vidar | b6e7e1ddaceee8c401056c0bd2e552c3545f6906b7de4b62ab3a239e5b01dfa7

Analysis

max time kernel
12s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2025, 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.ps1
Size

3KB
MD5

21c010cf4481df82d7e5e4a0b4260793
SHA1

d2ae87b41aa4e951c3a3131ce7ebc8969948ed97
SHA256

b6e7e1ddaceee8c401056c0bd2e552c3545f6906b7de4b62ab3a239e5b01dfa7
SHA512

8f97b34ecda980b0a738d98a99a28ba6f6ceafe65ae97f41b0fc8561a919796e729429507a18e9fe0ef79feb6ee892afb29fc325615c920d72111f3649b3bf5f

Score

10^/10

vidar 00cb84c6bd4caac4bdfc1131beae4df7 credential_access defense_evasion discovery execution stealer

Malware Config

Extracted

Family

vidar

Version

13.3

Botnet

00cb84c6bd4caac4bdfc1131beae4df7

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://jacrcell.com/joomla/crypted.exe

exe.dropper

https://installsh.pages.dev/config.ps1

Signatures

Detect Vidar Stealer 63 IoCs

stealer

resource	yara_rule
behavioral2/memory/924-47-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-46-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-48-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-57-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-58-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-63-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-67-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-64-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-72-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-77-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-73-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-93-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-125-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-426-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-425-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-427-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-430-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-434-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-435-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-436-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-440-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-442-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-803-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-851-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-848-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-853-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-854-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-857-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-858-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-859-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-860-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-864-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-865-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-869-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-874-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-870-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-879-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-875-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-880-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-881-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-882-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-883-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/924-890-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-944-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-949-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-950-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-955-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-959-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-956-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-963-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-964-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-965-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-970-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-971-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-1335-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-1337-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-1336-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-1338-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-1341-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-1345-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-1346-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-1347-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3136-1351-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	5836	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3736	powershell.exe
5836	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	5836	powershell.exe

Uses browser remote debugging 2 TTPs 16 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3312	chrome.exe
6140	chrome.exe
3972	msedge.exe
1772	chrome.exe
4072	chrome.exe
3308	chrome.exe
4952	msedge.exe
4924	msedge.exe
3164	chrome.exe
4768	chrome.exe
6092	chrome.exe
2184	msedge.exe
4244	chrome.exe
2740	chrome.exe
3908	msedge.exe
2912	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
3600	updater.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
5688	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3600 set thread context of 924	3600	updater.exe	97

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4276	timeout.exe
5104	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5836	powershell.exe
5836	powershell.exe
924	MSBuild.exe
924	MSBuild.exe
924	MSBuild.exe
924	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5836	powershell.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 3600	5836	powershell.exe	96
PID 5836 wrote to memory of 3600	5836	powershell.exe	96
PID 3600 wrote to memory of 924	3600	updater.exe	97
PID 3600 wrote to memory of 924	3600	updater.exe	97
PID 3600 wrote to memory of 924	3600	updater.exe	97
PID 3600 wrote to memory of 924	3600	updater.exe	97
PID 3600 wrote to memory of 924	3600	updater.exe	97
PID 3600 wrote to memory of 924	3600	updater.exe	97
PID 3600 wrote to memory of 924	3600	updater.exe	97
PID 3600 wrote to memory of 924	3600	updater.exe	97
PID 3600 wrote to memory of 924	3600	updater.exe	97
PID 3600 wrote to memory of 924	3600	updater.exe	97
PID 3600 wrote to memory of 924	3600	updater.exe	97
PID 3600 wrote to memory of 924	3600	updater.exe	97
PID 924 wrote to memory of 4244	924	MSBuild.exe	101
PID 924 wrote to memory of 4244	924	MSBuild.exe	101
PID 4244 wrote to memory of 4804	4244	chrome.exe	102
PID 4244 wrote to memory of 4804	4244	chrome.exe	102
PID 4244 wrote to memory of 1704	4244	chrome.exe	103
PID 4244 wrote to memory of 1704	4244	chrome.exe	103
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2884	4244	chrome.exe	104
PID 4244 wrote to memory of 2948	4244	chrome.exe	105
PID 4244 wrote to memory of 2948	4244	chrome.exe	105
PID 4244 wrote to memory of 2948	4244	chrome.exe	105
PID 4244 wrote to memory of 2948	4244	chrome.exe	105
PID 4244 wrote to memory of 2948	4244	chrome.exe	105
PID 4244 wrote to memory of 2948	4244	chrome.exe	105
PID 4244 wrote to memory of 2948	4244	chrome.exe	105
PID 4244 wrote to memory of 2948	4244	chrome.exe	105
PID 4244 wrote to memory of 2948	4244	chrome.exe	105
PID 4244 wrote to memory of 2948	4244	chrome.exe	105
PID 4244 wrote to memory of 2948	4244	chrome.exe	105
PID 4244 wrote to memory of 2948	4244	chrome.exe	105
PID 4244 wrote to memory of 2948	4244	chrome.exe	105
PID 4244 wrote to memory of 2948	4244	chrome.exe	105

