lumma | 53d491fcb95b0cd2c073b1a2b7dc8c032e9de2d9422ac13170fe5975b78f6a7e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2025, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 362KB
Sample250315-1xtkjsvtcs
SHA256 53d491fcb95b0cd2c073b1a2b7dc8c032e9de2d9422ac13170fe5975b78f6a7e
MD5 38da35e91c9aeea07d77b7df32e30591
SHA1 49eebb6f1db4065b62e276f61c6f2c6abc0cb66e
SHA512 739d88b2df68063eb0771cfa538bc5fdf9f3485c114c454dfa0dcce554e89cc39e3b970d689bd4c8a80ad595761a39928620cf43c05feb0aea92433870f0b8e0
SSDEEP 6144:YFDI5CzTBC/2tX8QPfembZUrALjlX4goEjkelY2NW2UYclVyqMvhm:YWCzTM2dzPblUrAv5oSs2UZAhm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealc vidar default e3a5dc9f3619e7e1987b9fcc98b49843 credential_access discovery persistence spyware stealer

Malware Config

Extracted

Family

vidar

Version

13.2

Botnet

e3a5dc9f3619e7e1987b9fcc98b49843

https://t.me/g_etcontent
https://steamcommunity.com/profiles/76561199832267488

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Firefox/135.0

Extracted

Family

lumma

https://citywand.live/api
https://crosshairc.life/api
https://smrodularmall.top/api
https://jowinjoinery.icu/api
https://legenassedk.top/api
https://htardwarehu.icu/api
https://cjlaspcorne.icu/api
https://sqbugildbett.top/api
https://weaponrywo.digital/api

Extracted

Family

stealc

Botnet

default

http://77.90.153.241

Attributes

url_path
/612acd258782ade8.php

Signatures

Detect Vidar Stealer 44 IoCs

stealer

resource	yara_rule
behavioral2/memory/5748-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-1-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-2-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-11-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-12-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-17-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-18-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-21-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-25-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-26-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-27-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-31-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-35-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-79-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-80-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-81-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-82-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-85-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-89-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-90-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-91-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-95-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-148-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-365-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-389-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-392-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-394-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-395-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-398-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-399-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-400-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-401-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-402-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-403-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-404-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/5748-518-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/11016-773-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/11016-787-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/11016-788-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/11016-793-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/11016-794-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/11016-797-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/11016-801-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/11016-802-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Downloads MZ/PE file 11 IoCs

flow	pid	Process
194	2216	0tsFSmRn7VXJVzhQ.exe
174	5748	MSBuild.exe
174	5748	MSBuild.exe
304	4512	MSBuild.exe
304	4512	MSBuild.exe
304	4512	MSBuild.exe
304	4512	MSBuild.exe
304	4512	MSBuild.exe
304	4512	MSBuild.exe
309	4512	MSBuild.exe
474	11016	MSBuild.exe

Uses browser remote debugging 2 TTPs 26 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2968	msedge.exe
9476	chrome.exe
8208	msedge.exe
7640	msedge.exe
5868	msedge.exe
4360	msedge.exe
3992	msedge.exe
3184	msedge.exe
9180	chrome.exe
8860	chrome.exe
5116	chrome.exe
3552	chrome.exe
5072	chrome.exe
1288	chrome.exe
4916	chrome.exe
9188	chrome.exe
4244	chrome.exe
2892	chrome.exe
5372	msedge.exe
4632	msedge.exe
9112	chrome.exe
8188	msedge.exe
7632	msedge.exe
2560	chrome.exe
4556	chrome.exe
4940	chrome.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk	0tsFSmRn7VXJVzhQ.exe

Executes dropped EXE 18 IoCs

pid	Process
5196	ph47ymoppp.exe
5228	iw479riw47.exe
3904	opppp8y5fk.exe
2216	0tsFSmRn7VXJVzhQ.exe
5644	lIu7OTF78jTO86ef.exe
3040	7Jaf5gSyHvQvqtZJ.exe
11124	uLRg2rYDBU005g64.exe
948	AKJDGIEHCA.exe
5376	AKEGIIJDGH.exe
3284	BFBFBFIIJD.exe
2736	wTxyMIMQavXh7bkE.exe
5080	hq4uFxXoNbY1hcpG.exe
23448	58gd2v3ozm.exe
22056	a1ngvkfkno.exe
7996	58gd2v3ozm.exe
7872	GtYt9b33QLRmb1YI.exe
8036	3MN1MFWEVUGLfIA3.exe
23380	c20ozOeJ2XmMNYun.exe

Loads dropped DLL 2 IoCs

pid	Process
4512	MSBuild.exe
4512	MSBuild.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleChrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CAmk4y8W\\0tsFSmRn7VXJVzhQ.exe"	0tsFSmRn7VXJVzhQ.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1860 set thread context of 5748	1860	file.exe	86
PID 5196 set thread context of 5672	5196	ph47ymoppp.exe	117
PID 5228 set thread context of 4512	5228	iw479riw47.exe	120
PID 3040 set thread context of 4736	3040	7Jaf5gSyHvQvqtZJ.exe	138
PID 948 set thread context of 11016	948	AKJDGIEHCA.exe	164
PID 23448 set thread context of 23504	23448	58gd2v3ozm.exe	202

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
11240	5644	WerFault.exe	123
17384	2736	WerFault.exe	171
17396	5080	WerFault.exe	172
23312	11124	WerFault.exe	155

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hq4uFxXoNbY1hcpG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GtYt9b33QLRmb1YI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c20ozOeJ2XmMNYun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lIu7OTF78jTO86ef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opppp8y5fk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BFBFBFIIJD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3MN1MFWEVUGLfIA3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0tsFSmRn7VXJVzhQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58gd2v3ozm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uLRg2rYDBU005g64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wTxyMIMQavXh7bkE.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5892	timeout.exe
15324	timeout.exe

