6915289e6b31a4f069d97acb5392f849490a1e4bbc11d97ba35aeb3ce446b09a

Analysis

max time kernel
144s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
101secured_stub.ps1
Size 5.5MB
Sample260721-ype13seg99
SHA256 6915289e6b31a4f069d97acb5392f849490a1e4bbc11d97ba35aeb3ce446b09a
MD5 eee1c074162ec5f9a866cb44f85a5a1c
SHA1 e90bce5c14ce9723b92b19318f4e5f0d34bd67be
SHA512 9b4cdd596df2648c5303f8e5080bd80c374d06d1f35b003aff4a8abcd95b1aa6eebba27d5768ad62abdb3b515eaf8ede1dceb24683c493b45384c28ec323acdf
SSDEEP 24576:D4bIkc4f84QT25fXr7nf+muXPVnKTX98SC9PtLCF1DpKu2tmcEuYio91B/mThJMs:b
TLSH
T1A146D9F4517585B2C00E85F9CA62FDD4823F28326B9CDFB5E823A2F6512F809FD4A585
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

collection discovery execution

Malware Config

Signatures

Accesses Microsoft Outlook profiles 1 TTPs 64 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 2576	2416	PowerShell.exe	96
PID 2416 set thread context of 4484	2416	PowerShell.exe	130
PID 2416 set thread context of 4424	2416	PowerShell.exe	162
PID 2416 set thread context of 5596	2416	PowerShell.exe	194
PID 2416 set thread context of 2948	2416	PowerShell.exe	227
PID 2416 set thread context of 3580	2416	PowerShell.exe	261
PID 2416 set thread context of 3424	2416	PowerShell.exe	290

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2416	PowerShell.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

System Time Discovery 1 TTPs 14 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1632	chrome.exe
1564	msedge.exe
2644	msedge.exe
3080	msedge.exe
4940	chrome.exe
2244	chrome.exe
3508	msedge.exe
6960	chrome.exe
1240	msedge.exe
5492	chrome.exe
1904	msedge.exe
2456	chrome.exe
6884	msedge.exe
3480	chrome.exe