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\sample.ps1
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Users\Admin\AppData\Local\0990244c-4d1e-4dd0-a0d4-5d5cc6bd6aa8\updater.exe
  "C:\Users\Admin\AppData\Local\0990244c-4d1e-4dd0-a0d4-5d5cc6bd6aa8\updater.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4244
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffecf4bdcf8,0x7ffecf4bdd04,0x7ffecf4bdd10
        5⤵
        
        PID:4804
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1572,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2056 /prefetch:3
        5⤵
        
        PID:1704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1948,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=1960 /prefetch:2
        5⤵
        
        PID:2884
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2340,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2520 /prefetch:8
        5⤵
        
        PID:2948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3224,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3244 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4072
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3276 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1772
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4256,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4316 /prefetch:2
        5⤵
        Uses browser remote debugging
        
        PID:3308
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4508,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=1728 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2740
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4220,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4260 /prefetch:8
        5⤵
        
        PID:512
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4968,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4972 /prefetch:8
        5⤵
        
        PID:3592
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4860,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5364 /prefetch:8
        5⤵
        
        PID:2060
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5412,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5424 /prefetch:8
        5⤵
        
        PID:4228
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5620,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5512 /prefetch:8
        5⤵
        
        PID:4260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5124,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5736 /prefetch:8
        5⤵
        
        PID:716
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5384,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5392 /prefetch:8
        5⤵
        
        PID:3244
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5388,i,1775973322717120963,6923731818968251908,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5500 /prefetch:8
        5⤵
        
        PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      PID:3908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffecf49f208,0x7ffecf49f214,0x7ffecf49f220
        5⤵
        
        PID:5080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1916,i,8234744789427068012,17592813102812765505,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
        5⤵
        
        PID:2928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2096,i,8234744789427068012,17592813102812765505,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
        5⤵
        
        PID:4108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1940,i,8234744789427068012,17592813102812765505,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
        5⤵
        
        PID:932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3572,i,8234744789427068012,17592813102812765505,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3600,i,8234744789427068012,17592813102812765505,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2912
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\79ri5" & exit
      4⤵
      PID:1924
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        5⤵
        Delays execution with timeout.exe
        
        PID:4276

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\UpdateCache\WindowsUpdate.ps1"
1⤵
- Hide Artifacts: Hidden Window
PID:5688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\UpdateCache\WindowsUpdate.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3736
- - C:\Users\Admin\AppData\Local\2f1312fa-070b-442b-acab-bd2e17bb8067\updater.exe
    "C:\Users\Admin\AppData\Local\2f1312fa-070b-442b-acab-bd2e17bb8067\updater.exe"
    3⤵
    PID:380
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:3136
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        
        PID:4768
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffed18ddcf8,0x7ffed18ddd04,0x7ffed18ddd10
        6⤵
        
        PID:4984
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2088,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2084 /prefetch:2
        6⤵
        
        PID:4332
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1988,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=1612 /prefetch:3
        6⤵
        
        PID:3552
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2392,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2552 /prefetch:8
        6⤵
        
        PID:828
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3208 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:6092
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3236 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3312
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4296,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4316 /prefetch:2
        6⤵
        Uses browser remote debugging
        
        PID:3164
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4456,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4600 /prefetch:8
        6⤵
        
        PID:4424
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4812,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4852 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:6140
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4980,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4996 /prefetch:8
        6⤵
        
        PID:4340
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5296,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5348 /prefetch:8
        6⤵
        
        PID:1480
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5304,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5388 /prefetch:8
        6⤵
        
        PID:4128
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5376,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5348 /prefetch:8
        6⤵
        