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133865497430856687"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5748	MSBuild.exe
5748	MSBuild.exe
5748	MSBuild.exe
5748	MSBuild.exe
4556	chrome.exe
4556	chrome.exe
5748	MSBuild.exe
5748	MSBuild.exe
5748	MSBuild.exe
5748	MSBuild.exe
5748	MSBuild.exe
5748	MSBuild.exe
5748	MSBuild.exe
5748	MSBuild.exe
4512	MSBuild.exe
4512	MSBuild.exe
2216	0tsFSmRn7VXJVzhQ.exe
2216	0tsFSmRn7VXJVzhQ.exe
5644	lIu7OTF78jTO86ef.exe
5644	lIu7OTF78jTO86ef.exe
5644	lIu7OTF78jTO86ef.exe
5644	lIu7OTF78jTO86ef.exe
4512	MSBuild.exe
4512	MSBuild.exe
2892	chrome.exe
2892	chrome.exe
4512	MSBuild.exe
4512	MSBuild.exe
4512	MSBuild.exe
4512	MSBuild.exe
4512	MSBuild.exe
4512	MSBuild.exe
11124	uLRg2rYDBU005g64.exe
11124	uLRg2rYDBU005g64.exe
11124	uLRg2rYDBU005g64.exe
11124	uLRg2rYDBU005g64.exe
11124	uLRg2rYDBU005g64.exe
11124	uLRg2rYDBU005g64.exe
4512	MSBuild.exe
4512	MSBuild.exe
2736	wTxyMIMQavXh7bkE.exe
2736	wTxyMIMQavXh7bkE.exe
5080	hq4uFxXoNbY1hcpG.exe
5080	hq4uFxXoNbY1hcpG.exe
5080	hq4uFxXoNbY1hcpG.exe
5080	hq4uFxXoNbY1hcpG.exe
11016	MSBuild.exe
11016	MSBuild.exe
11016	MSBuild.exe
11016	MSBuild.exe
9476	chrome.exe
9476	chrome.exe
11016	MSBuild.exe
11016	MSBuild.exe
11016	MSBuild.exe
11016	MSBuild.exe
11016	MSBuild.exe
11016	MSBuild.exe
11016	MSBuild.exe
11016	MSBuild.exe
7872	GtYt9b33QLRmb1YI.exe
7872	GtYt9b33QLRmb1YI.exe
8036	3MN1MFWEVUGLfIA3.exe
8036	3MN1MFWEVUGLfIA3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
5868	msedge.exe
5868	msedge.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
5372	msedge.exe
5372	msedge.exe
9476	chrome.exe
9476	chrome.exe
9476	chrome.exe
9476	chrome.exe
8188	msedge.exe
8188	msedge.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeCreatePagefilePrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	9476	chrome.exe
Token: SeCreatePagefilePrivilege	9476	chrome.exe
Token: SeShutdownPrivilege	9476	chrome.exe
Token: SeCreatePagefilePrivilege	9476	chrome.exe
Token: SeShutdownPrivilege	9476	chrome.exe
Token: SeCreatePagefilePrivilege	9476	chrome.exe
Token: SeShutdownPrivilege	9476	chrome.exe
Token: SeCreatePagefilePrivilege	9476	chrome.exe
Token: SeShutdownPrivilege	9476	chrome.exe
Token: SeCreatePagefilePrivilege	9476	chrome.exe
Token: SeShutdownPrivilege	9476	chrome.exe
Token: SeCreatePagefilePrivilege	9476	chrome.exe
Token: SeShutdownPrivilege	9476	chrome.exe
Token: SeCreatePagefilePrivilege	9476	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
5868	msedge.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe
5372	msedge.exe
9476	chrome.exe
9476	chrome.exe
9476	chrome.exe
9476	chrome.exe
9476	chrome.exe
9476	chrome.exe
9476	chrome.exe
9476	chrome.exe
9476	chrome.exe
9476	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 5748	1860	file.exe	86
PID 1860 wrote to memory of 5748	1860	file.exe	86
PID 1860 wrote to memory of 5748	1860	file.exe	86
PID 1860 wrote to memory of 5748	1860	file.exe	86
PID 1860 wrote to memory of 5748	1860	file.exe	86
PID 1860 wrote to memory of 5748	1860	file.exe	86
PID 1860 wrote to memory of 5748	1860	file.exe	86
PID 1860 wrote to memory of 5748	1860	file.exe	86
PID 1860 wrote to memory of 5748	1860	file.exe	86
PID 1860 wrote to memory of 5748	1860	file.exe	86
PID 1860 wrote to memory of 5748	1860	file.exe	86
PID 1860 wrote to memory of 5748	1860	file.exe	86
PID 5748 wrote to memory of 4556	5748	MSBuild.exe	90
PID 5748 wrote to memory of 4556	5748	MSBuild.exe	90
PID 4556 wrote to memory of 2340	4556	chrome.exe	91
PID 4556 wrote to memory of 2340	4556	chrome.exe	91
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4952	4556	chrome.exe	93
PID 4556 wrote to memory of 4952	4556	chrome.exe	93
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 4792	4556	chrome.exe	92
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94
PID 4556 wrote to memory of 2752	4556	chrome.exe	94

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Downloads MZ/PE file
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff2395dcf8,0x7fff2395dd04,0x7fff2395dd10
      4⤵
      PID:2340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2072,i,7337544202359176015,11668969578054843441,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2068 /prefetch:2
      4⤵
      PID:4792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1996,i,7337544202359176015,11668969578054843441,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2184 /prefetch:3
      4⤵
      PID:4952
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2384,i,7337544202359176015,11668969578054843441,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2552 /prefetch:8
      4⤵
      PID:2752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3260,i,7337544202359176015,11668969578054843441,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3300,i,7337544202359176015,11668969578054843441,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4400,i,7337544202359176015,11668969578054843441,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4440 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:4244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4584,i,7337544202359176015,11668969578054843441,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4732 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4944,i,7337544202359176015,11668969578054843441,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5344 /prefetch:8
      4⤵
      PID:3520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5404,i,7337544202359176015,11668969578054843441,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5424 /prefetch:8
      4⤵
      PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7fff2393f208,0x7fff2393f214,0x7fff2393f220
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1904,i,3548274391046295716,2923139745168792732,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2116,i,3548274391046295716,2923139745168792732,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1956,i,3548274391046295716,2923139745168792732,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3560,i,3548274391046295716,2923139745168792732,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3568,i,3548274391046295716,2923139745168792732,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2968
- - C:\ProgramData\ph47ymoppp.exe
    "C:\ProgramData\ph47ymoppp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5196
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5672
- - C:\ProgramData\iw479riw47.exe
    "C:\ProgramData\iw479riw47.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5228
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Downloads MZ/PE file
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4512
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
        5⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:2892
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x11c,0x120,0x124,0x118,0xf4,0x7fff2387dcf8,0x7fff2387dd04,0x7fff2387dd10
        6⤵
        
        PID:2312
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1596,i,11736655786023246099,17107564757774193206,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2260 /prefetch:3
        6⤵
        
        PID:4820
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2052,i,11736655786023246099,17107564757774193206,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2000 /prefetch:2
        6⤵
        
