1d5194a5d62be390d0b495b0033057141e2f19ec2bf5b6c99b9d4f90527192f1

Analysis

max time kernel
4s
max time network
20s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/06/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
cleaner.bat
Size 388B
Sample260619-p5geeahw2x
SHA256 1d5194a5d62be390d0b495b0033057141e2f19ec2bf5b6c99b9d4f90527192f1
MD5 15fdbbeca4f04df80aa24875f36af5ea
SHA1 8dc15ece23ffc0a61fb088d4a5e4dce216614230
SHA512 b9793b87067a9d1029690f4099d7b9fad5f5817ddc63058490b7396b0a8fdb43d2fa8132269376d1171f6242fc2a11cff5673d46d7954435e943f808d7233580
TLSH
T1F5E0F12324075C0E590435D0E8F5669C3177A216A8A0D58E30038464A510527B022088
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4468	msedge.exe

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
1120	timeout.exe
2732	timeout.exe
3432	timeout.exe
3344	timeout.exe
5660	timeout.exe
3172	timeout.exe
6136	timeout.exe
764	timeout.exe
5436	timeout.exe
2644	timeout.exe
2180	timeout.exe
3216	timeout.exe
5364	timeout.exe
996	timeout.exe
1820	timeout.exe
3504	timeout.exe
3720	timeout.exe
1272	timeout.exe
5560	timeout.exe
3680	timeout.exe
3456	timeout.exe
4696	timeout.exe
4872	timeout.exe
1444	timeout.exe
1596	timeout.exe
1300	timeout.exe
5124	timeout.exe
1372	timeout.exe
296	timeout.exe
2644	timeout.exe
4452	timeout.exe
2812	timeout.exe
2956	timeout.exe
4124	timeout.exe
1840	timeout.exe
3756	timeout.exe
960	timeout.exe
4960	timeout.exe
1444	timeout.exe
3344	timeout.exe
5732	timeout.exe
1204	timeout.exe
1480	timeout.exe
5664	timeout.exe
5436	timeout.exe
1516	timeout.exe
3144	timeout.exe
5124	timeout.exe
3724	timeout.exe
1516	timeout.exe
4304	timeout.exe
4144	timeout.exe
2984	timeout.exe
2732	timeout.exe
1688	timeout.exe
1796	timeout.exe
1820	timeout.exe
3020	timeout.exe
2336	timeout.exe
1456	timeout.exe
4840	timeout.exe
1964	timeout.exe
4516	timeout.exe
4924	timeout.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 6088	1924	cmd.exe	89
PID 1924 wrote to memory of 1560	1924	cmd.exe	90
PID 1924 wrote to memory of 4308	1924	cmd.exe	91
PID 1924 wrote to memory of 5164	1924	cmd.exe	92
PID 1924 wrote to memory of 1608	1924	cmd.exe	93
PID 1924 wrote to memory of 1796	1924	cmd.exe	94
PID 1924 wrote to memory of 1740	1924	cmd.exe	95
PID 1924 wrote to memory of 3624	1924	cmd.exe	96
PID 1924 wrote to memory of 3504	1924	cmd.exe	97
PID 1924 wrote to memory of 4640	1924	cmd.exe	98
PID 1924 wrote to memory of 3700	1924	cmd.exe	99
PID 1924 wrote to memory of 1240	1924	cmd.exe	100
PID 1924 wrote to memory of 1040	1924	cmd.exe	101
PID 1924 wrote to memory of 4320	1924	cmd.exe	102
PID 1924 wrote to memory of 1444	1924	cmd.exe	103
PID 1924 wrote to memory of 4364	1924	cmd.exe	104
PID 1924 wrote to memory of 4584	1924	cmd.exe	105
PID 1924 wrote to memory of 3456	1924	cmd.exe	106
PID 1924 wrote to memory of 3948	1924	cmd.exe	107
PID 1924 wrote to memory of 5676	1924	cmd.exe	108
PID 1924 wrote to memory of 3400	1924	cmd.exe	109
PID 1924 wrote to memory of 5836	1924	cmd.exe	110
PID 1924 wrote to memory of 4204	1924	cmd.exe	111
PID 1924 wrote to memory of 1964	1924	cmd.exe	112
PID 1924 wrote to memory of 5128	1924	cmd.exe	113
PID 1924 wrote to memory of 1616	1924	cmd.exe	114
PID 1924 wrote to memory of 5124	1924	cmd.exe	115
PID 1924 wrote to memory of 5892	1924	cmd.exe	116
PID 1924 wrote to memory of 4636	1924	cmd.exe	117
PID 1924 wrote to memory of 2128	1924	cmd.exe	118
PID 1924 wrote to memory of 6076	1924	cmd.exe	119
PID 1924 wrote to memory of 5840	1924	cmd.exe	120
PID 1924 wrote to memory of 4916	1924	cmd.exe	121
PID 1924 wrote to memory of 2648	1924	cmd.exe	122
PID 1924 wrote to memory of 4772	1924	cmd.exe	123
PID 1924 wrote to memory of 3496	1924	cmd.exe	124
PID 1924 wrote to memory of 4132	1924	cmd.exe	125
PID 1924 wrote to memory of 4736	1924	cmd.exe	126
PID 1924 wrote to memory of 3724	1924	cmd.exe	127
PID 1924 wrote to memory of 5776	1924	cmd.exe	128
PID 1924 wrote to memory of 5984	1924	cmd.exe	129
PID 1924 wrote to memory of 5660	1924	cmd.exe	130
PID 1924 wrote to memory of 5168	1924	cmd.exe	131
PID 1924 wrote to memory of 4720	1924	cmd.exe	132
PID 1924 wrote to memory of 3172	1924	cmd.exe	133
PID 1924 wrote to memory of 3296	1924	cmd.exe	134
PID 1924 wrote to memory of 3804	1924	cmd.exe	135
PID 1924 wrote to memory of 2936	1924	cmd.exe	136
PID 1924 wrote to memory of 6004	1924	cmd.exe	137
PID 1924 wrote to memory of 1672	1924	cmd.exe	138
PID 1924 wrote to memory of 2812	1924	cmd.exe	139
PID 1924 wrote to memory of 5852	1924	cmd.exe	140
PID 1924 wrote to memory of 2720	1924	cmd.exe	141
PID 1924 wrote to memory of 5652	1924	cmd.exe	142
PID 1924 wrote to memory of 3972	1924	cmd.exe	143
PID 1924 wrote to memory of 3028	1924	cmd.exe	144
PID 1924 wrote to memory of 3220	1924	cmd.exe	145
PID 1924 wrote to memory of 3860	1924	cmd.exe	146
PID 1924 wrote to memory of 5800	1924	cmd.exe	147
PID 1924 wrote to memory of 4872	1924	cmd.exe	148
PID 1924 wrote to memory of 5884	1924	cmd.exe	149
PID 1924 wrote to memory of 1220	1924	cmd.exe	150
PID 1924 wrote to memory of 5436	1924	cmd.exe	151
PID 1924 wrote to memory of 2468	1924	cmd.exe	152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cleaner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:6088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1560
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1608
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:3624
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:3504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:3700
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:1240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4320
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4584
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:3456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5676
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4204
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1616
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4636
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:6076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5840
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:4916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4772
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4736
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:3724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5984
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:5660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4720
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:3172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:3804
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1672
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2720
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:5652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:3028
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:3220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5800
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1220
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:5436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5684
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:6136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:3592
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5772
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5848
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:4864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4576
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5612
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4904
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1700
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:2732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1800
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5272
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5484
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2596
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:2644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2668
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:3720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:3448
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:5732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1664
