stealc | 8e5021734b22342186a7b51235fbccc3d72ca27aa940c5b5c5e876d9fd406a85

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
71256c11265d9762446983178290b1d2.exe
Size 974KB
Sample250326-slvdpsyrt5
SHA256 8e5021734b22342186a7b51235fbccc3d72ca27aa940c5b5c5e876d9fd406a85
MD5 71256c11265d9762446983178290b1d2
SHA1 3578f76f0705950d07affe6f0fcdfcd5ec8c66c6
SHA512 aa9e8353c5eab9e18ced0f2aa6770ba39bd622bfa3d9e1581c84d6bbf6f9dd0d02cf1f750b003afe1037b9be2e71c0be5581a6e9c4dc83d9297aed5bad08c98b
SSDEEP 12288:iNjIp/hT9uYSYtk4IhpvyQa/quIi6RaZZBDN0y9GcWNgRcES+3NG8JPm:iEhUTi8SQayuIEN8ukcGEPm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar 928af183c2a2807a3c0526e8c0c9369d default credential_access discovery persistence spyware stealer

Malware Config

Extracted

Family

vidar

Version

13.3

Botnet

928af183c2a2807a3c0526e8c0c9369d

https://t.me/lw25chm
https://steamcommunity.com/profiles/76561199839170361

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

stealc

Botnet

default

http://77.90.153.241

Attributes

url_path
/612acd258782ade8.php

Signatures

Detect Vidar Stealer 44 IoCs

stealer

resource	yara_rule
behavioral2/memory/4336-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-1-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-2-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-9-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-10-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-15-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-16-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-19-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-23-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-24-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-25-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-29-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-31-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-81-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-82-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-83-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-84-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-87-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-91-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-92-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-93-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-97-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-106-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-433-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-488-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-491-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-494-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-495-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-496-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-497-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-498-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-499-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-500-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/4336-551-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/12760-1553-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/12760-1570-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/12760-1571-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/12760-1576-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/12760-1577-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/12760-1580-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/12760-1584-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/12760-1585-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/12760-1586-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/12760-1590-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Downloads MZ/PE file 16 IoCs

flow	pid	Process
250	4336	MSBuild.exe
250	4336	MSBuild.exe
416	4916	MSBuild.exe
416	4916	MSBuild.exe
416	4916	MSBuild.exe
416	4916	MSBuild.exe
416	4916	MSBuild.exe
416	4916	MSBuild.exe
421	4916	MSBuild.exe
698	30244	MSBuild.exe
698	30244	MSBuild.exe
698	30244	MSBuild.exe
698	30244	MSBuild.exe
698	30244	MSBuild.exe
698	30244	MSBuild.exe
594	12760	MSBuild.exe

Uses browser remote debugging 2 TTPs 39 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
8564	chrome.exe
5132	msedge.exe
10956	chrome.exe
4028	chrome.exe
1872	msedge.exe
6340	msedge.exe
11240	chrome.exe
5104	chrome.exe
10960	chrome.exe
15964	msedge.exe
1248	msedge.exe
8828	chrome.exe
11284	chrome.exe
5364	chrome.exe
11548	chrome.exe
19404	msedge.exe
15984	msedge.exe
11540	chrome.exe
8816	chrome.exe
6616	msedge.exe
7632	msedge.exe
19396	msedge.exe
19956	msedge.exe
5072	chrome.exe
3712	msedge.exe
9188	chrome.exe
11812	msedge.exe
11828	msedge.exe
7748	msedge.exe
9864	chrome.exe
19960	msedge.exe
456	chrome.exe
4504	chrome.exe
5168	msedge.exe
10864	chrome.exe
10096	chrome.exe
2984	msedge.exe
3596	msedge.exe
8684	chrome.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk	FEXW2EMWBVltXKof.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk	asWnvZJqkhcgI0xd.exe

Executes dropped EXE 17 IoCs

pid	Process
4884	6xb1d2vs00.exe
3852	3ectjek689.exe
3108	9hl6p8qiek.exe
60	FEXW2EMWBVltXKof.exe
4708	asWnvZJqkhcgI0xd.exe
15884	KbJAimn5JGdHsjIK.exe
12668	DBFIDGIIIJ.exe
12680	AEBGIEGCFH.exe
12924	FCGIJKJJKE.exe
12940	plKHjCPvXJdzLUj0.exe
12992	mietaavNgylcmhaB.exe
30048	aasr1dbsjm.exe
30164	8y58gl689h.exe
30408	1ngvsr90ri.exe
30436	N9Zeu2fQuoPx4W3j.exe
30492	21HJGFJiRUpdVpvA.exe
19464	WXGy0ePzMcvwgNMS.exe

Loads dropped DLL 4 IoCs

pid	Process
4916	MSBuild.exe
4916	MSBuild.exe
30244	MSBuild.exe
30244	MSBuild.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleChrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PKG5gUky\\FEXW2EMWBVltXKof.exe"	FEXW2EMWBVltXKof.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 3572 set thread context of 4336	3572	71256c11265d9762446983178290b1d2.exe	89
PID 4884 set thread context of 3392	4884	6xb1d2vs00.exe	142
PID 3852 set thread context of 4916	3852	3ectjek689.exe	145
PID 12680 set thread context of 12760	12680	AEBGIEGCFH.exe	202
PID 12668 set thread context of 12896	12668	DBFIDGIIIJ.exe	206
PID 30048 set thread context of 30128	30048	aasr1dbsjm.exe	243
PID 30164 set thread context of 30244	30164	8y58gl689h.exe	246

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
11720	4708	WerFault.exe	148
17776	12992	WerFault.exe	209
17792	12940	WerFault.exe	208
23776	15884	WerFault.exe	183
29952	60	WerFault.exe	147
9560	30436	WerFault.exe	248

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21HJGFJiRUpdVpvA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KbJAimn5JGdHsjIK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FCGIJKJJKE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WXGy0ePzMcvwgNMS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asWnvZJqkhcgI0xd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plKHjCPvXJdzLUj0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9hl6p8qiek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FEXW2EMWBVltXKof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mietaavNgylcmhaB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ngvsr90ri.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	N9Zeu2fQuoPx4W3j.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
7584	timeout.exe
11164	timeout.exe