        PID:2512
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2424,i,11736655786023246099,17107564757774193206,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2596 /prefetch:8
        6⤵
        
        PID:1640
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,11736655786023246099,17107564757774193206,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3188 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2560
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,11736655786023246099,17107564757774193206,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3216 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5072
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4300,i,11736655786023246099,17107564757774193206,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4316 /prefetch:2
        6⤵
        Uses browser remote debugging
        
        PID:1288
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4672,i,11736655786023246099,17107564757774193206,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4700 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4916
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5308,i,11736655786023246099,17107564757774193206,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5332 /prefetch:8
        6⤵
        
        PID:1412
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5284,i,11736655786023246099,17107564757774193206,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5468 /prefetch:8
        6⤵
        
        PID:4968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
        5⤵
        Uses browser remote debugging
        
        PID:3992
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --edge-skip-compat-layer-relaunch
        6⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff144ff208,0x7fff144ff214,0x7fff144ff220
        7⤵
        
        PID:2276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2196,i,15787972606570205130,9569675719474512426,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
        7⤵
        
        PID:3244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=276,i,15787972606570205130,9569675719474512426,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
        7⤵
        
        PID:1052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2520,i,15787972606570205130,9569675719474512426,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
        7⤵
        
        PID:4036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3524,i,15787972606570205130,9569675719474512426,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3536,i,15787972606570205130,9569675719474512426,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:4632
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AKJDGIEHCA.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11208
      - C:\Users\Admin\AKJDGIEHCA.exe
        
        "C:\Users\Admin\AKJDGIEHCA.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:948
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:11016
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:9476
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xf4,0x124,0x7fff2387dcf8,0x7fff2387dd04,0x7fff2387dd10
        9⤵
        
        PID:9468
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1580,i,4520278949860079079,15579279329881656486,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
        9⤵
        
        PID:9244
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2312,i,4520278949860079079,15579279329881656486,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
        9⤵
        
        PID:9236
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2092,i,4520278949860079079,15579279329881656486,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
        9⤵
        
        PID:9212
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3268,i,4520278949860079079,15579279329881656486,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:9188
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3288,i,4520278949860079079,15579279329881656486,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:9180
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4216,i,4520278949860079079,15579279329881656486,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
        9⤵
        Uses browser remote debugging
        
        PID:9112
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4596,i,4520278949860079079,15579279329881656486,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:8860
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5368,i,4520278949860079079,15579279329881656486,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
        9⤵
        
        PID:8564
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5508,i,4520278949860079079,15579279329881656486,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
        9⤵
        
        PID:8516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        
        PID:8208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --edge-skip-compat-layer-relaunch
        9⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:8188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff144ff208,0x7fff144ff214,0x7fff144ff220
        10⤵
        
        PID:8160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2324,i,3903122546502457374,13266651474600047588,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
        10⤵
        
        PID:7924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1940,i,3903122546502457374,13266651474600047588,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
        10⤵
        
        PID:7916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2376,i,3903122546502457374,13266651474600047588,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
        10⤵
        
        PID:7880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,3903122546502457374,13266651474600047588,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:7640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3484,i,3903122546502457374,13266651474600047588,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:7632
        
        C:\ProgramData\58gd2v3ozm.exe
        
        "C:\ProgramData\58gd2v3ozm.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:23448
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:23504
        
        C:\ProgramData\a1ngvkfkno.exe
        
        "C:\ProgramData\a1ngvkfkno.exe"
        8⤵
        Executes dropped EXE
        
        PID:22056
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        
        PID:8148
        
        C:\ProgramData\58gd2v3ozm.exe
        
        "C:\ProgramData\58gd2v3ozm.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\97oUtPZG\GtYt9b33QLRmb1YI.exe
        
        C:\Users\Admin\AppData\Local\Temp\97oUtPZG\GtYt9b33QLRmb1YI.exe 0
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\97oUtPZG\c20ozOeJ2XmMNYun.exe
        
        C:\Users\Admin\AppData\Local\Temp\97oUtPZG\c20ozOeJ2XmMNYun.exe 7872
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:23380
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\sjmg4" & exit
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15372
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        9⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:15324
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AKEGIIJDGH.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
      - C:\Users\Admin\AKEGIIJDGH.exe
        
        "C:\Users\Admin\AKEGIIJDGH.exe"
        6⤵
        Executes dropped EXE
        
        PID:5376
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:5408
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\BFBFBFIIJD.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4944
      - C:\ProgramData\BFBFBFIIJD.exe
        
        "C:\ProgramData\BFBFBFIIJD.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\hcRTzVZ9\wTxyMIMQavXh7bkE.exe
        
        C:\Users\Admin\AppData\Local\Temp\hcRTzVZ9\wTxyMIMQavXh7bkE.exe 0
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\hcRTzVZ9\hq4uFxXoNbY1hcpG.exe
        
        C:\Users\Admin\AppData\Local\Temp\hcRTzVZ9\hq4uFxXoNbY1hcpG.exe 2736
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 652
        9⤵
        Program crash
        
        PID:17396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 672
        8⤵
        Program crash
        
        PID:17384
- - C:\ProgramData\opppp8y5fk.exe
    "C:\ProgramData\opppp8y5fk.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\CAmk4y8W\0tsFSmRn7VXJVzhQ.exe
      C:\Users\Admin\AppData\Local\Temp\CAmk4y8W\0tsFSmRn7VXJVzhQ.exe 0
      4⤵
      Downloads MZ/PE file
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\CAmk4y8W\lIu7OTF78jTO86ef.exe
        
        C:\Users\Admin\AppData\Local\Temp\CAmk4y8W\lIu7OTF78jTO86ef.exe 2216
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5644
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5644 -s 644
        6⤵
        Program crash
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\LisVxMxU\7Jaf5gSyHvQvqtZJ.exe
        
        C:\Users\Admin\AppData\Local\Temp\LisVxMxU\7Jaf5gSyHvQvqtZJ.exe 0
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3040
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\CAmk4y8W\uLRg2rYDBU005g64.exe
        
        C:\Users\Admin\AppData\Local\Temp\CAmk4y8W\uLRg2rYDBU005g64.exe 2216
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:11124
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11124 -s 624
        6⤵
        Program crash
        
        PID:23312
    - - C:\Users\Admin\AppData\Local\Temp\CAmk4y8W\3MN1MFWEVUGLfIA3.exe
        
        C:\Users\Admin\AppData\Local\Temp\CAmk4y8W\3MN1MFWEVUGLfIA3.exe 2216
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:8036
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\a16ph" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1624
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 11
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5892