Enumerates system info in registry 2 TTPs 38 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2416	PowerShell.exe
2416	PowerShell.exe
2416	PowerShell.exe
2416	PowerShell.exe
2416	PowerShell.exe
2416	PowerShell.exe
2416	PowerShell.exe
2416	PowerShell.exe
2416	PowerShell.exe
2416	PowerShell.exe
2416	PowerShell.exe
2416	PowerShell.exe
2416	PowerShell.exe
2416	PowerShell.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2416	PowerShell.exe
2416	PowerShell.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
6812	chrome.exe
6812	chrome.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe
2576	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	PowerShell.exe
Token: SeDebugPrivilege	2576	aspnet_compiler.exe
Token: SeShutdownPrivilege	6812	chrome.exe
Token: SeCreatePagefilePrivilege	6812	chrome.exe
Token: SeDebugPrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	6812	chrome.exe
Token: SeCreatePagefilePrivilege	6812	chrome.exe
Token: SeDebugPrivilege	4128	msedge.exe
Token: SeDebugPrivilege	4484	aspnet_compiler.exe
Token: SeShutdownPrivilege	3252	chrome.exe
Token: SeCreatePagefilePrivilege	3252	chrome.exe
Token: SeDebugPrivilege	5740	chrome.exe
Token: SeDebugPrivilege	7144	msedge.exe
Token: SeDebugPrivilege	4424	aspnet_compiler.exe
Token: SeShutdownPrivilege	6728	chrome.exe
Token: SeCreatePagefilePrivilege	6728	chrome.exe
Token: SeShutdownPrivilege	6728	chrome.exe
Token: SeCreatePagefilePrivilege	6728	chrome.exe
Token: SeDebugPrivilege	4920	chrome.exe
Token: SeDebugPrivilege	3080	msedge.exe
Token: SeDebugPrivilege	5596	aspnet_compiler.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeDebugPrivilege	1876	chrome.exe
Token: SeShutdownPrivilege	2768	chrome.exe
Token: SeCreatePagefilePrivilege	2768	chrome.exe
Token: SeDebugPrivilege	2156	msedge.exe
Token: SeDebugPrivilege	2948	aspnet_compiler.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeDebugPrivilege	6672	chrome.exe
Token: SeShutdownPrivilege	5716	chrome.exe
Token: SeCreatePagefilePrivilege	5716	chrome.exe
Token: SeDebugPrivilege	3524	msedge.exe
Token: SeDebugPrivilege	3580	aspnet_compiler.exe
Token: SeShutdownPrivilege	7140	chrome.exe
Token: SeCreatePagefilePrivilege	7140	chrome.exe
Token: SeShutdownPrivilege	7140	chrome.exe
Token: SeCreatePagefilePrivilege	7140	chrome.exe
Token: SeShutdownPrivilege	7140	chrome.exe
Token: SeCreatePagefilePrivilege	7140	chrome.exe
Token: SeDebugPrivilege	6168	chrome.exe
Token: SeDebugPrivilege	7012	chrome.exe
Token: SeDebugPrivilege	564	msedge.exe
Token: SeDebugPrivilege	3424	aspnet_compiler.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
6812	chrome.exe
6812	chrome.exe
5208	msedge.exe
3252	chrome.exe
3252	chrome.exe
4164	msedge.exe
6728	chrome.exe
6728	chrome.exe
5324	msedge.exe
2768	chrome.exe
2768	chrome.exe
4740	msedge.exe
5716	chrome.exe
5716	chrome.exe
6848	msedge.exe
7140	chrome.exe
7140	chrome.exe
564	msedge.exe
1200	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 6348	2416	PowerShell.exe	91
PID 2416 wrote to memory of 4912	2416	PowerShell.exe	92
PID 2416 wrote to memory of 4924	2416	PowerShell.exe	93
PID 2416 wrote to memory of 5488	2416	PowerShell.exe	94
PID 2416 wrote to memory of 5940	2416	PowerShell.exe	95
PID 2416 wrote to memory of 2576	2416	PowerShell.exe	96