Enumerates system info in registry 2 TTPs 24 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133874756139147106"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3218366390-1258052702-4267193707-1000\{A5C50B73-ED55-4086-B832-57EAA9D797FC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4336	MSBuild.exe
4336	MSBuild.exe
4336	MSBuild.exe
4336	MSBuild.exe
5072	chrome.exe
5072	chrome.exe
4336	MSBuild.exe
4336	MSBuild.exe
4336	MSBuild.exe
4336	MSBuild.exe
4336	MSBuild.exe
4336	MSBuild.exe
4336	MSBuild.exe
4336	MSBuild.exe
3392	MSBuild.exe
3392	MSBuild.exe
3392	MSBuild.exe
3392	MSBuild.exe
60	FEXW2EMWBVltXKof.exe
60	FEXW2EMWBVltXKof.exe
4708	asWnvZJqkhcgI0xd.exe
4708	asWnvZJqkhcgI0xd.exe
4708	asWnvZJqkhcgI0xd.exe
4708	asWnvZJqkhcgI0xd.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
9188	chrome.exe
9188	chrome.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
15884	KbJAimn5JGdHsjIK.exe
15884	KbJAimn5JGdHsjIK.exe
15884	KbJAimn5JGdHsjIK.exe
15884	KbJAimn5JGdHsjIK.exe
15884	KbJAimn5JGdHsjIK.exe
15884	KbJAimn5JGdHsjIK.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
12940	plKHjCPvXJdzLUj0.exe
12940	plKHjCPvXJdzLUj0.exe
12992	mietaavNgylcmhaB.exe
12992	mietaavNgylcmhaB.exe
12992	mietaavNgylcmhaB.exe
12992	mietaavNgylcmhaB.exe
12896	MSBuild.exe
12896	MSBuild.exe
12896	MSBuild.exe
12896	MSBuild.exe
12760	MSBuild.exe
12760	MSBuild.exe
12760	MSBuild.exe
12760	MSBuild.exe
11284	chrome.exe
11284	chrome.exe
12760	MSBuild.exe
12760	MSBuild.exe
12760	MSBuild.exe
12760	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
11828	msedge.exe
11828	msedge.exe
11828	msedge.exe
11828	msedge.exe
11284	chrome.exe
11284	chrome.exe
11284	chrome.exe
11284	chrome.exe
15984	msedge.exe
15984	msedge.exe
9864	chrome.exe
9864	chrome.exe
9864	chrome.exe
9864	chrome.exe
19404	msedge.exe
19404	msedge.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	9188	chrome.exe
Token: SeCreatePagefilePrivilege	9188	chrome.exe
Token: SeShutdownPrivilege	9188	chrome.exe
Token: SeCreatePagefilePrivilege	9188	chrome.exe
Token: SeShutdownPrivilege	9188	chrome.exe
Token: SeCreatePagefilePrivilege	9188	chrome.exe
Token: SeShutdownPrivilege	9188	chrome.exe
Token: SeCreatePagefilePrivilege	9188	chrome.exe
Token: SeShutdownPrivilege	9188	chrome.exe
Token: SeCreatePagefilePrivilege	9188	chrome.exe
Token: SeShutdownPrivilege	9188	chrome.exe
Token: SeCreatePagefilePrivilege	9188	chrome.exe
Token: SeShutdownPrivilege	9188	chrome.exe
Token: SeCreatePagefilePrivilege	9188	chrome.exe
Token: SeShutdownPrivilege	11284	chrome.exe
Token: SeCreatePagefilePrivilege	11284	chrome.exe
Token: SeShutdownPrivilege	11284	chrome.exe
Token: SeCreatePagefilePrivilege	11284	chrome.exe
Token: SeShutdownPrivilege	11284	chrome.exe
Token: SeCreatePagefilePrivilege	11284	chrome.exe
Token: SeShutdownPrivilege	11284	chrome.exe
Token: SeCreatePagefilePrivilege	11284	chrome.exe
Token: SeShutdownPrivilege	11284	chrome.exe
Token: SeCreatePagefilePrivilege	11284	chrome.exe
Token: SeShutdownPrivilege	11284	chrome.exe
Token: SeCreatePagefilePrivilege	11284	chrome.exe
Token: SeShutdownPrivilege	11284	chrome.exe
Token: SeCreatePagefilePrivilege	11284	chrome.exe
Token: SeShutdownPrivilege	9864	chrome.exe
Token: SeCreatePagefilePrivilege	9864	chrome.exe
Token: SeShutdownPrivilege	9864	chrome.exe
Token: SeCreatePagefilePrivilege	9864	chrome.exe
Token: SeShutdownPrivilege	9864	chrome.exe
Token: SeCreatePagefilePrivilege	9864	chrome.exe
Token: SeShutdownPrivilege	9864	chrome.exe
Token: SeCreatePagefilePrivilege	9864	chrome.exe
Token: SeShutdownPrivilege	9864	chrome.exe
Token: SeCreatePagefilePrivilege	9864	chrome.exe
Token: SeShutdownPrivilege	9864	chrome.exe
Token: SeCreatePagefilePrivilege	9864	chrome.exe
Token: SeShutdownPrivilege	9864	chrome.exe
Token: SeCreatePagefilePrivilege	9864	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
1248	msedge.exe
1248	msedge.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
9188	chrome.exe
11828	msedge.exe
11828	msedge.exe
11284	chrome.exe
11284	chrome.exe
11284	chrome.exe
11284	chrome.exe
11284	chrome.exe
11284	chrome.exe
11284	chrome.exe
11284	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4336	3572	71256c11265d9762446983178290b1d2.exe	89
PID 3572 wrote to memory of 4336	3572	71256c11265d9762446983178290b1d2.exe	89
PID 3572 wrote to memory of 4336	3572	71256c11265d9762446983178290b1d2.exe	89
PID 3572 wrote to memory of 4336	3572	71256c11265d9762446983178290b1d2.exe	89
PID 3572 wrote to memory of 4336	3572	71256c11265d9762446983178290b1d2.exe	89
PID 3572 wrote to memory of 4336	3572	71256c11265d9762446983178290b1d2.exe	89
PID 3572 wrote to memory of 4336	3572	71256c11265d9762446983178290b1d2.exe	89
PID 3572 wrote to memory of 4336	3572	71256c11265d9762446983178290b1d2.exe	89
PID 3572 wrote to memory of 4336	3572	71256c11265d9762446983178290b1d2.exe	89
PID 3572 wrote to memory of 4336	3572	71256c11265d9762446983178290b1d2.exe	89
PID 3572 wrote to memory of 4336	3572	71256c11265d9762446983178290b1d2.exe	89
PID 3572 wrote to memory of 4336	3572	71256c11265d9762446983178290b1d2.exe	89
PID 4336 wrote to memory of 5072	4336	MSBuild.exe	99
PID 4336 wrote to memory of 5072	4336	MSBuild.exe	99
PID 5072 wrote to memory of 4848	5072	chrome.exe	100
PID 5072 wrote to memory of 4848	5072	chrome.exe	100
PID 5072 wrote to memory of 832	5072	chrome.exe	102
PID 5072 wrote to memory of 832	5072	chrome.exe	102
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 392	5072	chrome.exe	103
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104
PID 5072 wrote to memory of 2144	5072	chrome.exe	104

C:\Users\Admin\AppData\Local\Temp\71256c11265d9762446983178290b1d2.exe
"C:\Users\Admin\AppData\Local\Temp\71256c11265d9762446983178290b1d2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Downloads MZ/PE file
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffea11fdcf8,0x7ffea11fdd04,0x7ffea11fdd10
      4⤵
      PID:4848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1548,i,7112635563950980984,12455303088763928604,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2116 /prefetch:3
      4⤵
      PID:832
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2092,i,7112635563950980984,12455303088763928604,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2084 /prefetch:2
      4⤵
      PID:392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2396,i,7112635563950980984,12455303088763928604,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2420 /prefetch:8
      4⤵
      PID:2144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3144,i,7112635563950980984,12455303088763928604,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3156 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3096,i,7112635563950980984,12455303088763928604,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3196 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4260,i,7112635563950980984,12455303088763928604,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4292 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:5104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4568,i,7112635563950980984,12455303088763928604,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4644 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5320,i,7112635563950980984,12455303088763928604,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4840 /prefetch:8
      4⤵
      PID:4024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5236,i,7112635563950980984,12455303088763928604,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffe9141f208,0x7ffe9141f214,0x7ffe9141f220
      4⤵
      PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1952,i,3657101447220987756,10718263342774477529,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
      4⤵
      PID:376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2272,i,3657101447220987756,10718263342774477529,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2480,i,3657101447220987756,10718263342774477529,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:8
      4⤵
      PID:3876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3568,i,3657101447220987756,10718263342774477529,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3576,i,3657101447220987756,10718263342774477529,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4144,i,3657101447220987756,10718263342774477529,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4152,i,3657101447220987756,10718263342774477529,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:1872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5104,i,3657101447220987756,10718263342774477529,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5292,i,3657101447220987756,10718263342774477529,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5440,i,3657101447220987756,10718263342774477529,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4768,i,3657101447220987756,10718263342774477529,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6204,i,3657101447220987756,10718263342774477529,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6204,i,3657101447220987756,10718263342774477529,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
      4⤵
      PID:3188
- - C:\ProgramData\6xb1d2vs00.exe
    "C:\ProgramData\6xb1d2vs00.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4884
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:3516
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3392
- - C:\ProgramData\3ectjek689.exe
    "C:\ProgramData\3ectjek689.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3852
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Downloads MZ/PE file
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
        5⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:9188
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf8,0x124,0x7ffe9143dcf8,0x7ffe9143dd04,0x7ffe9143dd10
        6⤵
        
        PID:7576
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2112,i,7431145165257093407,17598259765710082139,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2108 /prefetch:2
        6⤵
        
        PID:7792
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1976,i,7431145165257093407,17598259765710082139,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2228 /prefetch:3
        6⤵
        
        PID:7752
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2308,i,7431145165257093407,17598259765710082139,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2324 /prefetch:8
        6⤵
        