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4468

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5644 -ip 5644
1⤵
PID:11184

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:9204

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:7608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5080 -ip 5080
1⤵
PID:17260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2736 -ip 2736
1⤵
PID:17280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 11124 -ip 11124
1⤵
PID:23284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BFIJKEBFBFHIJJKEHDHI

Path C:\ProgramData\BFIJKEBFBFHIJJKEHDHI
Size 6KB
SHA256 d35750252d9f409a905eefc58fae2197b8c890e90874bd21b5fb4cedc0f37974
MD5 b928141b2e36e74752d1c379ec1c3540
SHA1 373d22dc4d0e23a9e290d09925b87032ce50cd89
SHA512 cb05ea0a0a78ac6de19752dc9954af4724cf8ef2d8f5b61a5d7b79281a5de6e881ec70f7d93c513f3e880ced58d11f9bea15bb787cc463961fe1158ef82b96d5
SSDEEP 96:xH7kUTUWIqGqYfb1mh1zS2LcoSSlVpdv9jNnHHi13AQeLcBw88n8L4cnHVV7g:SmDRYfb1mhRLcoSSfPOeLcBw88CLM
MD5 SHA1 SHA512 SSDEEP

Submit Download

EGDGIIJJ

Path C:\ProgramData\EGDGIIJJ
Size 228KB
SHA256 3a07b3003758a79a574aa73032076567870389751f2a959537257070da3a10d8
MD5 ee463e048e56b687d02521cd12788e2c
SHA1 ee26598f8e8643df84711960e66a20ecbc6321b8
SHA512 42b395bf6bd97da800385b9296b63a4b0edd7b3b50dc92f19e61a89235a42d37d204359b57d506e6b25ab95f16625cce035ed3b55ef2d54951c82332498dab0f
SSDEEP 192:J1mo3fT8a0QQnGzaW6qt8K+dJIhPJyiqzX1i+VpdssMV7due8FPu:r73fQrQQnyn6qt8K+dJIhPJyvzl5cYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

iw479riw47.exe

Path C:\ProgramData\iw479riw47.exe
Size 464KB
SHA256 e0244bd6e41657defabe82a544c6eeedf4ca7ba48dc8c70f4ec808980ae27786
MD5 fd9ad7a02f77e72ec3b077293dd329c3
SHA1 e6a9f93d2f282d198392956bbbf3df832be269a6
SHA512 e4901b99b4cd48ed84f17501b146565b1036af918a7408e6460c82db3a6b56babfb78ec3fdffa9393853b272a757e9a18ba280791b5965b4c74d3589920bb45a
SSDEEP 12288:DWCzTM2dzPblUrAv5oSUE/LMRBDcBV7sSGWeCc45lOL:DUePpaE/MBDcyWvcE6
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

opppp8y5fk.exe

Path C:\ProgramData\opppp8y5fk.exe
Size 251KB
SHA256 dcc05c3ac7ae22d601bcb7c97cfcda568f3041bd39b2fd8899282dfde83369a5
MD5 58d3a0d574e37dc90b40603f0658abd2
SHA1 bf5419ce7000113002b8112ace2a9ac35d0dc557
SHA512 df61329a32e9261b01c5b7d95e0d9a3fb8cc36e5d90ede72bc16befe00fb32c221898a8346db9de07c0f5dcba57dcdbb09a22ca8b73223f989d33ec433c3a90a
SSDEEP 6144:fo5FKmVjbskNWDV6wyZYbn5tMfWsfTx2n83Oixf:k8CskNiV6yo7eixf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ph47ymoppp.exe

Path C:\ProgramData\ph47ymoppp.exe
Size 575KB
SHA256 3517e38cd4c9ecb63b50498ebe837e870374f7e8bd9a4c8b7584f6e590c6b15d
MD5 f1fd0248cc742ba94edce47043b2b827
SHA1 2e8db5d05d34df5340be1ccc5b2cb7f1d07e0c26
SHA512 1ac4e15c35aa3c2fa45cbde3c94d8adbdbe0679e6f143fe86233397c1d1bef1c50d36f94954ca1b51af5f3be55063d6e34a85d51535e79dd319f2e689313b38c
SSDEEP 12288:lWCzTM2dzPblUrAv5oSHc+e1RoKq/T/+Kc5fBzBS0+I4d0Z2cdOBPGM:lUePpeboz/aKc5fr3l4dzcYPr
MD5 SHA1 SHA512 SSDEEP

Submit Download

cjwbaa

Path C:\ProgramData\sjmg4\cjwbaa
Size 288KB
SHA256 21b3dccb841428c8ac8a97af79bd17b8c964a2d6e0aeb9fbd126124faf3c3f35
MD5 2b4012814b88c028ff60a3d2581f0995
SHA1 6e431deae05a1807c53496eb0c9fe8873b947b0a
SHA512 bac9044f39087c11f884cf32fdb7baae0a4b99786272d48e90d5429aeabf5ff6c179e21f1e56c57b323bb6cc3a5bfa4a7ea705581b8de354549a5c2a28d08fcb
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vHW9+CmIFg:f1zkVmvQhyn+Zoz67AW9TmIFg
MD5 SHA1 SHA512 SSDEEP

Submit Download

pph4eu

Path C:\ProgramData\sjmg4\pph4eu
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
MD5 SHA1 SHA512 SSDEEP

Submit Download

wlxlfkfuk

Path C:\ProgramData\sjmg4\wlxlfkfuk
Size 56KB
SHA256 bb923abf471bb79086ff9ace293602e1ad882d9af7946dda17ff1c3a7e19f45b
MD5 1c832d859b03f2e59817374006fe1189
SHA1 a4994a54e9f46a6c86ff92280c6dabe2bcd4cc42
SHA512 c4d3be414fa5dd30151cde9f6d808d56c26b031ff3f6446d21a15d071053787b6ba337b12909a56af7bb420f858dba5213f08e64ca9f836f52c98a18762b4bef
SSDEEP 96:QkS/KLPeymOcVizhGNOnfXG38tyvFbn8MouB6w9f/nP:04cVizhGNOnu/7Iw9fP
MD5 SHA1 SHA512 SSDEEP