        PID:1516
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5692,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5368 /prefetch:8
        6⤵
        
        PID:4376
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5352,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5844 /prefetch:8
        6⤵
        
        PID:4324
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5672,i,14522058746761705925,9580173242929519599,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5836 /prefetch:8
        6⤵
        
        PID:5332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        
        PID:2184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffed18bf208,0x7ffed18bf214,0x7ffed18bf220
        6⤵
        
        PID:4364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1976,i,10849078970243807807,956282299945491181,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
        6⤵
        
        PID:3080
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2180,i,10849078970243807807,956282299945491181,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
        6⤵
        
        PID:5316
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2524,i,10849078970243807807,956282299945491181,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
        6⤵
        
        PID:2044
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3616,i,10849078970243807807,956282299945491181,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3972
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3644,i,10849078970243807807,956282299945491181,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4924
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\c2dt0" & exit
        5⤵
        
        PID:4852
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        6⤵
        Delays execution with timeout.exe
        
        PID:5104

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\c2dt0\26fu3e

Filesize
16KB

MD5
d312f3704e9476cea069c84f3b3904fa

SHA1
875c81f43c2d7333a2abea3dca82592f902d342d

SHA256
a4ae8e1fab1187cba15f2ea4965e34fd511862dd076784649f0bff43df3d07a0

SHA512
16744efaf14fe17ae2fc418543a90109e86ba149c602a9c3234d2023be4382696fd536959cf94076445c6bbc7a25c5fff80650d662654803731cc1b14c712a38

Download Submit
C:\ProgramData\c2dt0\5fctr1

Filesize
13KB

MD5
99992044c2cf7fcdef884f292479bfff

SHA1
d4eb22b95da957e3492c9c475c2a2640abf6c462

SHA256
1da449586850587c4cdcefadd911edc2752186343b7b172efe45d5fa7a7134bf

SHA512
4c6cdf2a09dc172dc657007fee0215bee55033a75b32916edba8d18d4d507da0852536b015e5ecec6b62a6781c39e2d3bc3bc3868c3b891c10b933fd2516e89f

Download Submit
C:\ProgramData\c2dt0\aimyc2

Filesize
288KB

MD5
9a3efac6cbb953007e61987d5299af8c

SHA1
1b636605499b29843c6e174e4839ba9b5903a4ab

SHA256
8d5473e4703144bc973151bf6d6b77fa6e3cc75b22996b308560468ae966491d

SHA512
da6115118c04a34aa90d8a1b353270f4fe9350a5ae0eed51918ebb8e3f97e14c42eea98b7e0080e9e8ee451cd3ab00c751aa1493c5ad2e9e9e79d5e88d74dc01

Download Submit
C:\ProgramData\c2dt0\dtrqie

Filesize
6KB

MD5
4d6318ff5bbcfa42c312fb4c148b20e7

SHA1
9c09a9e541e9d00fb474a59331706a2551d543ef

SHA256
ab0f81ee44eeb71ce4e73150c3840b3103df044df6d35b19af63b91cfbe5978a

SHA512
26f950f785316f305f38cf0dad96601aa27004f0b6b70889167e7b0a4a85ec18432a2066145312d6f58dbdc82feb8a96fd903897e3fd6ac1828f042c3102f09a

Download Submit
C:\ProgramData\c2dt0\s0h4oh

Filesize
14KB

MD5
e3633b3ca08a0f9a49ee507d77d25a96

SHA1
f12078048c28e3e93f416f5b716578bdc84f1ba5

SHA256
f06a55a3f757a06e386584a3851493d73bb35fd829cc3fa2c6e1b1cf938b1f2e

SHA512
1168607f30ab0005be001a7c122d0f7c107892c12ce334eb9335d5c7f3afa849cdac52bd2de755b9397543220a471a19e9f6da39021f0507e181930656e05061

Download Submit
C:\ProgramData\c2dt0\v37q9r

Filesize
9KB

MD5
091e40a8afddc217a4d52689b6155870

SHA1
856effee5088c2994f07595f21b3307bb2d5c61c

SHA256
3806488cf2168fb312aaa14e05f1e86f885c396f4c3892a4d5b14e192fba975d

SHA512
190965000f56f06a93d50a8bbf37fc93a183d644065660340a350d6c338475d8e8e5473df37996723f186ec13cc487e8e9c35113e60d6b31231030b5bba7cb9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
734B