        PID:9016
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,7431145165257093407,17598259765710082139,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3324 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:8816
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,7431145165257093407,17598259765710082139,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3300 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:8828
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4332,i,7431145165257093407,17598259765710082139,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4260 /prefetch:2
        6⤵
        Uses browser remote debugging
        
        PID:8684
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4624,i,7431145165257093407,17598259765710082139,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4676 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:8564
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5320,i,7431145165257093407,17598259765710082139,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5336 /prefetch:8
        6⤵
        
        PID:7512
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5556,i,7431145165257093407,17598259765710082139,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5576 /prefetch:8
        6⤵
        
        PID:7140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
        5⤵
        Uses browser remote debugging
        
        PID:11812
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --edge-skip-compat-layer-relaunch
        6⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:11828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe8ee3f208,0x7ffe8ee3f214,0x7ffe8ee3f220
        7⤵
        
        PID:11856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1880,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:3
        7⤵
        
        PID:12152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2600,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
        7⤵
        
        PID:12172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2072,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:8
        7⤵
        
        PID:12228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3380,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:5168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3400,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:6340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4080,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:6616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3792,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:2
        7⤵
        Uses browser remote debugging
        
        PID:5132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3984,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
        7⤵
        
        PID:6148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3640,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
        7⤵
        
        PID:11680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5456,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
        7⤵
        
        PID:11924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5432,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
        7⤵
        
        PID:11916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5316,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
        7⤵
        
        PID:16376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5316,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
        7⤵
        
        PID:13788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6668,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
        7⤵
        
        PID:14248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6700,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
        7⤵
        
        PID:13444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6800,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
        7⤵
        
        PID:13168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6780,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
        7⤵
        
        PID:15764
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6984,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
        7⤵
        
        PID:15724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7008,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
        7⤵
        
        PID:15636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7012,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:8
        7⤵
        
        PID:15512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7312,i,14688310329919652709,5341335714131960099,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:8
        7⤵
        
        PID:15060
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AEBGIEGCFH.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12576
      - C:\Users\Admin\AEBGIEGCFH.exe
        
        "C:\Users\Admin\AEBGIEGCFH.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:12680
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:12760
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:11284
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe9212dcf8,0x7ffe9212dd04,0x7ffe9212dd10
        9⤵
        
        PID:11268
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2428,i,16483515054568376944,13932574134919002578,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
        9⤵
        
        PID:11004
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2492,i,16483515054568376944,13932574134919002578,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:3
        9⤵
        
        PID:11000
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2088,i,16483515054568376944,13932574134919002578,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
        9⤵
        
        PID:10984
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3268,i,16483515054568376944,13932574134919002578,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:10960
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3260,i,16483515054568376944,13932574134919002578,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:10956
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4220,i,16483515054568376944,13932574134919002578,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
        9⤵
        Uses browser remote debugging
        
        PID:10864
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4596,i,16483515054568376944,13932574134919002578,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:5364
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5332,i,16483515054568376944,13932574134919002578,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
        9⤵
        
        PID:5996
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5500,i,16483515054568376944,13932574134919002578,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
        9⤵
        
        PID:5492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        
        PID:15964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --edge-skip-compat-layer-relaunch
        9⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:15984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe8ee3f208,0x7ffe8ee3f214,0x7ffe8ee3f220
        10⤵
        
        PID:16000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1944,i,6403192401006140426,16130010282793072851,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:3
        10⤵
        
        PID:8948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2072,i,6403192401006140426,16130010282793072851,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
        10⤵
        
        PID:8896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2404,i,6403192401006140426,16130010282793072851,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:8
        10⤵
        
        PID:8628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3504,i,6403192401006140426,16130010282793072851,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:7632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3520,i,6403192401006140426,16130010282793072851,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:7748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4912,i,6403192401006140426,16130010282793072851,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
        10⤵
        
        PID:16352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4952,i,6403192401006140426,16130010282793072851,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
        10⤵
        
        PID:13764
        
        C:\ProgramData\aasr1dbsjm.exe
        
        "C:\ProgramData\aasr1dbsjm.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:30048
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:30128
        
        C:\ProgramData\8y58gl689h.exe
        
        "C:\ProgramData\8y58gl689h.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:30164
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:30244
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
        10⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        
        PID:9864
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe9261dcf8,0x7ffe9261dd04,0x7ffe9261dd10
        11⤵
        
        PID:5764
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1572,i,14350005953963025839,8068411919287768080,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3
        11⤵
        
        PID:5484
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2416,i,14350005953963025839,8068411919287768080,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
        11⤵
        
        PID:5456
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2084,i,14350005953963025839,8068411919287768080,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
        11⤵
        
        PID:5664
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,14350005953963025839,8068411919287768080,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:11540
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,14350005953963025839,8068411919287768080,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:11548
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4200,i,14350005953963025839,8068411919287768080,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
        11⤵
        Uses browser remote debugging
        
        PID:11240
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4680,i,14350005953963025839,8068411919287768080,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:10096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
        10⤵
        Uses browser remote debugging
        
        PID:19396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --edge-skip-compat-layer-relaunch
        11⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:19404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe8ee3f208,0x7ffe8ee3f214,0x7ffe8ee3f220
        12⤵
        
        PID:19440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2212,i,4845638671290980393,3090493870677196856,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
        12⤵
        
        PID:19732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=272,i,4845638671290980393,3090493870677196856,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
        12⤵
        
        PID:19740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2388,i,4845638671290980393,3090493870677196856,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
        12⤵
        
        PID:19776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3472,i,4845638671290980393,3090493870677196856,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
        12⤵
        Uses browser remote debugging
        
        PID:19956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3480,i,4845638671290980393,3090493870677196856,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
        12⤵
        Uses browser remote debugging
        
        PID:19960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4964,i,4845638671290980393,3090493870677196856,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
        12⤵
        
        PID:5912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5092,i,4845638671290980393,3090493870677196856,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
        12⤵
        
        PID:6644
        
        C:\ProgramData\1ngvsr90ri.exe
        
        "C:\ProgramData\1ngvsr90ri.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:30408
        
        C:\Users\Admin\AppData\Local\Temp\fAgNzXVw\N9Zeu2fQuoPx4W3j.exe
        
        C:\Users\Admin\AppData\Local\Temp\fAgNzXVw\N9Zeu2fQuoPx4W3j.exe 0
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:30436
        
        C:\Users\Admin\AppData\Local\Temp\fAgNzXVw\21HJGFJiRUpdVpvA.exe
        
        C:\Users\Admin\AppData\Local\Temp\fAgNzXVw\21HJGFJiRUpdVpvA.exe 30436
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:30492
        
        C:\Users\Admin\AppData\Local\Temp\fAgNzXVw\WXGy0ePzMcvwgNMS.exe
        
        C:\Users\Admin\AppData\Local\Temp\fAgNzXVw\WXGy0ePzMcvwgNMS.exe 30492
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:19464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 30436 -s 620
        10⤵
        Program crash
        
        PID:9560
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\usrqq" & exit
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9948
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        9⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:11164
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\DBFIDGIIIJ.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12604
      - C:\Users\Admin\DBFIDGIIIJ.exe
        
        "C:\Users\Admin\DBFIDGIIIJ.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:12668
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:12876
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:12896
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\FCGIJKJJKE.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12848
      - C:\Users\Admin\FCGIJKJJKE.exe
        
        "C:\Users\Admin\FCGIJKJJKE.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\uYPKDwyK\plKHjCPvXJdzLUj0.exe
        
        C:\Users\Admin\AppData\Local\Temp\uYPKDwyK\plKHjCPvXJdzLUj0.exe 0
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\uYPKDwyK\mietaavNgylcmhaB.exe
        
        C:\Users\Admin\AppData\Local\Temp\uYPKDwyK\mietaavNgylcmhaB.exe 12940
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:12992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12992 -s 644
        9⤵
        Program crash
        
        PID:17776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12940 -s 660
        8⤵
        Program crash
        
        PID:17792
- - C:\ProgramData\9hl6p8qiek.exe
    "C:\ProgramData\9hl6p8qiek.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\PKG5gUky\FEXW2EMWBVltXKof.exe
      C:\Users\Admin\AppData\Local\Temp\PKG5gUky\FEXW2EMWBVltXKof.exe 0
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:60
    - - C:\Users\Admin\AppData\Local\Temp\PKG5gUky\asWnvZJqkhcgI0xd.exe
        