PID 2416 wrote to memory of 2576	2416	PowerShell.exe	96
PID 2416 wrote to memory of 2576	2416	PowerShell.exe	96
PID 2416 wrote to memory of 2576	2416	PowerShell.exe	96
PID 2416 wrote to memory of 2576	2416	PowerShell.exe	96
PID 2576 wrote to memory of 6812	2576	aspnet_compiler.exe	98
PID 6812 wrote to memory of 6160	6812	chrome.exe	99
PID 6812 wrote to memory of 5564	6812	chrome.exe	100
PID 6812 wrote to memory of 5492	6812	chrome.exe	101
PID 6812 wrote to memory of 1696	6812	chrome.exe	102
PID 6812 wrote to memory of 3120	6812	chrome.exe	103
PID 6812 wrote to memory of 2008	6812	chrome.exe	104
PID 6812 wrote to memory of 2868	6812	chrome.exe	105
PID 6812 wrote to memory of 2988	6812	chrome.exe	106
PID 6812 wrote to memory of 1060	6812	chrome.exe	107
PID 6812 wrote to memory of 2820	6812	chrome.exe	108
PID 6812 wrote to memory of 1272	6812	chrome.exe	109
PID 2576 wrote to memory of 2008	2576	aspnet_compiler.exe	104
PID 2576 wrote to memory of 2008	2576	aspnet_compiler.exe	104
PID 2576 wrote to memory of 5208	2576	aspnet_compiler.exe	111
PID 5208 wrote to memory of 2244	5208	msedge.exe	112
PID 5208 wrote to memory of 3452	5208	msedge.exe	113
PID 5208 wrote to memory of 1904	5208	msedge.exe	114
PID 5208 wrote to memory of 2052	5208	msedge.exe	115
PID 5208 wrote to memory of 988	5208	msedge.exe	117
PID 5208 wrote to memory of 1448	5208	msedge.exe	118
PID 5208 wrote to memory of 5036	5208	msedge.exe	119
PID 5208 wrote to memory of 3964	5208	msedge.exe	120
PID 5208 wrote to memory of 6556	5208	msedge.exe	121
PID 5208 wrote to memory of 204	5208	msedge.exe	122
PID 5208 wrote to memory of 4496	5208	msedge.exe	123
PID 5208 wrote to memory of 4128	5208	msedge.exe	124
PID 5208 wrote to memory of 2992	5208	msedge.exe	125
PID 5208 wrote to memory of 1944	5208	msedge.exe	126
PID 5208 wrote to memory of 6992	5208	msedge.exe	127
PID 5208 wrote to memory of 4928	5208	msedge.exe	128
PID 2576 wrote to memory of 4128	2576	aspnet_compiler.exe	124
PID 2576 wrote to memory of 4128	2576	aspnet_compiler.exe	124
PID 2416 wrote to memory of 4484	2416	PowerShell.exe	130
PID 2416 wrote to memory of 4484	2416	PowerShell.exe	130
PID 2416 wrote to memory of 4484	2416	PowerShell.exe	130
PID 2416 wrote to memory of 4484	2416	PowerShell.exe	130
PID 2416 wrote to memory of 4484	2416	PowerShell.exe	130
PID 4484 wrote to memory of 3252	4484	aspnet_compiler.exe	131
PID 3252 wrote to memory of 6124	3252	chrome.exe	132
PID 3252 wrote to memory of 7004	3252	chrome.exe	133
PID 3252 wrote to memory of 2456	3252	chrome.exe	134
PID 3252 wrote to memory of 2936	3252	chrome.exe	135
PID 3252 wrote to memory of 5344	3252	chrome.exe	136
PID 3252 wrote to memory of 5412	3252	chrome.exe	137
PID 3252 wrote to memory of 5740	3252	chrome.exe	138
PID 3252 wrote to memory of 3364	3252	chrome.exe	139
PID 3252 wrote to memory of 5596	3252	chrome.exe	140
PID 3252 wrote to memory of 5784	3252	chrome.exe	141
PID 4484 wrote to memory of 5740	4484	aspnet_compiler.exe	138
PID 4484 wrote to memory of 5740	4484	aspnet_compiler.exe	138
PID 4484 wrote to memory of 4164	4484	aspnet_compiler.exe	142
PID 4164 wrote to memory of 6476	4164	msedge.exe	143
PID 4164 wrote to memory of 6252	4164	msedge.exe	144