MD5
e192462f281446b5d1500d474fbacc4b

SHA1
5ed0044ac937193b78f9878ad7bac5c9ff7534ff

SHA256
f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60

SHA512
cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D40B29EF2AAB638A6E53A219BE0F7862_7CC1BE4083661CE8C617B0F6CF027C04

Filesize
346B

MD5
5b258e8d665ed707ae7a11c6c6c4b2fa

SHA1
fdcd580b8b051e01f1fd104bb16e331057486120

SHA256
56264a7b7b59136dbaf57a076106b075e1772dd64864df600a041db0a3fb646b

SHA512
a183b3dfc7f884cf0094a3674663418144b3548f5fcc3d39768618598f1f932b82a3e0c09df2782051b2d3bb7a398d85f49ae38765f3acca6e7f8f8a5666a7ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
657715c7a8b57a80db42633e79334ef3

SHA1
4be3477d92fdeab34f7e73be34c340b4d27bab96

SHA256
efb9f877739c43aa2d2f81697b9f4ca81f66b021633bbf672bd82e917346304a

SHA512
968efbfd189517d8429eacbfd01a9dcc24b40e519d61dafd3ffb94ffde7a2bc61113a4d6ebd693ad5c4950229904ec0e625e16a3148c65d0478b2d50a1387167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D40B29EF2AAB638A6E53A219BE0F7862_7CC1BE4083661CE8C617B0F6CF027C04

Filesize
544B

MD5
0ccaf6cc4e487a49c05bb698aa250aa2

SHA1
5c6b3c13e2b60e5bedaef45d7e40acea64fb6441

SHA256
ffb31d702b2697f2fb896beacc58993552c685cc4fd6455d610a488b6b11c872

SHA512
6b07a37a78ac3249e498f22f3cc01d1fdc5e089b898ad24ca36c303711ec9dcaaaeb845589134708f59365c0b4f5a5af7cf744595aae8678689e0f12e613c766

Download Submit
C:\Users\Admin\AppData\Local\0990244c-4d1e-4dd0-a0d4-5d5cc6bd6aa8\updater.exe

Filesize
1.7MB

MD5
175c9b6b2db3b3624f7df4c54dff3262

SHA1
a96c038467d2d6ff0b95275a828948997b6987a3

SHA256
5ce7687d00cc5cdc0b7575bc68940f7a092a1f559f987f3b6a9b0c837eaa6496

SHA512
3d728ce053930f16c8debc087807b3eaadef3c9b21a452b49f13ce767b35b221e71b15db8c849fe71c7d0077d2c0ab31506762626622f87347c596260cddff34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
34c29bdb9e41b1f47f2d2786762c12ec

SHA1
4075131b18c3487e3e848361e112009c897629c7

SHA256
67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17

SHA512
ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
13e85db7ab7bd0131b6d7b372eb6b3cb

SHA1
5bd031c1d79faee9f5b180576fb2ba73afd236a9

SHA256
96bf5616e02db2a7d71c4eb64ee4bf0ca8a06700e34ffa47bdc9c02f97092e20

SHA512
63e735544156689c62d6d5cffe428e6cf749066239e69dae910f08b89aa9f87efbeaf9ba5fa16d2644d16478ee854903270d4e330ddf89ea1bae6d54c98cb029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
4d54b28ade05dd079f300c3cdd5b3a87

SHA1
243bc3c653580832e2391e91c4b97ef340cb89d4

SHA256
12b8a290c5a476c6e183325497618225bf909d6bad3023e8f870c25402f9c7b2

SHA512
6ac0d6a1b417f8ecd7f5c6380f691f0649a437bb3686ce1020a280fa523d096e24bf5630a7c12c7380a31900ca494b1740601dc3f0e9f6f387fc350254bf81d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
aca850610df02f2aaf3e9fe2ddd781dc

SHA1
05a52f5bddccc4a4c0ed90bd86b072dafd55a682

SHA256
5192098bc039e131c29d84cdf10fcffe06dec03be693320904664e03f11e3125

SHA512
5fb190791e139e804d39c2bdf64a5cf460f7f7da52ce3b8851578d2fd1f7ac8c738ced96c2f173797232251d4f1065a0c00ebc4312e1ac276ca744b9ffdb603e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
89dea4828fe33a5fb92f29bfc5e0fcc6