        C:\Users\Admin\AppData\Local\Temp\PKG5gUky\asWnvZJqkhcgI0xd.exe 60
        5⤵
        Drops startup file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 748
        6⤵
        Program crash
        
        PID:11720
    - - C:\Users\Admin\AppData\Local\Temp\PKG5gUky\KbJAimn5JGdHsjIK.exe
        
        C:\Users\Admin\AppData\Local\Temp\PKG5gUky\KbJAimn5JGdHsjIK.exe 60
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:15884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15884 -s 664
        6⤵
        Program crash
        
        PID:23776
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 724
        5⤵
        Program crash
        
        PID:29952
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\2noh4" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9092
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 11
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:7584

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:472

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:8920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4708 -ip 4708
1⤵
PID:11696

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:8148

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:10992

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:8436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 12940 -ip 12940
1⤵
PID:17552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 12992 -ip 12992
1⤵
PID:17704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 15884 -ip 15884
1⤵
PID:23736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 60 -ip 60
1⤵
PID:29928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 30436 -ip 30436
1⤵
PID:5240

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:11580

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:19872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3ectjek689.exe

Path C:\ProgramData\3ectjek689.exe
Size 1.1MB
SHA256 f27f8dd63155dd7504fd6c4105c1792a29b4b3a07d55f8110df8cd315be729f9
MD5 4ddc793d17a7278474e622d34854705c
SHA1 7edc128eda8610a29266ee5f6ed88c152e27cf66
SHA512 aec2938ff177ae2dcf4f59e17b375a67569b7de3c64ee6b5edf5accd631a8b8524359fa28f5b5c878fd1535258a4ba799698c2344ae77bb2cda09c29b58bd3f0
SSDEEP 12288:pNjIp/hT9uYSYtk4IhpvyQa/quIi6RaZZBDN0y9GcWNgRcufEQ59PN2vS1Xm9EK:pEhUTi8SQayuIEN8u9R59PNPXm9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

6xb1d2vs00.exe

Path C:\ProgramData\6xb1d2vs00.exe
Size 1.2MB
SHA256 46e27d11159266ffa9f58fefb24ed4b3d5daeecf98da905544e5878a5fe17f1a
MD5 28c41d1fc97e73e8ef19375c2848dd37
SHA1 b869f8dd9c18a36287a9709670d6749e7f08a20d
SHA512 056a1252321635c958d32d7fb5980b929cccf50d0e6b8a075ee71f16250a47212e314687d1a501995dd20045c89b85e4db9cbbf78702b4d73e34db0464a36664
SSDEEP 24576:PEhUTi8SQayuIEN8u7rnhDbydnGaUKgx:1orFbEFU/
MD5 SHA1 SHA512 SSDEEP

Submit Download

9hl6p8qiek.exe

Path C:\ProgramData\9hl6p8qiek.exe
Size 251KB
SHA256 dcc05c3ac7ae22d601bcb7c97cfcda568f3041bd39b2fd8899282dfde83369a5
MD5 58d3a0d574e37dc90b40603f0658abd2
SHA1 bf5419ce7000113002b8112ace2a9ac35d0dc557
SHA512 df61329a32e9261b01c5b7d95e0d9a3fb8cc36e5d90ede72bc16befe00fb32c221898a8346db9de07c0f5dcba57dcdbb09a22ca8b73223f989d33ec433c3a90a
SSDEEP 6144:fo5FKmVjbskNWDV6wyZYbn5tMfWsfTx2n83Oixf:k8CskNiV6yo7eixf
MD5 SHA1 SHA512 SSDEEP

Submit Download

EBFBFBFIIJDAKECAKKJE

Path C:\ProgramData\EBFBFBFIIJDAKECAKKJE
Size 6KB
SHA256 91eb192f2b3045a913d1657dd8fa42639b4defa13172d10ce9b31f7b5ed375c2
MD5 a0ff33d303cd9d58352b53fac5342dd7
SHA1 a521d78215004689bd7b030cd06153bb04185925
SHA512 9c721b65d9ae1d0a6964f032bfa2f5bf71747f71eb7099c194fcf602fe1bbe55ee84ffd00cd0b0a87ef59e84d2cff22289c38fa953abeb972de5a684882f3077
SSDEEP 96:xHaVEUTUTqGqcwfbYjl1zS2GnSSlVpdv9junniRHbBw88n8L4cnhIV1HK:PuRcwfbYjlRGnSSfd9bBw88YCFK
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

4wln7g

Path C:\ProgramData\usrqq\4wln7g
Size 288KB
SHA256 7c0d07ffc72abc3982349fed572aa8683c2c37fa3666c7591f52f5981bff706f
MD5 3088b52fa0daa284dd073870d6b4f292
SHA1 198d25a904d2167e5cb71e3576f099c82584e7ca
SHA512 0fcfe4d0823fc8837bac15e8afc65735db1935260e337d644b05bcd29d14369732ed7a8683ad80bbf62f2af3a33d51808c84025573fbe14b88584bdfe81d22ee
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vJ9+CtNE:f1zkVmvQhyn+Zoz67I9TtNE
MD5 SHA1 SHA512 SSDEEP

Submit Download

hd2dtr

Path C:\ProgramData\usrqq\hd2dtr
Size 228KB
SHA256 a0810a09d4e8c9e0a8d5aa0f0e48c004d365c8a71c4932bc02a8d00356fee847
MD5 7dba11214a99908d19420ef17198addb
SHA1 8d992c2415a4f5105c095c31b8a3aade38a51b58
SHA512 408484820fb69b10f097a7dc333fbc9621cf114760bd66ae7c46c60ab4c4042b8c075f0f30053398c12fa308e6ae47012aa63ee3f4b20cc90430da4e0c4e691c
SSDEEP 192:p1moNHfT8a0QQnGzaW6qt8K+dJIhPJyiqzX1i+VpdssMV7due8FPu:L79fQrQQnyn6qt8K+dJIhPJyvzl5cYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

lfkfus

Path C:\ProgramData\usrqq\lfkfus
Size 130KB
SHA256 33d663d4481f360a64d607c082f2f9df7f2c9807bf09cae652a48dc53d05a395
MD5 53e9f4124b67a2dc6a7ae592b812b418
SHA1 e8386df5904afc66dd0f581079a238161bac233d
SHA512 15fede43a6e983807d0b97d6b933243c44f6a197a5d1a779566d33346fcf56c075d08f58d717b878f30d59aa4b2a2a199a4733a4355b779d28ebaf214d046f66
SSDEEP 192:YB4BvnXuvkUUo4nVaIvsb5wSVpX66NnqaVum+S:SovXuvepnkIvsb5wST1NvVum+S
MD5 SHA1 SHA512 SSDEEP

Submit Download

nglngv

Path C:\ProgramData\usrqq\nglngv
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
MD5 SHA1 SHA512 SSDEEP

Submit Download

q90r9hvai

Path C:\ProgramData\usrqq\q90r9hvai
Size 40KB
SHA256 c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e
MD5 dfd4f60adc85fc874327517efed62ff7
SHA1 f97489afb75bfd5ee52892f37383fbc85aa14a69
SHA512 d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4
SSDEEP 96:iLSQCn8MouB6w9f/8iZqmvJKLPeymwil:iLSQG7Iw9fEiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

v3e3op8qi

Path C:\ProgramData\usrqq\v3e3op8qi
Size 56KB
SHA256 bb923abf471bb79086ff9ace293602e1ad882d9af7946dda17ff1c3a7e19f45b
MD5 1c832d859b03f2e59817374006fe1189
SHA1 a4994a54e9f46a6c86ff92280c6dabe2bcd4cc42
SHA512 c4d3be414fa5dd30151cde9f6d808d56c26b031ff3f6446d21a15d071053787b6ba337b12909a56af7bb420f858dba5213f08e64ca9f836f52c98a18762b4bef
SSDEEP 96:QkS/KLPeymOcVizhGNOnfXG38tyvFbn8MouB6w9f/nP:04cVizhGNOnu/7Iw9fP
MD5 SHA1 SHA512 SSDEEP