Submit Download

wt000r9zm

Path C:\ProgramData\sjmg4\wt000r9zm
Size 40KB
SHA256 c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e
MD5 dfd4f60adc85fc874327517efed62ff7
SHA1 f97489afb75bfd5ee52892f37383fbc85aa14a69
SHA512 d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4
SSDEEP 96:iLSQCn8MouB6w9f/8iZqmvJKLPeymwil:iLSQG7Iw9fEiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

z58qqq

Path C:\ProgramData\sjmg4\z58qqq
Size 130KB
SHA256 68299da817eae848e11e55825244470d5e8f47d6c3100788b16b46ed3b58cbf0
MD5 81ada8b1b469c06e5740672a9d10ab42
SHA1 ff10f40d463e2468d79f04ff646adaebfd76fc98
SHA512 041ddd13f282a408f0b859e2c911888c7d8609a7ceab8e816aa970b6f5681e3454468ac12707dcbe06f02c22030ac06dcf9337d8ea46ef12fd947dbdc6fd85e9
SSDEEP 192:YB4BvnXuvkUUo4nVaIvsb5wSkpX6zLLZq9VumRYW:SovXuvepnkIvsb5wS49VumRYW
MD5 SHA1 SHA512 SSDEEP

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4b4c804b4afd7385d172358f481b45fb5eeeade16251d036555fc4c1abbadfc8
MD5 0792092a8affb9c9b08c0c6f46dca0e4
SHA1 0100a83f5b608ee1bd8376d3e2561ac44eec6328
SHA512 78255472767630ce1e81dc72349c40060bd1bdecf0d970335a0e8e6e6098b282d422280e9a358c52f3dc989ce4bbf326a5e9606910f9739e17ec030334617062
MD5 SHA1 SHA512

Submit Download

5b7937a9-3d97-41d3-a9df-30d79043e3d0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5b7937a9-3d97-41d3-a9df-30d79043e3d0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 044cd2e0ec00949a45705757fe819e297ed14d2b772f5ad3935bccafe32ed5ff
MD5 fa751727bf1f71ad2e1fbec853f22f9c
SHA1 638e0e56034c2fb7b9ceb24b52a424b1488e875d
SHA512 d570e95ebc6cd446708a2f0a99f27d3f1aef9e14168f402a145f9c70b2296e14112bec372b41d4b4d1be7829b2eb183f220c4fc27434945ab03aa4b99ff5ceae
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 1875727f7c5155631db94a9bd7203b63ed76ddfe032d9b978c183fd1222a1cb8
MD5 e4f8843c29c77ff7413cb07eda9ce07c
SHA1 037fa344230967213f467b2cb92a16b969b7ff31
SHA512 783e94b50b19749578ed84256cbd73062f203bf90f871e0d5207814f2ef6c22fcbee1274ee3c09b94efcfde1bc98da1b61c5ae830c6187baa539dd2f71e535ac
SSDEEP 6:/FoEXE9Ck8fkNEh9YKv1LYknCkLV6Cr+wPtGomEDqCGSctl/enS:d7Xa8MNEh9VL5Eotl3x3GSctll
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 795a93889831952d2fbb3ae0e4b403b37cf8569d6abb26bd62e049c9ab7901ff
MD5 7aa54b0247334285e006ca8ebce86e01
SHA1 431cb7fd05553fb1d91ab0b40959d1895dd53b61
SHA512 aaff5603aa425a5ddedf1a8de84c31f21ec57118b933b369497f867ac99d341ffac7abdce06d901b0f8c584ce9899c5e8d141f9b3134f7aa88d2e044e34f7bf6
SSDEEP 48:/TDBYhLOQVMCXg9StoMiXWrRGxoyCqS8aBCy3aAW0:2hCQV/g9dDWlPDqSCy3aJ0
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 db56da6504a713c2e8655f5805f96ab2332d91a43f42cebcf9babb851b8e7f0f
MD5 db302308d3572e5e0e4d416356116e32
SHA1 e7d56692b42a16feb698b37dd679fb75773977f4
SHA512 3a5d7398c544568d94cf2e99dde9f51991cdeacf1123882b87ada2edf035dc136bfe658e64aa5e9d33943b233ebeeae2d9c4958f597f81c641fe5dfacb26997d
SSDEEP 768:QDb4yb4xb4cj94CfDPLSgcRUv+hcd46UfDPLSgcRUv+Ycd4DUfDPLSgcRUv+jcd4:0bVb+bVj9Pdhdnd
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 35KB
SHA256 4ad44f91b221fcff91bc257050b4a14bbfb4e985d1809b9d966a24e071caf297
MD5 daa184a0256ad85ccfd55438b61856cd
SHA1 aeb8baff5db69f0f09e75301cf95728e3ec2c76a
SHA512 833fd504358cd6bac836974958c263794c96307ae05122e66e11d7d49b1630eaa78ab23ed18ed8c47d0a36c15876244f6302eb777f2795ef4d4fc85a8c12a080
SSDEEP 768:4b2trKrylaoqwhhIV4CjvT+C1oZ1HfibDjWsWfDAwatWkNpLYhZ1NqStLO:0YjaghhI+e+C1SHKvcDAwaWkvW9/Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 3af3bd13725eef2ce7f7823ad97d2c1d3ac0120fc9f49cfd31d11f5372098559
MD5 3ad26e87a9e5207e451db4cb5d3a597f
SHA1 052fee8c81966ae3e14cf5c9f5d4c5ff781a5037
SHA512 82b351e763a1775774b08251bc68d1322b2b65b9bc15ed62554cde53a830f78432c986314d388b29eccc4ffc2c3980f139b92a687175c032ee8177faa8d56396
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log
Size 106B
SHA256 3a0abb41f1f0fe1382e1a68d716c9fe77e222a518a2d468ad4c98dd82b8f3b15
MD5 c441b448b2ed3281ec2d040b40aaf8a3
SHA1 0cdb52276b299da33a381dc57c23a987a4670eab
SHA512 3eeb4f51e1f68b6ffda74ea9e6b027744e1b10bb30fae8f97790fd82874252a177e57bb8c9a291b4664b0116d00336576cef016d6fad344d375bbbaa0f0f9f53
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG
Size 404B
SHA256 6bdaa9ef71bde82515895d7c2a28db6de1b928244be0c7aefc711e9b491ff1ad
MD5 374d24d3187ff21bc5af8a978d6e0c58
SHA1 cde75cf960999157c4235535fde37fab95224c98
SHA512 aa2dfe450e97b629681c592b56bb4fcfe9689ba44ff7dd3291856141b1363e020004f4676c8fa6b15dd1a3b2f085644fe69795b5ba243477162d8d9ab35a2bbf
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 3146e1fd2a895fbc196a5f616faa09fe4b1320ab766ac191c3ae5f1f9bd8104b
MD5 e21ccb2a1b9a5e9593b485b4d7f54ed1
SHA1 1075da7de50f41d6110d275e13c348869de7b4c5
SHA512 36167455151ad83e25b39da2973c078899537c14c7cadb8178790a685c72680501d53a5f82462032048dd08281f87a478ad157d32c759ddd1d76155efc250d32
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG
Size 334B
SHA256 249619a0d264cc65003ac5b9f4928ce6c91f9f4609a35e6880d0d4c263b8a4cf
MD5 dcac704e1c6612b40a866172b7d74f0f
SHA1 9a793a0352d44b3bee52ae331c3e0a488c00cb47
SHA512 2d4e2e9e3609c8e608bc7a92ba367eef6b6ddbfbead4e9596aeefbf8675bbb4a2fe5c92f0f3b72c28402ec234ecd08ca7a49bc237a82723b3fab1ac3746df122
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 3KB
SHA256 ba6536c072e12ddeb921c87477102c168252f9eea2abff4f6ae106c730a3a222
MD5 7d990de665d0a79a6d642fcc6da2d6bb
SHA1 236e9b4975f18b5bfbc93c6e241288d98ff983be
SHA512 bdc08be32704b00cd33bed508cca4ddf1c8d0e6c82c40540473b0f3894dbb8e0a9efa6c97e9de6abf24ce589f3f062aec95ebcd3a06754e25c2f37fe6b33a9c5
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 c58163eb4d5c87ec6356cf1c2d18da0d5c27ad54499af958a81fd131a26b7d5c
MD5 321e58f756731e3698aa54d65e5ed6a4
SHA1 260c74a7a5709683e3c58db6598008928b5d5aeb
SHA512 2955503719a735305a401ba797912005d3ac9b93bd65af86b42477a5fdeef4b434e34da86a52106a2a4437e8b275a30d331c77e59cb8a180efebd6a5d057d1a7
MD5 SHA1 SHA512