SHA1
22e3a83745e79a343dde17fe3c46645775c59af8

SHA256
3fd5fc35ae1e70c7ee15d1fec2ecf63f55809e9b7f065022122eec0f13a75448

SHA512
0974ffeb1dee6ebd6d27bd18f4f3a6f561ee775fc445e747282081177d30357ef95589292bcf12db670bf9a2d4139c67cd49e0ae8748f8dfb4d9488376445723

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
0605b75c5c345cc202a7885499cc09a7

SHA1
540568cdb245ba26bce8711347e456320012e83d

SHA256
8ed5d8964a977a79c5aacf34853c9e5e00a06de2f2f0964a56c4089805a2dda8

SHA512
dae16a98e4cf861b918d684f0d7660e1c6647897afeded6859253a51f8dd95c41f007e3f20fe43da0292b493c170cb94fb8370d7b17b4f23cf2950cec477f9a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
84bde6fe21377dbd9eee04e591531e2f

SHA1
898c235f7fe1da1a325651ad692cc58167eff7ec

SHA256
80785f4b23da62e15e9c04023a7c7f6821f25264be5e43401679e7056e6bd5a7

SHA512
3f665ac5ad2ce0c65c67931817d79e72ebb5b7eb297864c905d77186c79218e65b0a4bb742b0f2ed8dd759786860962eb40797a608128a902ee7eb6963c091a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
35KB

MD5
9d11e56690926afef8ba0c383e14dfed

SHA1
af93695e27ad5bba05be9863c64cd01bf25599c4

SHA256
6813b5d2e9175c80f256b25c10337e926ca9dc77726fc0165e88802d9accf496

SHA512
0080baeffbc61eb064c700a0774eff3bf31afc3be60b7d880d4c42cbb02f8bcfb50f0045c170e2e8cbe360f9003425a1c974c8b93a4321d2895817cae4ae84a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
27KB

MD5
99ac36612a299555bb89d2befb08aee0

SHA1
1782e35de9f2aa6c67964ededbf6059c941b4df8

SHA256
bfbf5b773068c90cc65e6626c30f5a30e778aed5c4ac51fa3b12e937510e6f69

SHA512
a9b9831cbda4c4f970d155ce0709230f046e0b122a58962415ca0a6b6928cc549b395985030104917dfe3847f1d5c9cd7fcaf5b307396a2025f60721f35ad7d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
63KB

MD5
1901d2bcbbabee4bbb9804c30642ae2b

SHA1
f31774bc12614be681c0b0c7de3ac128f0e932db

SHA256
15eba349e5829f11363614b8f3dd9c3d04994586601d3c4c4d8069e0f5655310

SHA512
bdb94d7d8cf47b239c61559545b1dd26e05da909fec05d215471388545879cd8ec9e1fea51c04ed43927e2b07b5b80a74f09eb9038c8d9045e4161ea69df215f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
38KB

MD5
f53236bc138719b68ccd1c7efb02a276

SHA1
26b7d3eea5d3b12d0b0e173ebf2af50a7d7e56d6

SHA256
787c14f8cc865430c03c96a345044b7c5b8dc8a032511a500d4a42228533acd8

SHA512
5485bc7ccce8ec75f60bca3be846086a4bd4466009c8e22da9cdd16bb1154529af2fb2667cd3a97485cc4f6635fb79ac0fdda4f3e1f39f25f6196f708a92d740

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

Filesize
317B

MD5
67a990d402d685151234dc935a68d854

SHA1
013180f9acfb83b916c5e0bb6c408a9353f3940b

SHA256
0bebc9ace7d83db30f5b8aa9d7b23b7fb372cd1d8034e2c7e3ec87bfa2ca470f

SHA512
190d2e30c297484123c5ca5f4a67499ee6d87f07f1d4788c8fdae44c641ece18cf97f93a66117fc3993a3d530e24f0a6df0bb70d58be9076377e2947ac4992de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG

Filesize
331B

MD5
c2b23d64cbe7c6f236ec4aefa4aef851

SHA1
700d4a521dbe0d661d0daf5aeffa2ad1aa18a450

SHA256
692de5f1cf644a0cbefda08b447ca679aaa2d8b16788f7d96b6c179672facb6d

SHA512
63730331e7fa7b6735995c6fd45888cb3e91afcd096f2eb53ced2e56282f479e4a0583f8ef1e972e0d788818827c6b83bb394ae156690bec87120f6719750d85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log