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\101secured_stub.ps1
1⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:6348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5488
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbae83c728,0x7ffbae83c734,0x7ffbae83c740
      4⤵
      PID:6160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1728,i,4332289240530531558,17164289375281029852,262144 --field-trial-handle=1916,i,7908934178007004401,10446850062848734435,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
      4⤵
      PID:5564
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui" --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,1383252321911862777,6014860480277750453,524288 --field-trial-handle=1916,i,7908934178007004401,10446850062848734435,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:11
      4⤵
      System Time Discovery
      PID:5492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui" --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,3939411052960299578,12674122379713480185,524288 --field-trial-handle=1916,i,7908934178007004401,10446850062848734435,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:13
      4⤵
      PID:1696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2972,i,1162380393936183837,9264413797493440297,2097152 --field-trial-handle=1916,i,7908934178007004401,10446850062848734435,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:1
      4⤵
      PID:3120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2976,i,2788449822736732811,4559919045366059036,2097152 --field-trial-handle=1916,i,7908934178007004401,10446850062848734435,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:1
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3152,i,5139571185657042337,8345044203771730653,2097152 --field-trial-handle=1916,i,7908934178007004401,10446850062848734435,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:2868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3204,i,5587981767432874501,556478865309443519,2097152 --field-trial-handle=1916,i,7908934178007004401,10446850062848734435,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:9
      4⤵
      PID:2988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3788,i,16823710242980382990,11042154653758518428,2097152 --field-trial-handle=1916,i,7908934178007004401,10446850062848734435,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:9
      4⤵
      PID:1060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4320,i,5488582574658384480,1269791187973931615,2097152 --field-trial-handle=1916,i,7908934178007004401,10446850062848734435,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:2820
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui" --force-high-res-timeticks=disabled --metrics-shmem-handle=4304,i,6640454128881421672,1565460108376629709,524288 --field-trial-handle=1916,i,7908934178007004401,10446850062848734435,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
      4⤵
      PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ffb98b7c188,0x7ffb98b7c194,0x7ffb98b7c1a0
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1672,i,3550870078670818146,13984017670699820038,262144 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:2
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,10279002014687158092,9869204353449203460,524288 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:11
      4⤵
      System Time Discovery
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,6257689503313119086,3200397173275998310,524288 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:13
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3268,i,14023210916813004690,14974490706774847360,2097152 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3272,i,3693826677384892895,6390231231597664739,2097152 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3712,i,17484825762491799937,2491819863918796805,2097152 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3740,i,7176793794886937075,5576821156942385937,2097152 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:9
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3764,i,14580312011584514456,11562750917279761559,2097152 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
      4⤵
      PID:6556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3792,i,12312775529378784225,10865005887959440668,2097152 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:9
      4⤵
      PID:204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3800,i,18435463743541732412,10253232012255434940,2097152 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3844,i,14690825359597102165,3223014433910966929,2097152 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:9
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3880,i,10732428719451560095,5552928064081462695,2097152 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3928,i,5524292494489559342,10545587565558624900,2097152 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:9
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3968,i,15260344400613196301,17129537642446504689,2097152 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:1
      4⤵
      PID:6992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3992,i,18427888322871180427,13166719922701048163,2097152 --field-trial-handle=2792,i,9594327283650261690,1786713001764903781,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:9
      4⤵
      PID:4928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tttl4ulu.vq3"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tttl4ulu.vq3 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tttl4ulu.vq3\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\tttl4ulu.vq3 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbae83c728,0x7ffbae83c734,0x7ffbae83c740
      4⤵
      PID:6124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tttl4ulu.vq3" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1652,i,17922350448015567846,11423371341259004650,262144 --field-trial-handle=2016,i,636375977106974275,1664557633768966195,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
      4⤵
      PID:7004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tttl4ulu.vq3" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1852,i,11311410998886462767,17114849909022773335,524288 --field-trial-handle=2016,i,636375977106974275,1664557633768966195,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:11
      4⤵
      System Time Discovery
      PID:2456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tttl4ulu.vq3" --force-high-res-timeticks=disabled --metrics-shmem-handle=2128,i,5821241684767454214,16386633927868898430,524288 --field-trial-handle=2016,i,636375977106974275,1664557633768966195,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:13
      4⤵
      PID:2936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tttl4ulu.vq3" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3000,i,12042579720776375851,16612718947847098397,2097152 --field-trial-handle=2016,i,636375977106974275,1664557633768966195,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
      4⤵
      PID:5344
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tttl4ulu.vq3" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3016,i,10885954454745148704,2861368764918583717,2097152 --field-trial-handle=2016,i,636375977106974275,1664557633768966195,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:1
      4⤵
      PID:5412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tttl4ulu.vq3" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3264,i,9570892520488476556,10196291550633100524,2097152 --field-trial-handle=2016,i,636375977106974275,1664557633768966195,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tttl4ulu.vq3" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3268,i,275147440096027109,3427520587157027821,2097152 --field-trial-handle=2016,i,636375977106974275,1664557633768966195,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:9
      4⤵
      PID:3364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tttl4ulu.vq3" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3812,i,14726797832318689693,14270277120039740732,2097152 --field-trial-handle=2016,i,636375977106974275,1664557633768966195,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:9
      4⤵
      PID:5596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tttl4ulu.vq3" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4324,i,14609461924785689652,13634070860400185951,2097152 --field-trial-handle=2016,i,636375977106974275,1664557633768966195,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