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d1d885a18d732a8194b977e6122929e1cd08b0cfba7b9fd45bf3f0cea1c9ee7f
MD5 86eccb4f05e29013d46fff96b84e5e45
SHA1 3f17af7b5b8f101ae6f17612f110d06b6b9b5603
SHA512 71b3dc8e93b0689cc4acb97fb1981859b1ae4b7aa121703cf5f2f1e7bf2045b6380313a77ca8ac17015938f0aa2f50e8bae873a3789292ba37a67e0339c66af3
MD5 SHA1 SHA512

Submit Download

0e2cfcd7-4bbe-4318-afb6-3ccd5a15cff1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0e2cfcd7-4bbe-4318-afb6-3ccd5a15cff1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 710af59454e6c536a9a67bb3d3de765c2370b892445c8f5982510b05775baef3
MD5 fa0419e041b7e29174e2b45e5a28fc22
SHA1 dfea293950245b9067903c142dc98b4860ead60b
SHA512 0ce02262023aa394cdedfed9849a24804e9378739d65b69867daae3a259b8646a852a5cd0540a21c0aed0dc3805936e32acdc938751f4d0c3bcc69a73a2834a1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d2bd0c132bfe266a0c87ce63a48c0385bfdbde74c9274c43f0b65cef29f79439
MD5 6ae0196ea582bdb7e32c6464618023e4
SHA1 b7b552942d59d2d7138dd68c47d5bf9db66e7081
SHA512 4cb82d347dd6089a37f5c1f81375c8e68026ff9af7bb839f3519ae8e76e5e3c2394bec1abb555e44e6eb7fe9b542a3fbd6cea5d27b278bd881fa58822c1ec692
SSDEEP 12:dMdMNib5/q+GJ+EsfglOl/sPe9+9MdeMM/:dMM6q+o+Esfg0+Pe7dzs
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 e01a174a9d87980d8cc505ad40ac3930c14b58d9f8b296d3b0a61607089896e6
MD5 f9d41ad53e8cdf0a07b030ca7a8ae769
SHA1 519dc0ac51f5727ce3d305ffdfc3f63584c0e943
SHA512 825cd9140e7cd6fc3ccc7c4b321f34ec080866cd9bddd96e9797bd99de19d6de966bb32598a1c23b0c0b6f4cad0a6cd49872585c07c7f1db20b670064444ce75
SSDEEP 96:8M+/gsDWlPDqSCyGaJ0D/gyJDWIama0y:Ylm3X0PJoma
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 8ed5d8964a977a79c5aacf34853c9e5e00a06de2f2f0964a56c4089805a2dda8
MD5 0605b75c5c345cc202a7885499cc09a7
SHA1 540568cdb245ba26bce8711347e456320012e83d
SHA512 dae16a98e4cf861b918d684f0d7660e1c6647897afeded6859253a51f8dd95c41f007e3f20fe43da0292b493c170cb94fb8370d7b17b4f23cf2950cec477f9a6
SSDEEP 48:fe7A9D031yIbj+BnO/f2sOwiPxTeXie7A9D031yIbj+BnO/f2sOwiPxTeX:G7A9glHWBOWhlpA37A9glHWBOWhlpA
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 411db2c09ed0cd8086eab1b67d327ea6d78e73ae8b3eab326ebcc74c506e8afa
MD5 da6e9ddd5a2be0f9e9efad6c7e352532
SHA1 ae609589f31c221bc7f543786ff3a8d8c766482f
SHA512 9b733f3a411b35c83df3c65dfab320167beed888eb754e06edc05b6270afcdc7afd0bf75684f5735c138efe6310fe13671e3dd90297e8908f0cf79dde1bb8656
SSDEEP 768:UUfDPLSgcRUv+j4FUfDPLSgcRUv+ZX/NcP4SWb4wb4Zb4Tj94rfDPLSgcRUv+fXT:+OcPYbnbybWj9xcPEgcgAcP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 35KB
SHA256 fe47f63249070fa4c0083175d32733ef8777361332e6cd52e147f2bfcd6bc7ad
MD5 82b77ce0ce38ad816031fee8a479d767
SHA1 bce7c6d373d03461e8c57424af005b00ba6542d9
SHA512 0d60327f3df8eae7ccfbf7089199d6f07fcab573c0766b26ae0bad4b72b6f64d79de4abcd41c829b1b974dad8f38b4f386f79be145e8b18fbb4816c5a199985c
SSDEEP 768:gEOgAC00xXFrP+OZkxAdQk1yvXxqepofiWVCZIiRKpq096hXqHmsrsJE37HgWq:gEOgsyNZ/dQU8AeRCqK2hX0PsJELPq
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 63KB
SHA256 15eba349e5829f11363614b8f3dd9c3d04994586601d3c4c4d8069e0f5655310
MD5 1901d2bcbbabee4bbb9804c30642ae2b
SHA1 f31774bc12614be681c0b0c7de3ac128f0e932db
SHA512 bdb94d7d8cf47b239c61559545b1dd26e05da909fec05d215471388545879cd8ec9e1fea51c04ed43927e2b07b5b80a74f09eb9038c8d9045e4161ea69df215f
SSDEEP 1536:W+5gOsBSBWfvEzE3ai2NWfot4S97Cgl3kWyCWqM9:t5gvBa3EjVS97PlRw
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 38KB
SHA256 787c14f8cc865430c03c96a345044b7c5b8dc8a032511a500d4a42228533acd8
MD5 f53236bc138719b68ccd1c7efb02a276
SHA1 26b7d3eea5d3b12d0b0e173ebf2af50a7d7e56d6
SHA512 5485bc7ccce8ec75f60bca3be846086a4bd4466009c8e22da9cdd16bb1154529af2fb2667cd3a97485cc4f6635fb79ac0fdda4f3e1f39f25f6196f708a92d740
SSDEEP 768:l9ng1k8IEJiM4oWt5nJ0OAMdjoMjjdmbh0pfrjLsgThp7sDfWrX+rJYtU:lRg1ktoiMknJBdxjJtxLsgThFsDeriJh
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 3e99f8c05a035da096fdfd63f42fac87c9a99f11159e14a64c20ae176710cb53
MD5 6b1467e5bf2df6976fbf2106c8594639
SHA1 7935da525912a05d7ea737cbe9724cfe0153712b
SHA512 d2778ba0be9d2ca8091b0473a11e432e3e89ec0ee77d7e4de2539c55b2f155ce031059d6d1bd36f42125240970f75a54a8819bed0eb40f41dbb66d43ab448863
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 fc0724a4b2697bbcf7af6883176a10009649bb9e4fbcd2dd8d61895b33d1c2c2
MD5 ed7969caa023e85d1c6f7f4acc109868
SHA1 5c46cf7b027e3a2fb410ceb9baa0745fe7d0b6c8
SHA512 372b27c257c1642b49c938d7b3b92b0fca8d7b0b5cc9a8105c821d4c6de0ce3d163a08ad7a1540789c2d2234edf298b6230028cdde3c956616a8a8e1733c8624
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 3KB
SHA256 b8b7ac30e76c7535aa26ff1709f86585c476cfdddca1f0adb05cf248a38bc889
MD5 adf15f208c04d378cc4fce22b7d41767
SHA1 3ba57083bbcd237143fc3732c61d171e463be251
SHA512 db3d4d8bdee8d8b2ffe2b5f7b7f4237f65d63ead0313f5c9f4844c0cb66b86789c2945fdb56a60a8db927464643c4e5d604c4a8bccb924b94c7df677ff3b1c6f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 39c962b48e2538b198cc71ade241d568f01d9ac2d4981dd8d8e20282eed99c28
MD5 6fe79aab8e756018b613617d7077f0e0
SHA1 fcfab323f3010c15945e9ddca391eaa0a6c579bc
SHA512 8c080c7d9ee4279f9f41f0e88accc08bcba5509e47a77ffc9682e4aeae5abeea45d70d4f7f6dcdfce7947988bf8afd9262480ec5c539ecc8e9b32312cd8478a5
MD5 SHA1 SHA512