Filesize
3KB

MD5
16b14c8bd5aee555f407b93206732c0b

SHA1
3fd566a6e2267970cf970f4c76584f865a57ded8

SHA256
8e79c731a0347126e1155ec17c72395104abef1569b98e5f1665f9c73db05718

SHA512
11de45c99b1f711d76aa96abe62d98f7305625f87e1fbb1883ae47125cfd82b0900affb3c21722a55b37eee09164bcfdc66819c83401171844e14bbd7acbe7e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

Filesize
336B

MD5
22f6560f2dca94f4898d3ce69d65ccda

SHA1
157bae1e28045f040941f9a1b3e3ac3df9c50dc1

SHA256
ce9dca7f36c874c9c62ce329cc2a93ffa556c7f094b3a5b4c865a85e8e7b3b86

SHA512
1d6b3b1cd311336eeda27acdb6ba60b6d66d64949935b9b5e6a9fd9fa0b3b8f2bab739748843da643129eba08a43742ebb2941b5668a794f3425c2a881804120

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0

Filesize
128KB

MD5
028d7845b069fb83c99db7cda3aee936

SHA1
c2be7849b640a02c03c489d8f6c3b0209acceb93

SHA256
bcd361261b958afd0f8fbfb18c4eda3401ae1fff3f2b3dee947b8cb3d0ecf416

SHA512
c76b5ef824933e60afb952d592b9667582d67780131401998c0b5f34c8413b2ad736d82fffc6629cb835ff7614d542abb5f09cea72efe064e23dcfa88f41f852

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1

Filesize
343KB

MD5
300974f99fa5c07e2c8189e1bf7d30b3

SHA1
0710f75789a1f1df3f5de9be36d8c03606ea2c77

SHA256
18cf00a2e0e782748fbe8e8032ac9a1ee53533bef5e130db969ebbe00553b50b

SHA512
3ec4fe80946bc5c7fbae483ed08da3ef140565886203726bb939daa7322b44e6951df043fb080b38fb0079e0f67ad6a066e8637b1f43847207a41992519dfa73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
0cbb0191ae6279de68ccb6784207a19d

SHA1
c28c7212949b55bd6be40f8a0f69afcba1af0eab

SHA256
09e13f2d7be9ad48f21f0d120e05e3dec6af715f94bda83d6791fd88e4823e01

SHA512
58c409bfaa4d614de3383473a3b7760bb76cb129b8f55845c0d83d9c3432af3b00c7be547d98e02e8a0da0a19bf75fd6b7d49381c7e7ed31e9106c8f67cee851

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
345B

MD5
1eda5a7bd35aa874ce4977bd6fe8306e

SHA1
8c7a4e0c3d0e968b9a33f3a306908af0486d578d

SHA256
7e25c8096f779ba2f678e440648b932293537494a9a7155c813e0c6a20233240

SHA512
c045c0de5f3143647114c064f046f7dddc62155eeef996e2ba8fb158b371780897d385f317a7c078a96c0cad706d96bb46c44f0e5b42098732723adc1a98a881

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
321B

MD5
3c184cc158767f0f395e91c36e979ad1

SHA1
feac579e15fae5e2d7ac2cef4c19c96fe90fb539

SHA256
2c58f30ebddcf1b502c22dc4daa2cf0caeec71cad46e30028b74e6a5dbc7a2b1

SHA512
74054d011335a9ac8b268631d9eba60f9a35c8ab97e71f35d003a314c2effebdff226d053c4df0d9aae40827c76a057afa227e0cfc366ed8846e86f2d0d77934

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
130KB

MD5
22e4293267ddc0c9dd542ad130a4697e

SHA1
92840d37770a0e0fcc6e0a2c9f8c6de83c954d50

SHA256
7bc3cc5ee32868e3ce39eab805a9fbb9106a0885b239718f107706d89732c355

SHA512
bc2f0b0e171c6262876948905942614e8cb2f57aa1e754e82e4e70a149a2b17ef363bb34f80e1a1375b2e486a112709f9f252eecf897f099a891c317605f4d65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal

Filesize
12KB

MD5
8b1553f843cf4776e7333f1d1f3e7e78

SHA1
731d0ab38f67514388b9db8e72e8c9399e7a5ac7

SHA256
0690dc45e101be678ab63e3254cae1bde035c4e99670800666a050beaa3911d3

SHA512
3552841d9cc43455f201bbb6a9dfca0163bb98312a424cf5291d73df9122ff7563281adad6750fd987049203f0efa214c62caf0d57e482a09fc0cb46bb5ca6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Filesize
24KB