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:2180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4560
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:3216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2472
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2844
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1828
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:4304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4692
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:5364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5796
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4984
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1544
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:464
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:1552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2188
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:5560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5688
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:2336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5060
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:3004
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1540
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:3828
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5276
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:3756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5692
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:5444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4396
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4564
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1500
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:4516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:6140
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1908
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:3684
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:4144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4284
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5508
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:3432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5100
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:696
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2612
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:1016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1708
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:1860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2036
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4584
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:3456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5676
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4204
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:1964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1616
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4636
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:4448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2128
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:4916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4772
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:4084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4736
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1520
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:5176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1060
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:5664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5160
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4908
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2720
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1556
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:3292
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1220
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:5436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2468
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:6136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:5712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:3592
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5772
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5848
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:4864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4576
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5612
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:1120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:4904
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1700
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:2732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1800
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5272
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:5484
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2596
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:2644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2668
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:4452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:832
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:1956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2096
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:3144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:2768
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:1944
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  - Delays execution with timeout.exe
  PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p ".=[%bar:~0,1]""
  2⤵
  PID:3676
- C:\Windows\system32\timeout.exe
  timeout /t 0.05
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
  2⤵
  PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x350,0x7ffd221dc188,0x7ffd221dc194,0x7ffd221dc1a0
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,8654974655465905970,14944340487844828683,262144 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:2
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,17957607427209722885,11510465477003298325,524288 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,12298938155290485171,364307922281137608,524288 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:13
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,2486317831190889659,4358185707173849454,2097152 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,3788962556955896948,18397316171315065023,2097152 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,6618959554518562667,7467402679688198638,2097152 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,5597446327257508480,2955775495961314262,2097152 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:9
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5260,i,10924876509568295327,852158029276535377,2097152 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,3305799192535779244,10224085734069705838,524288 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,1565255705658879141,9186223143851533607,524288 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,14849184604168782487,13005244090006947431,524288 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5844,i,1760194148552921096,9832532382568292142,2097152 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,3979392157935210928,17464025495079498866,524288 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:12
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,1006465539059400155,9265950081761021280,524288 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,1006465539059400155,9265950081761021280,524288 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,14889445959285436781,9016355008991496635,524288 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,15025138892229209375,10318986484584358248,524288 --field-trial-handle=2912,i,13638202850540125608,4035705335049809228,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:14
    3⤵
    PID:4212
- C:\Windows\system32\shutdown.exe
  shutdown /s /t 10
  2⤵
  PID:5232

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
PID:5560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2592