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 128KB
SHA256 aac955452d846e19791a2c1f30dba6a9c1ebde5b20547d37c6e7ebb6c62154eb
MD5 ad5500392a3d6dab62cbbed72729419d
SHA1 74b1d039a44cc37e62dc573d0d14efe2ead9e391
SHA512 454433c661570990955c25eedb52ebdf5ae2317ac062cb23be3537b1cc8b5afc2a1d3d1e370951641a473cccb0f3ddee9db34dee2bb7f52db5bb4c9a609a1872
SSDEEP 1536:YEO+9lhvoaEAoAf0OliS9XbrrJQiFZcBaw7ILYzEVKOAKa4q32O1I5Z+dOOXW+xh:ZoE9Xb9ZevcKOAKaN2O1IwOOJxX9P
MD5 SHA1 SHA512 SSDEEP

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 343KB
SHA256 3cbdbe25233c061eee0a1826abfbd94d5e4cbd3a1af33b36cedd7c330293eedd
MD5 fe0afab9e43167cfacab107f21d040b4
SHA1 6448a3243f17b73cf4cb5fa0c0d13e8e59751f83
SHA512 eaca957714b139b3da6fd096407007b0940f280a1aea7922220678958a37869a5640422f7acb232732b6ee2063fbd8f9de080ec49bb5d8c0210b859a8b7ca883
SSDEEP 3072:pJ9MGKn0oI+YTtiaW3t5Txle/vu93GZcxy+5ZHfV0RSj+kuyBBhlkOPSWjrZauJu:pYDVJaW51le/EiSzH5jB8sSWfHJNrbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 107eb42f8d318492b72c7ec7a8b18a8c9a437440b4945df2544c95dd9e0e6cf6
MD5 7c65ceb266841bf64e2e333514248c1f
SHA1 26b3e94dac52e37db90a3ee1ed0401ae8d4cfd22
SHA512 a905bf6ad8a1f434912924b747355ef4bc27c7174b8e75ba6c737c3b0ed4f1d6e4c5b7b9fe276f08296385c3670866401c91413ca98155e124860e8d0083982e
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 308B
SHA256 cbee1100a2c9add47776b7e416b58a809f6feb9fe458bef8185b0c176b5db340
MD5 4e7982b86b3d7d916b7722aa3b3f0669
SHA1 ce4e874903cb71d9012cc7654ca7a6ba5e4f7efd
SHA512 c4dda8b36e90a327061dab901730f47fc23cca129b02a157f1ed0c566a1d6dddf272a4e74d3acbf14eb3a7fac0820387a584db9e19ca299724ed7f3030f891bb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 320B
SHA256 b2d474755f7610f20d3c4e8781405c93ba4a25af4e3a18f84018bbef717476d5
MD5 cd2a15dc85a4648504b645c9708ad61b
SHA1 26a00788749d07b32567c33078c930634bc95c0a
SHA512 ddc8fc77fbe6a494ee2c1907a0771830a650afa50b9ee6a038f0a89569747d74a6676b9201603d422eeca0563e314b95a066b85dc14c936f5b182848d6b38943
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 5b5f52ee41d591bfc84468b62722fa812eee7aa191254b22b2e71e2dd5ceb715
MD5 4f4cc56d8153cff2d6155e4e74be2360
SHA1 d10f47d8aeb22eed3ec0c0af7c9eef8fc9732346
SHA512 6d6a73229f74581f764390a34bff5e4591ef597691a2333645da5d253b4009d9f8df18af5719efeb1c1920a071c4fb59f90bbbc1b48596866a7cb7f84884c063
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 548215b66a0e2732a23745f8edae597a2ed899476e44799ff2db0f747123381f
MD5 66d8a4405282750251d0e8c789cdb588
SHA1 f570b7174aa63711b7077cb25cd247f1ad8368bd
SHA512 1ff8b9b4b7db9e587ee14e4dc91af6e9e4229bb0bd3fe0f3eea0530110990347496bc959fd83587d232650eb440b914bda6f5828632779211b9a373a7672e40b
MD5 SHA1 SHA512

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 4b6363a16ade08719bf7f3fe7c0c8a007ae10135268f2221b498c63bc9c9f400
MD5 cdf0d300eb0a15a66422ff33d19849aa
SHA1 a2cbe81615455834b38d79acae207891bdbabfee
SHA512 99c72fc0fc9a227a1a38130625e7f365229b7737595870144cfab94ccdb0eba7239e8801d03a35d7eeadd0454d12b13764aaaed6b1554a80a471d0563ba6cc1d
SSDEEP 6:YdMlA8o74MLWc/XKuqHKu42X8NQMLlAQs:SkDrMLRXXwX4o8NrK
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 24KB
SHA256 be26af2012fc3283c41e2067da93b398920e327b4ef66337f073b63c1ce00607
MD5 4f1dba489bf565b461c09a4b6c9ab8ee
SHA1 d4f4c9c1a6077a211e676ddc8e22bbf8df5552a1
SHA512 7c18880ed7bd13ac6725281a36dd4ffcfc6474a15d998957b0fd7d9b2b1154bc5fe90b6658b1f0b93c8f178d75ce311696ab57f434816449db730c261d71d938
SSDEEP 384:TXFbsdGN0axXQPQyIIIRbpMIMHBi5nxsdGRwGCTgFsdGmPEsdG7dG4lDQAsdG7dO:BAPQ8GygM3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 c6ccc60aff4bc7fef4c6870cd763011c14b0895933f8d0eb0ecdc4ba2dab3cf7
MD5 517687a6b3e493b15100a8c13d16348d
SHA1 1f1029f95631243612bd81bca48df7e023c5b0f6
SHA512 f1ad8e6a57eeb84c5fc1a2d9361bc3ca274742e19078dd77de9f2ac850965db1b2a15d6d65e1a87439efe6a3670277afddea0b620aec0338f9a7bb2b26864211
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 80d695a7d7ca1a049c2a39e64705d9bb5e6d07dddf35b28f21f9388de410f34b
MD5 63ea8b877ab25df8f76bd3586e8b5eb4
SHA1 55d7492fb4b8168b00e4f54b900b319f405583b8
SHA512 19ab22e1dc725f0b1c64947ec1fcdd706f5837796f1779ec505c23013efbe3f427d9fa17305418e8c1572c46453e75abbeabb380e22a3bb3f0ead12f87524c6c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 e1faa137dae71089d09c07e51db08b77741f3ad6f4e55df5d671606585c76037
MD5 08cab8f30c20701068966c0315299d47
SHA1 2b7054cd4fcc130c255e5e66cf05ed29482049b6
SHA512 f191c9d206f7325db6a8f02dbdbd3ac9dd2b34fe0ccadf2e1e1e44bced19125a230257f1c44e0c1ef4e4405b676f1cc7b6a970279c1ab1cee8262f4808571c0e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0
Size 44KB
SHA256 7c2e389cb2d76555965d51c11da38ee2bd5da4c7fdd5dc43df387060f969e7d7
MD5 98b19b2898175b001825eef54b6f0914
SHA1 7f05f58b6d14c7719e2ee2ec3ed5ea02e783182d
SHA512 3ff7e1ed1e2b06799baf1a18168229a6d357344568ea9d53d4d5490a4f92d0182a5d1676dc1f6078bd857a17a3b11a3d5cbfbcbef396ae68730601826308079c
SSDEEP 24:d/WEy7nxWd/fd+G0q2me0T/v9gEg5kEuKQfudmCii/UeUG0QSO/TbWfyBElu2:w6ymRVEkgTdsGcI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e9816fa5f22e07670e2cd1df73154989927025fc24d2fefa635ef3ad687c31
MD5 605d9528a21077154ce27d545953fce3
SHA1 bc4d81a1cc8d13c46695f35d5d6c2adfb421c9d8
SHA512 a13e1028ea1fc7563af2a4b8d6ebf5eed46ae4aadce12b896cf05838ac8c5a3a05ac4b4c9627b98499f1944786cd6d0e9cbfe601309c9aaf8fe0efb8eede9ca6
SSDEEP 96:6S0SuS+ZStSOSvSJrSOSxSTVrSJS0SRFPS1NSTZSE+ST4cSZYSKhSbeSITSQSxSH:CC9MxBO27QsJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
MD5 a4710a30ca124ef24daf2c2462a1da92
SHA1 96958e2fe60d71e08ea922dfd5e69a50e38cc5db
SHA512 43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 80KB
SHA256 199f4009ea3973cebfd6a16d7be140896009d1a4dfac94f37942df1d4afea203
MD5 3770ef0d64eba39ce36125005c8f7457
SHA1 40d9b875a884055accdff6af0b1acc9f13fe3898
SHA512 d7a61dc0f3d22d7cb284e1d6e488471b1017642766b518c3b7b565951e89fc0d0a90b56633d9270108657139c3fb4746204016d5aea1c161c2e525d73aae0b51
SSDEEP 1536:gvqNjdpr3nOOJZd5d3Apv/x49GeaJTNnoV7SadJAfAkP3/2HNHGUrq+h:7FD3laXx49GdfoV7S6JAYkP/s8y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c41acdf5d0a01d5e9720ef9f6d503099950791b6f975ba698ccd013c4defa8c4
MD5 fed4ab68611c6ce720965bcb5dfbf546
SHA1 af33fc71721625645993be6fcba5c5852e210864
SHA512 f9ab23b3b4052f7fda6c9a3e8cd68056f21da5d0fcf28061331900cac6f31ef081705804d9a9d4103ee7d9c9bdb6aa4237987b7e821d2d96cd52da24219e55ee
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb1a67bdc2761f1f9e72bbc41b6fc0bf89c068205ffd0689e4f7e2c34264b22a
MD5 4013ebc7b496bf70ecf9f6824832d4ae
SHA1 cfdcdac5d8c939976c11525cf5e79c6a491c272a
SHA512 96822252f121fb358aa43d490bb5f5ce3a81c65c8de773c170f1d0e91da1e6beb83cb1fb9d4d656230344cd31c3dca51a6c421fda8e55598c364092232e0ad22
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a8dbbcb1b5108675b78c9643059ebf61bdc87757bbc3f4a98a63417b78265fa5
MD5 53f3c06a0332026a2f8d6112b9db70a3
SHA1 f1d0227866a583e7d2bfadff9250b4dfb0d3736e
SHA512 8c5d6c05b20b038ec68a51d3e83aeed4ed03b2c2c82769c8689910e215445c164a76556343098c9c283984137f12d36012239e57fc8b4f34589793715dce878b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a42dd01d89eb891fbcd738d29b2234b7f019be21a6f011efb677379629c2374c
MD5 a61fd98fae7da77215f82e6f0538ce9a
SHA1 1d1bc7c7d0342411854322ad36409a165a715119
SHA512 0389fd733647c7fc65b9f4ffcf304a5bc43704bb90b8795c3dc178e56ae424a2cedfefeee1a30ffe211af4bacf16daf1b29fc60482ec5f5316411126b657261c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c18a9ef76ba393c659b42033b0e26271c8a330448dccda60ad618ac4195eb672
MD5 63f4275437cf2154f64f2e7bdd95c59f
SHA1 c3ae41b9cc11058eaf32faf47b8475a9ea3d3729
SHA512 ed7a6ff1d2c9096e589150fed4d05c307bc7736d5938028de9f81f2ad7ca76e56012f0d459258e592898f36511e126666b753f339a307632150c11aac8b858a2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bf91d15d42e22dad494f39abac78e27be4cdd3cf23356a51d3f4338fe151ee81
MD5 9feba96782a464add8b728fa269d402c
SHA1 9f4c5b6e61236d58d2fe001a028213123d3840f0
SHA512 e203d822eda838ca219b8ceabf48af1ed8e72753c0e3a7a706d451d0c825d22ba32513ba2875aff24383d3c76fd955b63b157a70abe3575ebc48976049d8c8b8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eecfb57031a64669fcdf5652f90eb4bb5f88082a04dd3bc16b27f5c6b5a4b60e
MD5 1233dc289b58c1569e9a9bcce23d9760
SHA1 9d200eafd5dade7e07d9202b928d5b98cc0ddf3d
SHA512 a9f873119a05711ada27e6941d82a120fcc5ccf4dfb24e032ab34a7bd39c97efb94627768a42375162fe6abffd9c4980738044abb10722b782edbf6a9a9c2e69
MD5 SHA1 SHA512