MD5
d0ac7091bf454673c18307b5554c857e

SHA1
c3c8801b938348a14c472bebded784c8515b2593

SHA256
59b56bc22a81b173350ffb9c263173bdf2e0ca2936c5ed9716f4fb588519f02f

SHA512
3365f860b298b927ad6cc5164c63eece530eacbd73e021dec8dbdbf209b8c75bde9357b7401cf3a98f7b27826559bdf66b08d625526240e754d11434e094f530

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Filesize
320B

MD5
076c12ba7522b879968a3e808d92cfbd

SHA1
f03f1edcc99184ae2ccad4d061435ba5e158686d

SHA256
7e66993917bef266828e4675e0700385602b7a99c3d65a64d286a95f4b59ac7b

SHA512
6971ed57aaaa0c85ce1bcbb658897d9b5a5c1cb80f31402d1374cabf3a8fca7006148ae4efb8d4722b19a37f522620c0dc6104caa24ca9cffbfa932506859976

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
b68e07a9c68407965683001b68f0b28f

SHA1
ee66a8a6761449e5e0179266609900571108cb1a

SHA256
7ea91963df568f5372d8f1b47f7afb5fc078ce7ed6b7d4675ed41be2cc4f146b

SHA512
c2e566520debbd59414b029efcef548791930fb0869e6c6d819efd5db45f7fe1348315abd5021e89eddbb24e56d9fa82473e15a1d74bf512df5910ef6bd081c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
338B

MD5
14e7146da6e584bfe727dbf74d3d9b4d

SHA1
8fb8cd5a38c5faa3b608b8211897ffdca364b03f

SHA256
4ec7e94801a704a5f901256f208b0cc372cb0a0743073aeb5637a45624e4ac7c

SHA512
0a65b14765547b2861bf10011088367fd31286101d25d8f8520195e6ad1d8722f248ef85fa177e6531fbdadbd544af8d7468a2e42f57ab7d1f0d89293024a431

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
13B

MD5
a4710a30ca124ef24daf2c2462a1da92

SHA1
96958e2fe60d71e08ea922dfd5e69a50e38cc5db

SHA256
7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7

SHA512
43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
79KB

MD5
7f7b4f0c528ee146b91cb502636e5537

SHA1
1bfcdf22d65034ece30443489ddf5713cb76504e

SHA256
7d2f69bdf2abc57e4288beebbefc3b05a64c40a41eab6e3bd1ab326419ee25fe

SHA512
81320beb6c37866d05205c1740b6626aefe6e7148077779d6188c2da493a536a454bc7baca572bf875d7946aa1b75c0cdaaeefd4295c2b2428b0e634a4dfb5ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
223bd4ae02766ddc32e6145fd1a29301

SHA1
900cfd6526d7e33fb4039a1cc2790ea049bc2c5b

SHA256
1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e

SHA512
648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
20031480ccf6bebf98361fe14c288baa

SHA1
8ac883d71ff92f3ed8125c72e3799bab14d3d070

SHA256
68e4d74b70dd8b8bc2e37789231867ebc49ec16b10586f49c47e3b044bd060a5

SHA512
143d50c79edde2cee329c547a8f195c5a6f3881bed18fec6239953aedf0ba68c18725d0297769289714a02179c88843ad435c15e52909781ea57c4d7c084f9ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
998db8a9f40f71e2f3d9e19aac4db4a9

SHA1
dade0e68faef54a59d68ae8cb3b8314b6947b6d7

SHA256
1b28744565eb600485d9800703f2fb635ecf4187036c12d47f86bbd1e078e06b

SHA512
0e66fd26a11507f78fb1b173fd50555dbd95b0d330e095cdd93206757c6af2780ece914a11a23cd4c840636a59470f44c6db35fa392303fb583806264e652016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\708abdcf-1295-4017-9d6b-36b4644e2a5a.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
d416d75a97fd4066546310a47d5a83e4