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b0055 /state1:0x41c64e6d
1⤵
PID:4972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c86597deade82b030f2c72b3f14f05bd05abda17e7a3e2ca064b5db96dc21c56
MD5 4a81aab780ef6bcd361ad7dacb2a1605
SHA1 47f9ccd1dc37c5c23acbce33ad4df2ff7f4575ed
SHA512 6304164215fdaebfc9e56b98e0adb700691df5260a4c1388518c61cbd00e263f1d1a1ed27debd43cb037eaf153cf27164f0f44944009f8fd00c5762236ad869e
SSDEEP 192:sxRCRuyM/jK1Ml8wcX/f5sVa8Z4e1d4zoA8pfXg/g6+WNltK/B3Ln9burG+IgtJ:sxRCwCX/f5sVaC4e1LI/5u/eb3
TLSH
T1A562C956AA34997B8CD7D218FA51BB57D7F81533B2904E44AAFCCA0C00E6AED2113C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 bfbd65f8f17cc864835f44f9866b33803589bf22af512c7945d9edfb476ebe17
MD5 3a73f2b36fa5ca522efa33cd28cd90d5
SHA1 f93ab8fe2066babe86953b7c64ebbb599c858ca2
SHA512 232bb5f470d9561d5a573dfd167b249345fa41c826ad28a8dc6121bcb610bef148191b9a7f7843e3be40ae4308f25f41c490dea5bad1ea1f456091c94a5db007
SSDEEP 768:eOEtpf7pLuL7ZIWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OV63REkTqQOro7o6:eOEtpZE7ZIWgKgf16u1jal32/QF885F
TLSH
T143E2EC3B680CCB7E4F804A9CED297E9F6DE801CB96D8C99447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 3c2305fdfdb90ec26eaced750ee7ae491a8cfac5327c4c70b532c85216878c40
MD5 05b676c69cb343a0bdfce189e28c3003
SHA1 c51377f1456fe263a2e966acdb81e5459b24be3c
SHA512 6c6efdc17d05b237dd892cdc1854c835a1ba2cb13237b3b12d96d1264af9d09b797adba2f83aff359efe4f3f2ada5e26bce1ff2a59e6fc135ca15ddfec026451
TLSH
T16DD023D70731684F1631EFD05835110D511F4D4DD8C0CCD1DD04F15231F8613D502A35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 b644ad1816fa6f5d532289fcbf2a7f8afbdf4f411833c67ab9261a4335cfa17a
MD5 ce63b6ab69c392c939ce7704367bef6b
SHA1 3f39b08e7ce34655b2521588a339da233e6f5483
SHA512 a8113fa909c234495eae4dc88a344d1e197f41843b2b02e319a4eeedd0ded8493ea315ad243b34c19d48022539cd9bbadc84f2fd790fc38ed4a1ad785fd83024
TLSH
T1C0C09BE71A1045974A31AED51838671D961F458DC8D0CCF49554614270789538802E65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe590064.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe590064.TMP
Size 137B
SHA256 a7fcaac92da039dd9800219ec721cfe63b8d4185b12f65bc3657c75f7d78c982
MD5 c0f9b9b45e821a3e1f63d770b7bed5e6
SHA1 d5305c222d60f23049e90987a02dedf9b7670024
SHA512 34fbf26324e4ae1c61bc16aeabc5bef4506f1b6afbb10cd866f7b80b303d412901c935058f1942fe7c85140f2acb79f06af6cac303e0707d1cf843458d2c6508
TLSH
T1F9C02BE30A2001830B327DC11839230D821F8C8ECCC0CCF0910570427074953C801F31
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 319dbcdb0529241f32df31b1f3776256a27531d3cb55721b0abe879d460ec60f
MD5 aa7f54227bd0d5f5657ad2ecaf40b609
SHA1 310249704556433a352101c4c09b514ee3b49f70
SHA512 dd8a396d3220d5b2abec36fe704c3d81c0b4bb6973313c505f977c318fa9df3bd50124494cef513bbf34aa31a36c8bc264d1bb98bf35bb2472b9236989dbbd54
SSDEEP 768:qj+9Y34APfcOTfBVDfBAqV5R4HTytYYqgHvPwss/+0mv1:J9Y3vfvfTfTWTwJVs/Kv1
TLSH
T1F0F2BF71EDA89CA75DE6C2C57206379B2FE80673D1C01A54DADC5A0D088BBDE1B0B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a2a707e6d38eab739d2fa5b40fe44a756cc8df766d501bf1258140a683dabc92
MD5 3e5aae6227fe76357886e2c58d6f15f6
SHA1 8ecf46861478c2609552afbcdcddf3ae093de8d6
SHA512 fe08d28424b0b98731dfd71bc3f596b61801712d5864413d7e41f25f10bfd7fa25e7166a01d365905157951cd19c3f35a49fdbee68fe0962e522eaea29160549
SSDEEP 768:EjaeqD4MlshiLdMma3vgPfcOTfBVYV5R4HTytYYqgHvPgsuyjWtxjTo:EqcjhIdMh3MfvfmWTwJluyj2y
TLSH
T11703CF76ECB85CB78CB296C5760277976EB842A3C3C52A64D9DC5A0D019BACF130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1800857718\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads