lumma | 6cff9733bcd32c2af2da61eab8281cd412a6d208ce6b763b783157be2901d5bd

Analysis

max time kernel
149s
max time network
155s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
29/03/2025, 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

s9471.exe
Size

736KB
MD5

18e5e760b807fc2b05172215540398b3
SHA1

6a1b4d3227088473c45869469b68a1737b26b90d
SHA256

6cff9733bcd32c2af2da61eab8281cd412a6d208ce6b763b783157be2901d5bd
SHA512

23430597753696466eea1c54337b1d37a734918433be2e0637aaf022c0ef09d5f8b04a3793ccb1a296bb83d13fda832d677cb926730653d78b0833f96737fa04
SSDEEP

12288:oaQ9+ICJkAp0mBpehM8ppy+E4J/aDQy5b4WeZGl/GtWV3OnP3cqXoi8TMkoleH5/:cw4GBpehMjcuP5b4FtyU/oiwMTleHKLu

Score

10^/10

lumma stealc vidar 928af183c2a2807a3c0526e8c0c9369d default credential_access discovery persistence spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

default

http://77.90.153.241

Attributes

url_path
/612acd258782ade8.php

Extracted

Family

vidar

Version

13.3

Botnet

928af183c2a2807a3c0526e8c0c9369d

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

lumma

https://wxayfarer.live/ALosnz

https://byteplusx.digital/aXweAX

https://travewlio.shop/ZNxbHi

https://skynetxc.live/AksoPA

https://pixtreev.run/LkaUz

https://advennture.top/GKsiio

https://atargett.top/dsANGt

https://70sparkiob.digital/KeASUp

https://appgridn.live/LEjdAK

Signatures

Detect Vidar Stealer 29 IoCs

stealer

resource	yara_rule
behavioral1/memory/1576-898-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-899-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-929-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-930-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-931-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-932-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-933-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-934-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-935-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-936-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-942-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-989-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-999-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1000-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1001-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1002-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1003-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1004-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1005-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1043-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1111-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1208-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1209-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1210-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1211-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1212-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1214-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1215-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/1576-1216-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Downloads MZ/PE file 10 IoCs

flow	pid	Process
139	2100	MSBuild.exe
139	2100	MSBuild.exe
139	2100	MSBuild.exe
139	2100	MSBuild.exe
139	2100	MSBuild.exe
139	2100	MSBuild.exe
193	2100	MSBuild.exe
193	2100	MSBuild.exe
406	1576	MSBuild.exe
406	1576	MSBuild.exe

Uses browser remote debugging 2 TTPs 22 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
12820	msedge.exe
12484	chrome.exe
2900	chrome.exe
1324	chrome.exe
12672	msedge.exe
10852	chrome.exe
10336	msedge.exe
3808	chrome.exe
2664	chrome.exe
4380	msedge.exe
1376	msedge.exe
4100	chrome.exe
12812	msedge.exe
11612	chrome.exe
2904	msedge.exe
12680	msedge.exe
11424	chrome.exe
1492	chrome.exe
1032	chrome.exe
4960	chrome.exe
5088	msedge.exe
3356	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk	vUPW5X7ncLsx5ezd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk	czBGCSxlnFibFaVR.exe

Executes dropped EXE 14 IoCs

pid	Process
1936	CGDHIEGCFH.exe
372	FHIEBKKFHI.exe
396	KEGDAKEHJD.exe
4352	vUPW5X7ncLsx5ezd.exe
4828	czBGCSxlnFibFaVR.exe
828	vUPW5X7ncLsx5ezd.exe
4780	BTsFNgRjDMAbibON.exe
18708	bJSkUpL0hJWQ8GFL.exe
1116	lJdu4jFv4Y9M4LA0.exe
1740	phvaasr1db.exe
12000	x4ozm7y5p8.exe
11660	6fu3ekf37q.exe
11640	UbMh6N0MLu8KrviI.exe
12132	7fjWMPWFWPLo7qRF.exe

Loads dropped DLL 2 IoCs

pid	Process
2100	MSBuild.exe
2100	MSBuild.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleChrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8I4Lurb7\\vUPW5X7ncLsx5ezd.exe"	vUPW5X7ncLsx5ezd.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3260 set thread context of 2100	3260	s9471.exe	80
PID 1936 set thread context of 1576	1936	CGDHIEGCFH.exe	130
PID 372 set thread context of 4508	372	FHIEBKKFHI.exe	134
PID 1740 set thread context of 13072	1740	phvaasr1db.exe	182
PID 12000 set thread context of 12032	12000	x4ozm7y5p8.exe	186

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
10404	4828	WerFault.exe	139
17324	4780	WerFault.exe	143
772	4352	WerFault.exe	138
13444	18708	WerFault.exe	174