Submit Download

f_0000d1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d1
Size 162KB
SHA256 7ba515805e9dd2822d42e8390acc37685195b8e30ff660d7727763fda7a05d30
MD5 8419d2ab52becc0f6a3f2360a3e06a85
SHA1 27d5dfe9535a211806a5f037d895bcf7519732db
SHA512 4c14a0420642268fd2320ab19a4c51a19d1c437c9bfe269110de2c612c431a5844694d356491d4c81b610cf8ee9d4211f1f4e0292c4513cebf1034f1361d3070
SSDEEP 3072:ldEtJ6eVAfjXLK/aGYCGTlPmevp5xwpAR/TIS0AdWUguZQJBA/XTYlga3+I9/C6K:SUXGFWleePxsA5p6i/DYiGN9q0rrpxKj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

a8523856-4f46-4fcd-abb5-dd60912e4dd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a8523856-4f46-4fcd-abb5-dd60912e4dd8.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1ddfaeec366fe142708dcb55be451c06fa4fc338852d0706b597f1b373c9b938
MD5 0d27abd4739c686b841d6aa44116cdb8
SHA1 68e5ccf4d9a8f61616b848d7b7e1864eaa19d04a
SHA512 217afde303ad4d1cd94b2d98f24847d4a6aee83fab2889424cee5c02b25052b665544ee729f808a2622b21e62f71f5e6015d259cdad6439cf196565d42b1d1e7
SSDEEP 192:sVeR/VyMh/Ky0Ml8MEXsyBcwEwkgdH9NzXZ8pyHY+WNgmwY4ISET3+IgdJ:sVeFp8Xsy2P3gdH6yHSpwTmL2n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 1e4497db915b2431d2ffb37bed0895c0b7065ac477547700b6dd4900711dbf41
MD5 0004a45a4ef9cb41971e832dec884604
SHA1 5c16298866baeb27e42f1e01c7248aa3cb5d05a9
SHA512 96c107abe823e8641aff1d24d9c5eca51c9b7755d26f839aed757c3254fc19d699da381183a9483a1183723e2d4acb4221f38d68641807989e451a80edd8267e
SSDEEP 768:jeh8+dvWFX5nF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeIFeLlUq/O4rouuagMBA:jeh8+dvWFX5nFu1jaFIFeLC4ODuu
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bb9a4039-5fee-44f8-a618-d20a135c468d\index-dir\the-real-index
Size 744B
SHA256 a391ad0c3e39d115e7e4cca13f042e983ee794d7254a09606403f66bdcc8d01f
MD5 9c16b770e5e31e47fae9e6625601017d
SHA1 8ce13cbf5bc854115facee4e4861e0d25c761a86
SHA512 e3f22de80b12ed2c4c4e91c9331411964f6d9432880978f9bf4d5eae37b906e093205af5fd833c7a47e48e6318529c4243cbeb8855971f2aa3a8e6fa438aa72b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bb9a4039-5fee-44f8-a618-d20a135c468d\index-dir\the-real-index
Size 1KB
SHA256 da030cca403697bdc35b4a358f29b1d7dc55511818e3ceee0915ec855b17f20a
MD5 65f6841c842775052995ee150f3a8e6f
SHA1 ac0a50c387f0b45f5c31f4aef7c594b4648d6fe1
SHA512 7240956b2b9ffd86ffb8783210d6b3798b523c851be152c02d5e4d94efc9ae48b02d1bcc4180e745750f260ae82df92cc16a8b462fad6498f868df7d4d8084bd
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57e639.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bb9a4039-5fee-44f8-a618-d20a135c468d\index-dir\the-real-index~RFe57e639.TMP
Size 744B
SHA256 348b01257d58788966d4db89f63390148cdbe0f5ba974c8ed87791ca27dc890b
MD5 e4136cbbde1c5a11cfaade5b9b9b6958
SHA1 d29b9906335b2fa09e7fc272f168831e24783fb6
SHA512 0bfabaeca19f50bfd4a25df9c435d478df1e5525a253c50cdf6f709a81bb8ea71a5d4aaf1c2352ad04f70bdbe673303b6ae922a44bd97f4eefd8be872934812d
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe589cd7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bb9a4039-5fee-44f8-a618-d20a135c468d\index-dir\the-real-index~RFe589cd7.TMP
Size 1KB
SHA256 2ccab7d9abc58878b7b346403883362c9fa817c5de04f5c4852826bdc8d337a6
MD5 fe798f80d10b231a9c27f7b2e7373acd
SHA1 dd198d3cea3e93b14383263f399c49b52a6f4509
SHA512 720f0d2e9d76e2ce453b4a97728ec71d932edea55a8859cd30f5e628330fb2314688276b2133231fea3811a5055c4547f757955c4831709cbeaf9e03dc877c81
MD5 SHA1 SHA512