SHA1
327bc63b2d79f7279bc851338c7fcf11de3c2f19

SHA256
b881ad4ac36c9edb5c6a37aa5755a8409f2e8a681d23ed51da68939651bb3bb0

SHA512
fb2d8f4dac52accb73b25d2fc2bd3c1b7c039ad5412baea78079e97a48212b1bb56d815753997eef49614ab644b150d2ce5b99e5790212c44f6121d7fbfd8e9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
6a8638f4ad3ee5a0c6216373348281d1

SHA1
d186e00d8c37408de6af0f746794443861596e14

SHA256
5aa033d3b92d4de9f91cc4c62c3f2d0d85a0cda2a94e04ad73f38648b35e3912

SHA512
c8a3604d71e478325d1e100499c19ffe5307251faecc10f50ea284430323eb4e0b7381b69613562683d7ac1f9ae56d12646a362a42715e5d21aaea94cb4a7972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
49ffa304370f23d530c1895b9119c71f

SHA1
f83088f8ae2e70c07876d8d75731711f05966e13

SHA256
8e744aabd4607bf2dc6fd4cf61f87029c4478097803247a443d7fbfe2b7cdb12

SHA512
23530a1d86c06fde5e939534c43732a63147b879c1f19a6d433ed98afd4536e6ac8d25f0c0cb4f61b21f47083363ebd391eb56f3e697c7b284ec40f9da3430f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ofkwtpq.3dk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4244_615321721\e6e5db5a-d389-410f-bb16-e73ba7c91fa5.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4768_1172265554\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4768_1172265554\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
64eaeb92cb15bf128429c2354ef22977

SHA1
45ec549acaa1fda7c664d3906835ced6295ee752

SHA256
4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c

SHA512
f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4768_1172265554\CRX_INSTALL\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4768_1172265554\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
2a738ca67be8dd698c70974c9d4bb21b

SHA1
45a4086c876d276954ffce187af2ebe3dc667b5f

SHA256
b08d566a5705247ddc9abf5e970fc93034970b02cf4cb3d5ccc90e1a1f8c816e

SHA512
f72b9190f9f2b1acc52f7fbb920d48797a96e62dfc0659c418edbbc0299dccf1931f6c508b86c940b976016745b9877f88f2ee081d3e3d5dcdcc2cc7e7884492

Download Submit
C:\Users\Admin\AppData\Roaming\UpdateCache\WindowsUpdate.ps1

Filesize
3KB

MD5
21c010cf4481df82d7e5e4a0b4260793

SHA1
d2ae87b41aa4e951c3a3131ce7ebc8969948ed97

SHA256
b6e7e1ddaceee8c401056c0bd2e552c3545f6906b7de4b62ab3a239e5b01dfa7

SHA512
8f97b34ecda980b0a738d98a99a28ba6f6ceafe65ae97f41b0fc8561a919796e729429507a18e9fe0ef79feb6ee892afb29fc325615c920d72111f3649b3bf5f

Download Submit
memory/924-435-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-870-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-882-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-883-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-890-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-864-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-859-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-880-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-46-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-858-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-857-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-854-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-853-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-865-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-869-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-874-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-848-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-425-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-875-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-851-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-803-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-442-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-440-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-67-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-436-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-860-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-434-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-426-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-427-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-881-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-430-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-64-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-125-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-93-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-879-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-73-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-77-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/924-72-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-1351-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-959-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-971-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-970-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-1345-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-964-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-963-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-949-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-956-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-1347-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-955-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-950-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-944-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-1336-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-965-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-1335-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-1338-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-1341-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-1337-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3136-1346-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5836-55-0x00007FFED8B53000-0x00007FFED8B55000-memory.dmp

Filesize
8KB

Download
memory/5836-0-0x00007FFED8B53000-0x00007FFED8B55000-memory.dmp

Filesize
8KB

Download
memory/5836-56-0x00007FFED8B50000-0x00007FFED9611000-memory.dmp

Filesize
10.8MB

Download
memory/5836-68-0x00007FFED8B50000-0x00007FFED9611000-memory.dmp

Filesize
10.8MB

Download
memory/5836-12-0x00007FFED8B50000-0x00007FFED9611000-memory.dmp

Filesize
10.8MB

Download
memory/5836-11-0x00007FFED8B50000-0x00007FFED9611000-memory.dmp

Filesize
10.8MB

Download
memory/5836-10-0x000002021F870000-0x000002021F892000-memory.dmp

Filesize
136KB

Download
memory/5836-896-0x00007FFED8B50000-0x00007FFED9611000-memory.dmp

Filesize
10.8MB

Download