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KEGDAKEHJD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vUPW5X7ncLsx5ezd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bJSkUpL0hJWQ8GFL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lJdu4jFv4Y9M4LA0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UbMh6N0MLu8KrviI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fu3ekf37q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7fjWMPWFWPLo7qRF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vUPW5X7ncLsx5ezd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czBGCSxlnFibFaVR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BTsFNgRjDMAbibON.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
12408	timeout.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133877279321607713"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3174447216-2582055397-1659630574-1000\{1927A618-16ED-4232-A5EA-67AEB62E4EC7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2100	MSBuild.exe
2100	MSBuild.exe
2100	MSBuild.exe
2100	MSBuild.exe
3808	chrome.exe
3808	chrome.exe
2100	MSBuild.exe
2100	MSBuild.exe
2100	MSBuild.exe
2100	MSBuild.exe
2100	MSBuild.exe
2100	MSBuild.exe
2100	MSBuild.exe
2100	MSBuild.exe
4352	vUPW5X7ncLsx5ezd.exe
4352	vUPW5X7ncLsx5ezd.exe
4828	czBGCSxlnFibFaVR.exe
4828	czBGCSxlnFibFaVR.exe
4828	czBGCSxlnFibFaVR.exe
4828	czBGCSxlnFibFaVR.exe
828	vUPW5X7ncLsx5ezd.exe
828	vUPW5X7ncLsx5ezd.exe
828	vUPW5X7ncLsx5ezd.exe
828	vUPW5X7ncLsx5ezd.exe
4780	BTsFNgRjDMAbibON.exe
4780	BTsFNgRjDMAbibON.exe
4508	MSBuild.exe
4508	MSBuild.exe
4508	MSBuild.exe
4508	MSBuild.exe
1576	MSBuild.exe
1576	MSBuild.exe
1576	MSBuild.exe
1576	MSBuild.exe
4100	chrome.exe
4100	chrome.exe
1576	MSBuild.exe
1576	MSBuild.exe
1576	MSBuild.exe
1576	MSBuild.exe
1576	MSBuild.exe
1576	MSBuild.exe
1576	MSBuild.exe
1576	MSBuild.exe
18708	bJSkUpL0hJWQ8GFL.exe
18708	bJSkUpL0hJWQ8GFL.exe
18708	bJSkUpL0hJWQ8GFL.exe
18708	bJSkUpL0hJWQ8GFL.exe
18708	bJSkUpL0hJWQ8GFL.exe
18708	bJSkUpL0hJWQ8GFL.exe
1116	lJdu4jFv4Y9M4LA0.exe
1116	lJdu4jFv4Y9M4LA0.exe
1116	lJdu4jFv4Y9M4LA0.exe
1116	lJdu4jFv4Y9M4LA0.exe
1116	lJdu4jFv4Y9M4LA0.exe
1116	lJdu4jFv4Y9M4LA0.exe
13072	MSBuild.exe
13072	MSBuild.exe
13072	MSBuild.exe
13072	MSBuild.exe
12032	MSBuild.exe
12032	MSBuild.exe
11640	UbMh6N0MLu8KrviI.exe
11640	UbMh6N0MLu8KrviI.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
10336	msedge.exe
10336	msedge.exe
10336	msedge.exe
10336	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3808	chrome.exe
Token: SeCreatePagefilePrivilege	3808	chrome.exe
Token: SeShutdownPrivilege	3808	chrome.exe
Token: SeCreatePagefilePrivilege	3808	chrome.exe
Token: SeShutdownPrivilege	3808	chrome.exe
Token: SeCreatePagefilePrivilege	3808	chrome.exe
Token: SeShutdownPrivilege	3808	chrome.exe
Token: SeCreatePagefilePrivilege	3808	chrome.exe
Token: SeShutdownPrivilege	3808	chrome.exe
Token: SeCreatePagefilePrivilege	3808	chrome.exe
Token: SeShutdownPrivilege	3808	chrome.exe
Token: SeCreatePagefilePrivilege	3808	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
3808	chrome.exe
4380	msedge.exe
4380	msedge.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
10336	msedge.exe
10336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 2100	3260	s9471.exe	80
PID 3260 wrote to memory of 2100	3260	s9471.exe	80
PID 3260 wrote to memory of 2100	3260	s9471.exe	80
PID 3260 wrote to memory of 2100	3260	s9471.exe	80
PID 3260 wrote to memory of 2100	3260	s9471.exe	80
PID 3260 wrote to memory of 2100	3260	s9471.exe	80
PID 3260 wrote to memory of 2100	3260	s9471.exe	80
PID 3260 wrote to memory of 2100	3260	s9471.exe	80
PID 3260 wrote to memory of 2100	3260	s9471.exe	80
PID 2100 wrote to memory of 3808	2100	MSBuild.exe	81
PID 2100 wrote to memory of 3808	2100	MSBuild.exe	81
PID 3808 wrote to memory of 4028	3808	chrome.exe	82
PID 3808 wrote to memory of 4028	3808	chrome.exe	82
PID 3808 wrote to memory of 1584	3808	chrome.exe	84
PID 3808 wrote to memory of 1584	3808	chrome.exe	84
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 828	3808	chrome.exe	85
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86
PID 3808 wrote to memory of 1880	3808	chrome.exe	86