Submit Download

ee91b116cc2005be_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d5806065-9d71-425f-b355-a8f00337e4d3\ee91b116cc2005be_0
Size 56KB
SHA256 c24a7fff4134176a675fdf444fdd8d45560d24f9ee08a4eadeebdcc5eb3225c6
MD5 00590d7e84bac0c7f5bad9498f9b542b
SHA1 af56307f26d945187364d21faa6adaed6c153c0e
SHA512 5b3000d8b75d5afa707b93a8a138e40f5ff02b34ecd2f0165b9f3183e0e2a5399714b1c03f67286db9a9e0bd9750f7e54fd48dc8cccd504f7676464c844e2226
SSDEEP 1536:5SL0dxASKxoHFXTBrCOhoy2BJ0ROrPDb9yE1O5eA8/Pwqd:u0dxVFDxC4N2B+gkC
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 325B
SHA256 ccc9333a3e136a189f902ded966d0cad0a822b58fc34460fc06bdd5e5b4f86f2
MD5 bbd322ec971b9fcec3be496508b8506f
SHA1 682527e117c8ca26b75c1c45f8f6827bb4b93433
SHA512 95cb65760e1b5df1c5b9d50e363a67d29868684ec47abcf7eef59bcd8464ed210159223f7a6601b38c3a72ab6dd9ed72ce6a6704bbb60b0597604db5074ba120
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5f43f6dfec59bd3fa1b2a01d78a77430e3e7bcb3487ccf27534b4cc99e8bdbec
MD5 ab158e32f176791a7d61a3282d3a6b7c
SHA1 aa12b13d34e90aec0fca209d46f97c6152f97bce
SHA512 60697482621532aafb31ddf666f9752231352464a911bcc9bbaafb31d282562210382631db6d998ba0ef119a736f5736ace99c35095f8f0f12aecf10c6ffaddc
SSDEEP 96:+QaQ9Q2Q6Q4QAQAQ+6QQQrQKQaQ+KgQEQUQaQDQEQTQqQfGkKdu6KdGY:+QaQ9Q2Q6Q4QAQAQPQQQrQKQaQaQEQUs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 6KB
SHA256 07cb0224d014a441bd3cb3e3d0638ed7e1522767fc69c0179510c2965f675a0d
MD5 7cbdcc57b200610cfecdfd7e8636b26f
SHA1 712cd038c348d8bcd52d8cbe15c31165777f1a5a
SHA512 59c93e8b7d78f8556bcb752aac70d5bb9b45aa91b5d4cb12df542a3d485edf5cc2c6c9e2d08d2bf02aad884ae44868f0d29bfdd0005619bc4b326c11651f5b9d
SSDEEP 96:hqONkCyUfUvqkK5ih/cIVURLl8RotoppQZbBhaPivP3z2lMKPlgbTjFAe4mJlT0T:IONbyRiwWiRUKy+cz2uKmXjF3lTfpKJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 706e36cb000017333b7908f4826f5902d4d682281fde896c34bb48d6287445b3
MD5 7667d93b72500f1a5e6d3a046c74154b
SHA1 d8c20f9d94b784d5a51d311a9eb930af9b6239fa
SHA512 ecc9073b220001e3ecc1ee5b2c6f6fac7b29977eabbc050ee138bccd4edf1910d4da58051c23b086c573d3d794a6597527bcd11149b06da70988732ad3ba9c34
SSDEEP 768:8E6esE8lDldUGG9D2a5r2dkN1K09kQDpNVgrK9NWdH9Q:+eB85d+Om1DaQDprYqNIH9Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 b158ea163e00adf4d5fd26a8b3614f1b9cec849d473ca8c6a068cbe5fb4cd719
MD5 48794e26531127e8f53363f1308f4d30
SHA1 158b620050343eb4278124fb42a0b6ee494453fc
SHA512 e05e4d4efd7c5c49dd21d2223cde6a23bc69f4ba80d5b23f0739b309400214314fca2c47699c2e4c3839de39bf5360fc452a24017220831f9c1760e539720fa6
SSDEEP 192:IONbyRiEWiRUDSkcz2uKm82SjZ6JZk3t91J:IONbysMhkca5r2SjsI5J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 47e621a65712ba71d37e866b4be1b65c297f16968cb7ac46f558be1f033bac87
MD5 df2c66e851a9f89bf9d525eaf1a425df
SHA1 87f39ca0f17109b4576d7fedc3b1b438754db37f
SHA512 0cfa126d4422b6c281e1cceae036324f12e7e7dbe36dbc5df241b05e0f20e50d521465f8e7e1c02e7e7f0dcd7ef8b7d6b4d22106a348fb6e409c7db8b30c02de
SSDEEP 192:IONbyRiEWiRUDukcz2uKm82SjZ6kN1ShCWmfye9KFUV:IONbysMZkca5r2SjskN1KCN0UV
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a096a33a507744f9aad5192b7fbe91a6ac6f75b1cd99d0097b99ff8ecb4334e
MD5 d770b54f4b258127482b2e9eb427a9b7
SHA1 4628d81ccbf8847023564d5ccb1cab72f2fae321
SHA512 e8b9ffa718c25534e7a40dd40439ff217a7bc9aa52248a5ead7c7f8f912e01ec850e404635fc1698b4647d2b475264afdc1704e09bcdd7e983f71208d4c31dce
MD5 SHA1 SHA512

Submit Download

eb718cd1-0858-4a24-abe0-3af9f459d0af.tmp

Path C:\Users\Admin\AppData\Local\Temp\eb718cd1-0858-4a24-abe0-3af9f459d0af.tmp
Size 152KB
SHA256 fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
MD5 dd9bf8448d3ddcfd067967f01e8bf6d7
SHA1 d7829475b2bd6a3baa8fabfaf39af57c6439b35e
SHA512 65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de
SSDEEP 3072:5TTj3gXV7obSP3uAxchhBoi+dmTfabSnVf8nik5jqfGc:5HUtoQuAx2cjsMeGiyjuGc
MD5 SHA1 SHA512 SSDEEP

Submit Download

5ad251d6-d7d9-434f-83a7-cc3763a18550.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir11828_1791051247\5ad251d6-d7d9-434f-83a7-cc3763a18550.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleChrome.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk
Size 1KB
SHA256 be9979799f885989a6d672a52a2b3507f490718dd97d8af401405229658f5ede
MD5 97d8334b2c4d24f5807c9d5c453edd03
SHA1 3631bef8d914243b008b55dad85431392be0d95e
SHA512 239c7d876e17f17dc2b93aae1c6b4255b1e61bc8ca2ac756a88da10650633d8a6f787d10ef3f799de1135f31b8035cede611c539d9591e99afa3a0199c190970
MD5 SHA1 SHA512

Submit Download

memory/3108-538-0x00000000009C0000-0x0000000000A04000-memory.dmp

Download

memory/3392-511-0x0000000000400000-0x0000000000464000-memory.dmp

Download

memory/3392-510-0x0000000000400000-0x0000000000464000-memory.dmp

Download

memory/4336-84-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-93-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-92-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-91-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-87-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-433-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-83-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-82-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-496-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-81-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-497-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-498-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-499-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-106-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-495-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-500-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-494-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-491-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-31-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-9-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-551-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-488-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-19-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-29-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-97-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-16-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4336-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4916-522-0x0000000000400000-0x0000000000650000-memory.dmp

Download

memory/4916-552-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4916-521-0x0000000000400000-0x0000000000650000-memory.dmp

Download

memory/12760-1590-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/12760-1586-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/12760-1585-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/12760-1584-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/12760-1580-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/12760-1577-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/12760-1576-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/12760-1571-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/12760-1570-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/12760-1553-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/12924-1563-0x0000000000530000-0x0000000000574000-memory.dmp

Download