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 128KB
SHA256 bcd361261b958afd0f8fbfb18c4eda3401ae1fff3f2b3dee947b8cb3d0ecf416
MD5 028d7845b069fb83c99db7cda3aee936
SHA1 c2be7849b640a02c03c489d8f6c3b0209acceb93
SHA512 c76b5ef824933e60afb952d592b9667582d67780131401998c0b5f34c8413b2ad736d82fffc6629cb835ff7614d542abb5f09cea72efe064e23dcfa88f41f852
SSDEEP 1536:jEO+9lhvoaEAoAf0OliS9XbrrJQiFZcBaw7ILYzEVKOAKa4q32O1I5Z+dOOXW+xg:MoE9Xb9ZevcKOAKaN2O1IwOOJxX9O
MD5 SHA1 SHA512 SSDEEP

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 343KB
SHA256 71118322ef09a3988c0e29fa888e4cfb8309cd2e425ceaebeb4a0dac50b671e1
MD5 235ad81f37c2f1be98e0f28e986c0caa
SHA1 b4445ff79b1a1c45c488eba2328ddee909f4e367
SHA512 0ddf345a66cefe8dd2ef38e1f85de97e021a6279167ae2f347015d728498d59f5a0db7b7f5a7bb9a5fd033940f272a9af7cd832ddc2c34ca92d5c4b9b04584a5
SSDEEP 3072:4J9MGKn0oI+YTtiaW3t5Txle/vu93GZcxy+5ZHfV0RSj+kuyBBhlkOPSWjrZauJu:4YDVJaW51le/EiSzH5jB8sSWfHJNrbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 9ca7afd1b3969dd5c1a8941e31f785fba3a24aa5fd34dfcfe337271f7d1d3859
MD5 8db62a6c6f0fce6178a95abffab2c2cf
SHA1 3f9282b8070b61e6ab2bf956931933a73c20a1f4
SHA512 d52112acdd959ccdd6e5fa834f9d04de5c6f8980765328ce8b3b1fb6ac79ab3cc5566b01f0c7fd2777b6b7e7e98190203e37261464768be5d0958bdbb54a622b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 308B
SHA256 cbee1100a2c9add47776b7e416b58a809f6feb9fe458bef8185b0c176b5db340
MD5 4e7982b86b3d7d916b7722aa3b3f0669
SHA1 ce4e874903cb71d9012cc7654ca7a6ba5e4f7efd
SHA512 c4dda8b36e90a327061dab901730f47fc23cca129b02a157f1ed0c566a1d6dddf272a4e74d3acbf14eb3a7fac0820387a584db9e19ca299724ed7f3030f891bb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 55281e911c10b130daedb791fe4c2cb86dc53db24fd646986bdec359b465cba6
MD5 bb9832452fe192a1a85e66cc2b62f708
SHA1 bad5dd4d365c1e3824b5a0961fc931175135316d
SHA512 33081e0391ae17ab580d0f0b17a03d0a511c4e1f06d73fd0a8ea395417ed076c5b178125645ae579781f14dc744a1b37049e2ac41647e9d0c46ec888a067d052
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 8dde1834820c03585d512197ce05cc706c79fb3e9e9c6fa240bfe4fb64467411
MD5 a03cd8d20c54904639426554f6cc475d
SHA1 486aad5b98d89391e3d03ea3361ffe240244af35
SHA512 b4676f495bc75667fb7e98c5f507922fdb5f804cd908ac08b2a9f084f3453ec2ca88754bd7abac4d9ded76579fc6d4967a0dc299528bffc0c3032fa0fa897992
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 abccc2ec772d00713b87d33c9a9c436b71fcb8fd006b63cf5002fa1a8d996c00
MD5 99c735584a40bb130324b8c996c209f8
SHA1 6c3eb53492ada0c9a93199d2db000b6ae7032255
SHA512 0430e3dec1f73eb54bb77fcc551e3d342414fa2424b1da07bd7a645fa8863fdf8d7a32076d33fafde804f21318d29d1c50b11592ee4dd1c66a3aa224fd73c306
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 130KB
SHA256 c02a293aa1f118be9d5f59a9f92ad5f18c592d56e02ad21e362fba7462cc85e2
MD5 7719393e6592de724421cf5eff0c4b3b
SHA1 6fbaee6b66cb85d2ae997891bec997125b39a187
SHA512 44c7c60312996dc072af34bbba961eee356b4d87e6c9f0f4ac2c746c760859cd7a776de2099c24abd42feac08faffa119d844769ac44b7b0ccabb843936dc503
SSDEEP 192:oB4BvnXuvkUUo4nVaIvsb5wSkpX6bZq9VumRYW:iovXuvepnkIvsb5wS49VumRYW
MD5 SHA1 SHA512 SSDEEP