C:\Users\Admin\AppData\Local\Temp\s9471.exe
"C:\Users\Admin\AppData\Local\Temp\s9471.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Downloads MZ/PE file
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7fff0a0ddcf8,0x7fff0a0ddd04,0x7fff0a0ddd10
      4⤵
      PID:4028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1960,i,2426823679410417538,3678757498050386408,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2156 /prefetch:3
      4⤵
      PID:1584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2128,i,2426823679410417538,3678757498050386408,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2124 /prefetch:2
      4⤵
      PID:828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2392,i,2426823679410417538,3678757498050386408,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2548 /prefetch:8
      4⤵
      PID:1880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,2426823679410417538,3678757498050386408,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3240,i,2426823679410417538,3678757498050386408,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4400,i,2426823679410417538,3678757498050386408,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5128,i,2426823679410417538,3678757498050386408,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5144 /prefetch:8
      4⤵
      PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x274,0x7fff098cf208,0x7fff098cf214,0x7fff098cf220
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1932,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2112,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2524,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:8
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3572,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3600,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4220,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4244,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3744,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5168,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:8
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5244,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5180,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6020,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6020,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4424,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6620,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
      4⤵
      PID:440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6760,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6832,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6376,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6348,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7136,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7144,i,16070385153888593290,17027536358581971056,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
      4⤵
      PID:4592
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\CGDHIEGCFH.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3852
  - - C:\Users\Admin\CGDHIEGCFH.exe
      "C:\Users\Admin\CGDHIEGCFH.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:1936
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1576
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4100
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7fff096ddcf8,0x7fff096ddd04,0x7fff096ddd10
        7⤵
        
        PID:2708
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1600,i,16243034408205141017,7816744722890041563,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2216 /prefetch:3
        7⤵
        
        PID:2900
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2192,i,16243034408205141017,7816744722890041563,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2172 /prefetch:2
        7⤵
        
        PID:2540
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2420,i,16243034408205141017,7816744722890041563,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2200 /prefetch:8
        7⤵
        
        PID:4776
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,16243034408205141017,7816744722890041563,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3184 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:1324
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,16243034408205141017,7816744722890041563,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3208 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:1032
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4264,i,16243034408205141017,7816744722890041563,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4416 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:1492
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5080,i,16243034408205141017,7816744722890041563,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5100 /prefetch:8
        7⤵
        
        PID:2808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:10336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x260,0x268,0x26c,0x264,0x280,0x7fff096bf208,0x7fff096bf214,0x7fff096bf220
        7⤵
        
        PID:10364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1912,i,9016372227494306473,434905562580585294,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:3
        7⤵
        
        PID:10676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2552,i,9016372227494306473,434905562580585294,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
        7⤵
        
        PID:10524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2152,i,9016372227494306473,434905562580585294,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
        7⤵
        
        PID:11948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3420,i,9016372227494306473,434905562580585294,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:12672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3436,i,9016372227494306473,434905562580585294,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:12680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4032,i,9016372227494306473,434905562580585294,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:12812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4060,i,9016372227494306473,434905562580585294,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:2
        7⤵
        Uses browser remote debugging
        
        PID:12820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5128,i,9016372227494306473,434905562580585294,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
        7⤵
        
        PID:13124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5160,i,9016372227494306473,434905562580585294,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
        7⤵
        
        PID:13220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5000,i,9016372227494306473,434905562580585294,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
        7⤵
        
        PID:17360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3744,i,9016372227494306473,434905562580585294,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
        7⤵
        
        PID:17368
      - C:\ProgramData\phvaasr1db.exe
        
        "C:\ProgramData\phvaasr1db.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1740
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:13072
      - C:\ProgramData\x4ozm7y5p8.exe
        
        "C:\ProgramData\x4ozm7y5p8.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:12000
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:11872
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:12032
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
        8⤵
        Uses browser remote debugging
        Enumerates system info in registry
        
        PID:12484
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7fff178cdcf8,0x7fff178cdd04,0x7fff178cdd10
        9⤵
        
        PID:12492
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1980,i,11334056134467172161,7103534370835947542,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
        9⤵
        
        PID:11972
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1600,i,11334056134467172161,7103534370835947542,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
        9⤵
        
        PID:12096
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2300,i,11334056134467172161,7103534370835947542,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
        9⤵
        
        PID:11804
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,11334056134467172161,7103534370835947542,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:11612
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,11334056134467172161,7103534370835947542,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:10852
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4436,i,11334056134467172161,7103534370835947542,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:11424
      - C:\ProgramData\6fu3ekf37q.exe
        
        "C:\ProgramData\6fu3ekf37q.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\p8A731l4\UbMh6N0MLu8KrviI.exe
        
        C:\Users\Admin\AppData\Local\Temp\p8A731l4\UbMh6N0MLu8KrviI.exe 0
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\p8A731l4\7fjWMPWFWPLo7qRF.exe
        
        C:\Users\Admin\AppData\Local\Temp\p8A731l4\7fjWMPWFWPLo7qRF.exe 11640
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:12132
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\q1va1" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12360
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:12408
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\FHIEBKKFHI.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:668
  - - C:\Users\Admin\FHIEBKKFHI.exe
      "C:\Users\Admin\FHIEBKKFHI.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:372
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4508
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\KEGDAKEHJD.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4784
  - - C:\Users\Admin\KEGDAKEHJD.exe
      "C:\Users\Admin\KEGDAKEHJD.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:396
    - - C:\Users\Admin\AppData\Local\Temp\8I4Lurb7\vUPW5X7ncLsx5ezd.exe
        
        C:\Users\Admin\AppData\Local\Temp\8I4Lurb7\vUPW5X7ncLsx5ezd.exe 0
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\8I4Lurb7\czBGCSxlnFibFaVR.exe
        
        C:\Users\Admin\AppData\Local\Temp\8I4Lurb7\czBGCSxlnFibFaVR.exe 4352
        6⤵
        Drops startup file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 696
        7⤵
        Program crash
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\8I4Lurb7\bJSkUpL0hJWQ8GFL.exe
        
        C:\Users\Admin\AppData\Local\Temp\8I4Lurb7\bJSkUpL0hJWQ8GFL.exe 4352
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:18708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18708 -s 716
        7⤵
        Program crash
        
        PID:13444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 1264
        6⤵
        Program crash
        
        PID:772

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\8I4Lurb7\vUPW5X7ncLsx5ezd.exe
1⤵
PID:4500
- C:\Users\Admin\AppData\Local\Temp\8I4Lurb7\vUPW5X7ncLsx5ezd.exe
  C:\Users\Admin\AppData\Local\Temp\8I4Lurb7\vUPW5X7ncLsx5ezd.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:828
- - C:\Users\Admin\AppData\Local\Temp\qlGOudlC\BTsFNgRjDMAbibON.exe
    C:\Users\Admin\AppData\Local\Temp\qlGOudlC\BTsFNgRjDMAbibON.exe 828
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 672
      4⤵
      Program crash
      PID:17324
- - C:\Users\Admin\AppData\Local\Temp\8I4Lurb7\lJdu4jFv4Y9M4LA0.exe
    C:\Users\Admin\AppData\Local\Temp\8I4Lurb7\lJdu4jFv4Y9M4LA0.exe 828
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1116

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4828 -ip 4828
1⤵
PID:10316

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:12692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4780 -ip 4780
1⤵
PID:17304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4352 -ip 4352
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 18708 -ip 18708
1⤵
PID:13464

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:11544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\x4ozm7y5p8.exe

Filesize
736KB

MD5
18e5e760b807fc2b05172215540398b3

SHA1
6a1b4d3227088473c45869469b68a1737b26b90d

SHA256
6cff9733bcd32c2af2da61eab8281cd412a6d208ce6b763b783157be2901d5bd

SHA512
23430597753696466eea1c54337b1d37a734918433be2e0637aaf022c0ef09d5f8b04a3793ccb1a296bb83d13fda832d677cb926730653d78b0833f96737fa04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
34c29bdb9e41b1f47f2d2786762c12ec

SHA1
4075131b18c3487e3e848361e112009c897629c7

SHA256
67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17

SHA512
ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
9273a8b8021f553e3c87cacea63a510c

SHA1
c5ffcd8f39d9c08e83c78db88600edfdd8826df0

SHA256
22bc3dc6c814e95239f6dc28f7b44f5e91335b368fb34efa7d9ac14eebcf8058

SHA512
1f39b082cf62c128bd6081a96b7857d1cef45ea843220c1e41e3b021c266ac621da13c7cdc48140450fa5667e7f20554e63dd75bd7ac6c2c698172ac2545285e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
c5e4d9d7b71764abd49378bb0ab67f8c