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 e0966ff12530c700f963f54ae928394174a6ec644115d02df6c726500076af79
MD5 ca39824be21ca46dec01d329078cf479
SHA1 96bccec633c1246dca1febb1297d454c672c4763
SHA512 d4737f3b8bbc4b916b3ca8862f37bd00134eb1efb7f690ff433c0765e9295d8e204db86731acc32fee5605b46df99ddfc8e9667471f74baa708ce538abfdce77
SSDEEP 3:IlnlllNllv/etXlZcWEpoll+qg/G9EZtaXM/RuW3Kb6z/LMQ/iHKb6z/LMQ42FQo:IlnlSlWWEp4MLWc/XKuqHKu429Elu
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 b56dd356e7679927868acf8a018ca8ce83906c619cf11bd0a765e4e3977329b9
MD5 a87495d61b8c16e77ff039ea729a40bf
SHA1 2036a01fd9e20bf4a22f68e9fcde69ea191b7927
SHA512 b1ff1b6066e95248afcd895712d867716f24d92e05fb0985ad4bf6d7b0e62fada040cc11e12f379ba254c717220a9a8e5f8328655b4aba19af79c257075a8054
SSDEEP 384:FWNF1sdGjtpCwvcfQyIIIRbpMIMHBLissxsdGhyLn+VTsdG0HnsdG/RdGN6ZEsdi:+t6fQByLDFiYC
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 e860effaac372b1fa8ba5a0ba4ffbf4c80406d582209a64fdeaf20e4390c2f4e
MD5 06aba99d06035eb0b79464fc3c204df4
SHA1 70499a904f80bd96534c471e31a8fb22042e2f3c
SHA512 446e3a5607c741675e118c0a91a85b584b9394c1cc28a4889f0d3fce4e0a7482570a117cf2fce4a67b8fa05e634ec8471493a3b10cbd79b4033525b4b451d999
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 770d33dc781ed19da2a9b76240d7907d311f97aa6c7088a734579f21052389eb
MD5 9d8ba31200decc52776860700252ee80
SHA1 790c8d6fc8fc9e967eb390bdb37565e25da666cc
SHA512 ba32160a2fbe7f1e3032feef9159d9bb76dd971c06178e26cf5b1ef83c2d9e4e106c9b7180155add0a748c8cb2ef9ba8f2c846bf8b4eccdfb9f23cc6b8f6eeef
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 3dd5b22578e18b483c3e42239bc11c5141875d913d090681692244d40415ed4e
MD5 ef410785580a87b8f507a5fc8a2a6af8
SHA1 67633f5879e04e7749a2c784bc63eca59f3e5f9c
SHA512 ecb9e83c7b44934e08e3721e88e0aa6d24f146586b7bf2a968e5eaf37f84561517e34342bf93c48293f7eacd472d072e3bcfaf59803901d62a02335f1b0e1645
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0
Size 44KB
SHA256 2dfeaa28fe8c6f6e2a13c195dd792fc56c39fe87d1677bffdab23d4616bd5628
MD5 a07ba75d08736bc1cb2ec065391bf15a
SHA1 e0b66c36d457bbc8d11cb7060aba5a4ecd17f4ed
SHA512 d3f350fdde69815ce575609e34a15d83bfa0239ec9516eb8521c153869d8cbc39fdf86a1606f2849d5096833aacf36f5ddef030dcf7ad84684068bb2b611c82f
SSDEEP 24:dCkN8EinjKkIkOZqgYk//g6d697M9vXwBKEkE3J+Wl8ycO/yrmpgw2g8EJJrJ/E:PMjpIBD/7w4EkgIM/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 844b52aeba5b7b269521b7ea8f46696da322dc97a31fd32e4323859b181d246d
MD5 216483c971455add053d450bd570922b
SHA1 e304422680c75b8f1c56067fcb79ff399314c072
SHA512 14636dfef9a7d830f9d5bc5f3b1fccc8439b757f559327636d5bd54e1afa8b2f76ffedd82d27a4ef4b869731e8e458246d26f5d2e87ed6087716c88edaf4b688
SSDEEP 96:9XST2uSbOIS+/OQSvoSS2S3DSJLDSFMSlvSTVxhStTSmrSRZMS1QcSTJuSESPSTi:9K2tOS/OT+JMQtixmfyatTWe+lfYh
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3
Size 4.0MB
SHA256 4cfc77cfd07bbefbcc4e1b37d8fbb7756c79a448a9333d404a04ca2716120c67
MD5 c5ccab923b8f9c3ba251513c689b6ca0
SHA1 7947904f2bba18fb2a1dd5ab535239c7dc8dd294
SHA512 e24ccd33d3d240fd71ac6a8396e451ca3c8a88c3659776cb4ab75361a7492f2672b7c9225dea774be6e39d370906203b68818e0ac524e360d8ce511bfd44248e
SSDEEP 3072:5iLEeJIaVmxC3EE9MQzg8YZ64+Uwt3zPs8QIwZ:
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
MD5 a4710a30ca124ef24daf2c2462a1da92
SHA1 96958e2fe60d71e08ea922dfd5e69a50e38cc5db
SHA512 43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 80KB
SHA256 0e0e2e36e0e232d405b88c1fba1fb1d2b5c280d1f191bae44358e24a95fea79b
MD5 3be1c873508cadfbd19c3d9a9581af00
SHA1 7c7f68a675bbe05c2bb9175530c55a20a46b0c57
SHA512 a2c62ab19da1521fefa4243e35d8b9d62df0436b867d69e3644cef5965b7cf1a7aff30773ef125832acae22916fd587f83687b4ecff2b62576b8aee6c4fdc60c
SSDEEP 1536:L8wNjdpr3nOOJZd5d3Apv/x49GeaJTNnoV7SadJAfAkP3/2HNHGUrq+U:fFD3laXx49GdfoV7S6JAYkP/s8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c3a2f26d5aef8b5ed1d23b59ed6fce952b48194bed69e108a48f78aec72126e0
MD5 60d40d2b37759323c10800b75df359b8
SHA1 f5890e7d8fc1976fe036fea293832d2e9968c05c
SHA512 0c339563594cc9f930a64903281589886308d4412ee267e976520a58d86b2c339d7b2320e1b3fd6fbf81f092ff1735f0710c669af2986ea5b63d2c1e0a6df902
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cfe29cd70971bb1cb2fc97f872c64d1167ff163378a138fdf20006421501e693
MD5 a9efc13ca6c6528bae67ac7c50d015eb
SHA1 53815386c3c25c853ab5068788360df0e6d62d81
SHA512 b94428759869fc16138a4d5e3f0c489336832ad8824ec0d65120ec605ebe89acbc162999c4b21e14bac33526255eaa06241084a8c2d8c0adfb2e10cb75ea316d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe5bb971ed4f60cfcef7167eed41a81d9b82c316f66f58586a7b2301ca6410af
MD5 12a81ff3afec1df49b2c88f23fd070fe
SHA1 ca3f02abb2996a190202cc3861713cb4c3b8caaf
SHA512 9c190902f5e28ece2ab57700907e1be6344b1613c9407c4f2b8fbc8c6118e828d6b48df38aa96040588588f249c7aead8016f1ea6603d5612a5f180224c40b34
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84644c8024a9a8b745bd5e8bc09211e293c73cf2d03be8156753772d25bd1064
MD5 f67e6648a9aaabed7f6221b3fc1a769a
SHA1 83daea0d2fba0fcb3d6e284b9bfb7c6a4a6fc524
SHA512 1f7ffeba8844599186ac7366d6c0bc3a1b2aa06df5eff7f967d4844412bf6a9d3fd664323b5d54764dfecc5cd560ce6bd5e5deedc592809c01239bf233f2bdc1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\548e3de4-5f7a-478f-be3d-50e211f1a149\index-dir\the-real-index
Size 1KB
SHA256 7f986716688d657764a8d5827a34dd12cff3995750f3ff92cc6b7a5a8527d36c
MD5 e7f6a897256f74bd9751ac4feac2d63a
SHA1 8220d7445456b99196a24f7743479a548916c0e9