SHA1
baf764eb7cc5faa085572164cc8100091d2684c2

SHA256
e2568958bb130aa6972ee73646cab216ef218bc683d6f966d5d96645a216a095

SHA512
711d3bfdd4eac590c79a36b216370cbbb1c3ad9c2b404a1e5f5e9e1ffba1493289c83f505c18c2d5f60be6352929b16814ee8b23c8380223d9845dbcf695373f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
19c9270980054259cc1cca91d1615e6f

SHA1
2e9e5e5e5cd5e8b3ad3aca7055cc01c2a3a10ce0

SHA256
e9bb5183d1b045fc4df8c2850aa4ec1d481e6c96e4bd8cf94a69d0e60ffc8d20

SHA512
cad4572aa2d277d919377370f78b39ab1359398e5ddd990c7579dc7eea8d7225a01c38e75f0fe764bada98a209bcbda86d19ff83bce2430555d70f693b9a64e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
1ea7f778a234743a944f3738b167d136

SHA1
cb1b990d9d083d186dc1d80cf18d6b66cb427d77

SHA256
1f489fc92994e94b14de2efa1bd30f8522c34c505763b447479f9ff62822537b

SHA512
ff459a3e5ea5c99930e93fe2635d4147dc5570f5a041476750fc2a6574c6fa1825b2f3362c286797135b6815df932c9b8efe9381055ba3edb27e502e22b95d4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
0605b75c5c345cc202a7885499cc09a7

SHA1
540568cdb245ba26bce8711347e456320012e83d

SHA256
8ed5d8964a977a79c5aacf34853c9e5e00a06de2f2f0964a56c4089805a2dda8

SHA512
dae16a98e4cf861b918d684f0d7660e1c6647897afeded6859253a51f8dd95c41f007e3f20fe43da0292b493c170cb94fb8370d7b17b4f23cf2950cec477f9a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
f8bc2f923df24756c33b7636faf9c8e7

SHA1
59361637353cc4af56cff17f6476f419d3656edb

SHA256
b621786953d095473947344d600e641da926b64316d4460d4acfe874ac458fcd

SHA512
4c105fe8aec435aeb261c5c3b209689b6b5012622251dc4d46a7ca0518c7b72ce31935b2c20f809252e4e10fffa8bf2a6348a36c8d0713af12aa5835d28b529f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
35KB

MD5
69453901a168c86a39fd6a949e86faa1

SHA1
642ce4bc00a5579f086e424c753aed1f4507551d

SHA256
e26ca86786494cb46056524163d2b947765c6aa8400bb0b9dfbd28629206dc88

SHA512
6542c0671a2b96d1d60d96947f73c68b84c38e24ee8169f19551acc52ac563b2c258f92b52dc0fbb497e77e016a99f1f888e5e1630d05be4f44bfa80afc45e93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
63KB

MD5
1901d2bcbbabee4bbb9804c30642ae2b

SHA1
f31774bc12614be681c0b0c7de3ac128f0e932db

SHA256
15eba349e5829f11363614b8f3dd9c3d04994586601d3c4c4d8069e0f5655310

SHA512
bdb94d7d8cf47b239c61559545b1dd26e05da909fec05d215471388545879cd8ec9e1fea51c04ed43927e2b07b5b80a74f09eb9038c8d9045e4161ea69df215f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
38KB

MD5
f53236bc138719b68ccd1c7efb02a276

SHA1
26b7d3eea5d3b12d0b0e173ebf2af50a7d7e56d6

SHA256
787c14f8cc865430c03c96a345044b7c5b8dc8a032511a500d4a42228533acd8

SHA512
5485bc7ccce8ec75f60bca3be846086a4bd4466009c8e22da9cdd16bb1154529af2fb2667cd3a97485cc4f6635fb79ac0fdda4f3e1f39f25f6196f708a92d740

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

Filesize
317B

MD5
52244820188cbcf3dbbf7b40420f269c

SHA1
dd77884ecec93b02500867be9059c8c8d6c4d13b

SHA256
2e9ac2fe7713cc8cafb35e5415f7cdf4a411cd3e9669b5bc0435f6909d11b157

SHA512
d8e16a34bf4706e8ccdfa98e6f59a7acb9088d1aee76aea8ecf8c4e5ddbdbb0495811fa1eb9982bfad8ed52e0085e6977fe392ace2fa6c7ea1b713370198fa26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG

Filesize
317B

MD5
e4b319a2426f9662f034013bfda4cb17

SHA1
0d3fba0c54b1a3c69216db447efea770d1c67b16

SHA256
84b1ed1ed9aafcc8084691ad4fc2b9a7a86fdd384f1bcd49443feddf1b8e2fe9

SHA512
ea5826aebe660468951e22e278973e62c1bf95a27f90a29cfbbbcefb309b402a9e403adf09f5eb6a8b6e57ff4855fca5e2de25820de13d3f0d220d7a4df45fd7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
345B

MD5
ed75b11e436c718197dece6017b8e441

SHA1
0345b718e3d7d86bb064de1f4e9f6c745e166a07

SHA256
bb8f7038b1f76f1624728f4a4d7d1ab60e5218423cc8c4bf0d51a005782247c9

SHA512
12d728fd70bdc144d8618dee743b9fa267e886972ece4d3423dec1dbd17f27340a23319422ff77ec15e48aea6da7aa1ffa7cdc7b6ab70c2ac5c9f859350960ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
321B

MD5
b9149a5e1e604ee7b9fffa744f4a00e5

SHA1
d1afa07020ae8059ded255a73f6b6c4d56a27cb4

SHA256
c4527c249a906055a3e599653148ad2aa04eeb7f54f43beca0f4f444b36ca8cc

SHA512
ea4d1fd6baa4da494a0d049d54785ef070f577db9fbe02eea055309b0f5af71d31698a2a46fe11b675b6a6260af33a899cdb026d4d8c4f6da0a6bc319dcb2891

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
130KB

MD5
fbf977a8b30391b5b84bef0e47a1e952

SHA1
2914ebfe5ddeaa4b2a2b26146e8c29798c49150b

SHA256
dd97c7a9b8fc29cd99f47a156b95d7af1dbcc232aa5cf3a45ee171e3c5ad62ec

SHA512
d21b169884f4ea1d7371f65045304a42953df3453c47813f4214be8cf1fa8055a1d86e4f0452f342573f4ead4b2b3c44f8e119ab8cbc992cfcc58651be2f77d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Filesize
24KB

MD5
1c6b8cba44ed9f3d653cf12870b7f644

SHA1
2524d56f393f167f52c011e67cb1c4ad046c2266

SHA256
36c8f39b29e09d9c045a8d6003076961590112e9002736efb1e8f73a39ca9317

SHA512
eb1de930b97d31cd6a9c294835c915df452b0f79daa224784b640c9f11af38f4cc52e3fb13baed4cf280bb3c718eb925c25a21c40a470b3cff60e4f48920d2b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Filesize
317B

MD5
5f4471d0c32ad60ae2162bce940d6a6d

SHA1
5ad8ef05e82392a0c9b9ca1558c4e51fae819545

SHA256
01a2bffe3498bf965866a5f4871a153fbefdb85e1666fa0675f9795f59615d33

SHA512
43f43011c565c5080e7c2b64e3159c38e89349e53d323389b08a08c1cfaf2dbd64fc978b3aa8c0fe167d72889eb7a0b059debd80ce07d1f66814ff169ff23dba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
bb36b0d01ed54d8f896bef56c9b43e72

SHA1
4470239d1e7f1f9c5e6b4e8e02480ee7618b7e54

SHA256
87733ad3a2de8ca5395a9993a6d0fcf872b987428ae23ad61063e801d3c20da8

SHA512
4354c9ee5bab13d6a4bf21c72a67296d00bd830c9a0c28ff1045d822dd7e07050b80c37e85a294daf0a32a735a61f29ff73d0ad54d791ea42ade5c1343e5a111

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
335B

MD5
a3ba56c9c7b71200d20da82c7c7cd013

SHA1
2c594cf4aa9466afe27ba634eb9222275365eead

SHA256
58f42faf3a99f49522d7c5774027db3d1d1d4e0ec39403577e428972e1e46e31

SHA512
3dadd44659909bb556955b7087ec47fc03800e8d905c97fb17b002fb8c1d0057f9b2a8d0f0c2a315e2671d61f08ff020ffdb2fc73aa3f2953206bc1a212fc99d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
13B

MD5
a4710a30ca124ef24daf2c2462a1da92

SHA1
96958e2fe60d71e08ea922dfd5e69a50e38cc5db

SHA256
7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7

SHA512
43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
66a6890b95792faf9e0b03bf82471e30

SHA1
89cb6714e7a7d9985d773102c1ebabcec7ee7359

SHA256
15e4247f6f256fd3ccad43602f467188937b84e87ddd5d49f89023f309981799

SHA512
08da5768ebdc0140bbcaa0264e7897f1a67be26ed56e86727f52602e5a3c6655db8c4c9f6b9e7b650a88667f7c38be1514834d612a58a724283e6f7c8f03901c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
751cb6129686d6f11c2af64a01d98f9c

SHA1
6faa6f47c1ce4bb829677f58e8f0698398f4d96f

SHA256
226bfe610ce9dcf3aac078146c33af4e09b4b1ca9f6a188a3656950b17913584

SHA512
d9fe0607da172fd0ab4a68a8e0a7cd99f30ddc8a905ce2578cb6f496a4b90854185d14346d67f3b9ce44ae3fc3264d8df52768982d302b7895a8234c48231c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
57bed41031a02717354968c00bbfb1b8