SHA512 4b9e928f6b58c496669332aa9e324bc8aa90d1f1214291cff6e05d2e78e78bff24248bd1104b37cc5a02762f789ecb05e312b1cb7bf7b639571d7c86520aba76
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\548e3de4-5f7a-478f-be3d-50e211f1a149\index-dir\the-real-index
Size 1KB
SHA256 06ebf1ea0bec0548edfd92a93acaec06f60e58a69c2015bc2e8ea8074fce6147
MD5 81c32008273a065bdd6e2a3ebee677e9
SHA1 333eee66b5e41d3630e4b74e326575feced4377c
SHA512 a188262da60c8f1399daf4abd827454eb492a5032a46b0ee69a0e36e91836e96e0bdbe0e8a10e2acf1d6350b881edc6adbee51ce2518050f0e0245073fa9130f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\548e3de4-5f7a-478f-be3d-50e211f1a149\index-dir\the-real-index
Size 2KB
SHA256 7b0a631d2a0fbc75a4cf168a3ca099438c5878a94d4cd38b5fc900fbd41a91f3
MD5 68a7ae1398d0b60c0eada743e41925ea
SHA1 b7f22795697751d07c0ff1d3123c23ee3d532437
SHA512 3b67dc5d35115cb340b16a272fdda1d587d9726c2c0860fa35516eb1c6750d7b80d4e192b3a3993f18bce739783f65959069e2e46f423a00e10785eb25ae4237
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\548e3de4-5f7a-478f-be3d-50e211f1a149\index-dir\the-real-index
Size 2KB
SHA256 c75cdac660fea0877640fef380898bf9e15333b4dd0111d0791bd6c545754cb7
MD5 9e8f2344d359c398699bec3fea01f917
SHA1 048fe8835dae92e256e489d6fb548a824beb2613
SHA512 0ce8d2cb3ecd050fcdbf927cce76a464e2e2104f66bb67ff80f3b06064c8fdc056f3faf79256755a457a75b71ba962cd11e583a3fe5eb40b688fb4b122a6c4d1
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe580078.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\548e3de4-5f7a-478f-be3d-50e211f1a149\index-dir\the-real-index~RFe580078.TMP
Size 2KB
SHA256 bbcc33aba27b55013d207b1f29dc4aef13d4f25646d983fadd50ef73ea182407
MD5 e004e633d730fe0e7ca12a0b921509aa
SHA1 e24da2f53ae136d19e0fdd1a40fa28e247875c23
SHA512 62f744c24b808fa2d334f48ff00f82ba1bbdde6d6c2a545b8b5a462a66589b54c0f475853f504148b60388aa4f5b7edb8b97b2c7715aa3ad2768d748788a4d1c
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe587e34.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\548e3de4-5f7a-478f-be3d-50e211f1a149\index-dir\the-real-index~RFe587e34.TMP
Size 2KB
SHA256 b3e70fd258495cf2f41524cf4ee5fdfbbc4c60150fdcddf105cf0b5ed57ecdbc
MD5 c7779589bd5cba13e578cc3b09b6bba3
SHA1 09b6c99b992ce9b435d219d663804f905eb38002
SHA512 a304b9753b763d0dcbe45ba8ab958702496a719860f12202d217fcdc57d5ff59fb12b24d491d7ae25c9e42dbc0e30ad5d33b4b57ee67b7f1a4fe1d7f308fc84b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 a66f5602931cb2b529e9645dd6f417ace9ae3b36a512b91814d90b4e64f59057
MD5 ad8c34b1ea16a34f85812e776bb7d631
SHA1 58e170474d063cae77e2eb5fd6c58056ef22fac6
SHA512 c6bc520352746e37d9451c3efe9354aa98d87e34e6e794fdc3824bf1ae616ed698351d5d5863be01bdeb70478039fccfe0c245ee11c605f3a236e21bae6f6d8e
SSDEEP 768:gliE6esE8lDldUGz3rbgSPUWswnztqfNK+Ffn/cqrF4MbBac6xG:deB85d73RL+FfnEqrFBkc6xG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3284-782-0x0000000000D60000-0x0000000000DA4000-memory.dmp

Download

memory/3904-443-0x0000000000DF0000-0x0000000000E34000-memory.dmp

Download

memory/4512-452-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4512-426-0x0000000000400000-0x0000000000650000-memory.dmp

Download

memory/4512-427-0x0000000000400000-0x0000000000650000-memory.dmp

Download

memory/5672-414-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/5672-415-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/5748-26-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-95-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-85-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-148-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-518-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-89-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-90-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-82-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-81-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-80-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-79-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-404-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-403-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-35-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-402-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-31-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-401-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-27-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-91-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-398-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-400-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-399-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-395-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-365-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-389-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-392-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-394-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-11-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5748-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/11016-802-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/11016-801-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/11016-797-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/11016-794-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/11016-793-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/11016-788-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/11016-787-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/11016-773-0x0000000000400000-0x0000000000429000-memory.dmp

Download