SHA1
67cfcd1eb59f4bff4b55432d82b57d1b7e3896a0

SHA256
d6f4ad7f5fc93456daa26ca4a38d867c510c2732536a1f3baad3b3e3d8a384d6

SHA512
df20b49576c202d2da4e509d2cda219cc07f2b0901a28f8940e7b28a044b41a3d180ae375c4dec00b680fb4f0642c55e480785bcffac49c8347e0b899f6f1d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
29f13140c50c2394177caf96baf3a5c0

SHA1
680e35060382a846752eb208b62de077d31fd1eb

SHA256
f4554eb3e1e133edb5f5f01e19539ffc52adc0b346e19c4742a815e7a92b2dcb

SHA512
d964d066a2913d3b6eb73925160d7e9d79a94ae5c6e3956cd361b54fe53833b311990a91346917bc90b227301d864939f6a5a417ff52ef9fe8e21971b1a661fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
a46a324553367dc0b13a007305e4f102

SHA1
005a700ac0bf4429024f9e857e2281f82f370aed

SHA256
a718f2fe90be4422382450b4959840a13d6d18dea09d3da5394624198a126063

SHA512
d3b9fcde15be13451aa441070d9143fc53faa6a2725adea7fb9c340bcb9d7ea183dc1b36c0f8ec21c1748c80bc8fa03a14f198c2fc914c9f8e81702bd8e18399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ad0fc24-14c3-4a53-bdc8-24ae321a49ae\index-dir\the-real-index

Filesize
552B

MD5
4eee7324d718d5b70926f8f342c4bb24

SHA1
881d24f9d6cfabf260a4fa28669c0ff51d2f0b99

SHA256
e487850e655d12d814e1bca1916a4c09abd978e2ea501d586c54d0f85a021dff

SHA512
1ae257e10548f521df19f2c13d729b0b817e4074fa94ee05389cdf54ed0fcb7346a59c8e821d97401d8d66c7fbdca0a2368fd3d5072795b68398202f0f24b988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ad0fc24-14c3-4a53-bdc8-24ae321a49ae\index-dir\the-real-index

Filesize
1KB

MD5
2258036942b166ee49ba9f052a70d9a4

SHA1
8213dc51d5cd0f41860eeeff5253aa66d262ddbe

SHA256
200b3eab0c8c5a4a71cc39ffaafd5cc79d8b1316ef5c08a3d707c312abe171a5

SHA512
a888aa3981a678318fcc2e583f209f64b135ad0dfa7ca0c6bcb0083e95e00d1314204de895af53b38b532cc3acc3fed388bdb17a62d91a57dd5101364dd0e410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ad0fc24-14c3-4a53-bdc8-24ae321a49ae\index-dir\the-real-index~RFe57e493.TMP

Filesize
552B

MD5
58dcd224049017341ffbfd36a4d9bb16

SHA1
e6e47e12d3c3d63f392036cea4e42bb5463c6672

SHA256
ee37687841bce1c2be317f47154c529bb070399dc15da6c4854bb06c23ce6f20

SHA512
59dc014846fa4dffb38a556da6e759283a0c53d17780914e88900d81a5e8778e23fdd0216fc3ab70ee09bb9ac1d4c9e350c0e75a32b3876153d739a63b9de82f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ad0fc24-14c3-4a53-bdc8-24ae321a49ae\index-dir\the-real-index~RFe58bcc3.TMP

Filesize
1KB

MD5
34650a02c2ced98d15b21c0eb4027ba5

SHA1
c1544374787b450e19f0846e1ec6c40b89cbc0e2

SHA256
bcf7c354b58f71cd69dce8108fd24d3abc63ef74a52f214cc985fbcbd1d3d49b

SHA512
aee11de6652342a255018d3f68c6e23dbe4687bfe778abcffe12dd3b7c536aeea85662704b70520b80095ced868c48e100de53cb75b93df8551f8077775c21b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
c297222dd6334f84ed9e1036db131a63

SHA1
70987340bfa6c5dd362995c01eca575253135db2

SHA256
b92a815af0a5d26f62ea7ede42ef5b3c120b63cab8600e05b007a70aeb96a56f

SHA512
edf917a7f17dd73550d69b2ea6861464711abe26f5d9d6b1ab9d901f2617c107838a0b35649417b95f6774a113360cc63ec2f632eb3c353bb3d6bed2c921f7db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
084a42f08b99ad19df4cd6df29dd7354

SHA1
31d703f9cddef1cc0a06afc32cb4f4076d556b2d

SHA256
53f2cd2e7b588df8663269e5fca5f390849908d5a7d9b319de818cffe74d197d

SHA512
0de2ad4717da41d75a14228796ff67d8834d9e29e964a1c75fdabe3faed3ff9fea58d5eb44db5ae4cf707cb09a6a70549a671f37b7d6a93dc358c79d6c29ce34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f3d562e76ab0cbea3f2d3e9cc020df30

SHA1
69d5fdb61c0f8bbb49ca412998ea31c077bc9f9e

SHA256
e56327b852485e1de88198407ab075709154d09c54f97c0cc3f77e862b3ed485

SHA512
b4b7f16e7ba2b588002aac8650f340cfab1cb895a802ace3fb7a463cbfa45a4834ab496fbca1693cb3b62079d01cd0b5a6dce53b4e50c3cfb0d6e0c96f734208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
0ef34c76e3245e05561117fe20f08f3c

SHA1
60aaf811abec3073f70770f0747a91ff999a8c63

SHA256
0b0ed6dcca10e342c6202a5af6ed5caeb7bba8ac9d579ed05727f41d99762295

SHA512
9f9bdeaa97699ff2ce65ab9a68577e2c62f35e97e2e73709d49df5673a4bb0d9fc6320e19e2aac5915648f5a552bd03889169e45509bdfc0203c4b3df53c81cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
8abc0eb6efc0685f741936ca02220eba

SHA1
25e2606481a4f1db518f40a81c5703682b6d65fe

SHA256
9784ea430ff40f8218a57bc8f4213bdf70731c6d48746d3e12c300e66cbff24d

SHA512
e3cd262ef48f9f1d80a6e9a13fefb6681f347850ee522dc75139051ef10d2072da54aa17414f9b6bc3e169b439871caf22288c3df9fc5b6c9bc6759aa8fab6d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\01f7d539-c4ba-43dc-851d-2988e28b002d.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\bb528923-27c8-4b43-86c7-dc84b531a8d2.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\bc959843-b921-4b5b-8770-a517e9495840.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk

Filesize
1KB

MD5
1960b914045f7c881ceb1d2cc0ac2f41

SHA1
92a40f0e52fb870199e3041a84d68d6be272c409

SHA256
c04d845c9c95e5a279bd97f280649ac4465c58af8e6c86b2df14eef7959165e2

SHA512
b1276a223d3b72ce46abf5d95997d28de1eca45b03e3205c1768c1751d951f1d6fd83ebfb98abebe241251c82cc514c514740b0b7ff33db0beef7b3bc1dc9b5a

Download Submit
C:\Users\Admin\CGDHIEGCFH.exe

Filesize
634KB

MD5
d62b289592043f863f302d7e8582e9bc

SHA1
cc72a132de961bb1f4398b933d88585ef8c29a41

SHA256
3c5a551b8fee65ffc444a3c0730b990591c3a95e442426563539f0a2ca3871d2

SHA512
63d389102c1b78ea5157aad0a3f45f351a5752ae896729d85be81b70721f19869efdb8dfa87906f891be9bec0d9154b7498e4ac4216fd3ec574fae64707e258c

Download Submit
C:\Users\Admin\FHIEBKKFHI.exe

Filesize
850KB

MD5
260faa08dbff4bc7ca6346061f42b956

SHA1
ccef508bb2693b097510015ef89ebb8f0289c5c1

SHA256
c47a55b842177445756163ca2d5cadaed5cdd4d313d7897b9aaac8e1d1c6e810

SHA512
ae30c903720f58abef12b9e091872d4a6470bae5ba246fc1d35dbaa4aecad04803647a0339490090a037de780b09df4282d5cc6247731729bf24e8fe872c42dc

Download Submit
C:\Users\Admin\KEGDAKEHJD.exe

Filesize
251KB

MD5
58d3a0d574e37dc90b40603f0658abd2

SHA1
bf5419ce7000113002b8112ace2a9ac35d0dc557

SHA256
dcc05c3ac7ae22d601bcb7c97cfcda568f3041bd39b2fd8899282dfde83369a5

SHA512
df61329a32e9261b01c5b7d95e0d9a3fb8cc36e5d90ede72bc16befe00fb32c221898a8346db9de07c0f5dcba57dcdbb09a22ca8b73223f989d33ec433c3a90a

Download Submit
memory/396-916-0x00000000008F0000-0x0000000000934000-memory.dmp

Filesize
272KB

Download
memory/1576-1002-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1208-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-930-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-929-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-932-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1216-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1215-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-933-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-934-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1214-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1212-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-989-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-999-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1000-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1001-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-936-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1003-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1004-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1005-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-935-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1211-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1210-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1043-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1209-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-942-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-899-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-898-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-1111-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1576-931-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2100-0-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2100-2-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2100-5-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2100-59-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2100-914-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/2100-3-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/4508-906-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4508-907-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/11660-1254-0x0000000000F80000-0x0000000000FC4000-memory.dmp

Filesize
272KB

Download