      4⤵
      PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x324,0x7ffb9ba6c188,0x7ffb9ba6c194,0x7ffb9ba6c1a0
      4⤵
      PID:6476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1560,i,14575304859315288397,11857491844239530551,262144 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:6252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,17411244576497124733,15577813553342512880,524288 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:11
      4⤵
      System Time Discovery
      PID:6884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,13354619989916311859,11240492286267039334,524288 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
      4⤵
      PID:6328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3280,i,9670377730633332791,16536851472556337369,2097152 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:6940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3300,i,4799885650602019970,5382655275564513019,2097152 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3752,i,11226989414177316693,17099620245170892659,2097152 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3784,i,16636904436533815238,1275639598078531490,2097152 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:9
      4⤵
      PID:1756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3832,i,10103615488232749043,12384406833741258567,2097152 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:1
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3828,i,16434314144383086443,10407344724968882682,2097152 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:9
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3908,i,16813534701092860929,13375462479715193201,2097152 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
      4⤵
      PID:6688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3916,i,16888428294549891724,14904813406490476803,2097152 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:9
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3812,i,3420665444886067091,655427177086911185,2097152 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:1
      4⤵
      PID:7164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3960,i,13954429953895184742,10341668193761565848,2097152 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:9
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4032,i,2156660753105433327,15926639985848341118,2097152 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:1
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4040,i,11501769444602730047,18310956544956177798,2097152 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:9
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:7144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,14549630954120561784,10664108697605445666,524288 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
      4⤵
      PID:6708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,11633403517804047109,829447456077858402,524288 --field-trial-handle=2272,i,15243054918901800909,14293678983860151399,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:6728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbae83c728,0x7ffbae83c734,0x7ffbae83c740
      4⤵
      PID:5904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1708,i,10597652406393961935,3183138300701504491,262144 --field-trial-handle=2000,i,11933270690638785292,10008871758430012104,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
      4⤵
      PID:4200
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1880,i,4992679377691772405,12109792314817603619,524288 --field-trial-handle=2000,i,11933270690638785292,10008871758430012104,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
      4⤵
      System Time Discovery
      PID:3480
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2" --force-high-res-timeticks=disabled --metrics-shmem-handle=2132,i,2314074891192365788,4179887695249477699,524288 --field-trial-handle=2000,i,11933270690638785292,10008871758430012104,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:13
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3000,i,8455570153281212540,9991331795428536783,2097152 --field-trial-handle=2000,i,11933270690638785292,10008871758430012104,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:1
      4⤵
      PID:6036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3024,i,8495486832783260692,11552649691149016780,2097152 --field-trial-handle=2000,i,11933270690638785292,10008871758430012104,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:1
      4⤵
      PID:1408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3308,i,697340602786567292,9647061754876983167,2097152 --field-trial-handle=2000,i,11933270690638785292,10008871758430012104,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:6696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3332,i,12598523231766622952,2315945918105401259,2097152 --field-trial-handle=2000,i,11933270690638785292,10008871758430012104,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:9
      4⤵
      PID:6688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3804,i,10995522287871379394,111542878743783576,2097152 --field-trial-handle=2000,i,11933270690638785292,10008871758430012104,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:9
      4⤵
      PID:6944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4328,i,9063572990199919956,15628321893898026019,2097152 --field-trial-handle=2000,i,11933270690638785292,10008871758430012104,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
      4⤵
      PID:2372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2" --force-high-res-timeticks=disabled --metrics-shmem-handle=4364,i,10478440207763748234,10906254607850925847,524288 --field-trial-handle=2000,i,11933270690638785292,10008871758430012104,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
      4⤵
      PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x2d4,0x7ffb9b3dc188,0x7ffb9b3dc194,0x7ffb9b3dc1a0
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1624,i,247248915801518766,731275962121130255,262144 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:6936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,6249455284456985048,10037552504652465278,524288 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
      4⤵
      System Time Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,13257069597465394471,5883892016791202854,524288 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:13
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3332,i,877911117795829709,3810885719275761590,2097152 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3360,i,14707494083680065203,16582715313649426463,2097152 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3824,i,3071122031674690173,795380282726572195,2097152 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
      4⤵
      PID:6168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3836,i,16993923120973476427,709527709200975278,2097152 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:9
      4⤵
      PID:6732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3852,i,16346679316215014076,15778135303419386677,2097152 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1
      4⤵
      PID:7144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3880,i,1286221002679334842,4331592777623668537,2097152 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:9
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3932,i,2577104977849656140,4227660805973630013,2097152 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:1
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3944,i,15555947935376307949,4666898144059755514,2097152 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:9
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3976,i,11936634577035041246,876076554638593004,2097152 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:1
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4000,i,387305384367685571,3793275219285625228,2097152 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:9
      4⤵
      PID:6896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3980,i,9863981460189397715,2848520289725663418,2097152 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:1
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4136,i,11891540879766283984,13788309351555350126,2097152 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:9
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16478974918660964309,14149253441508488173,524288 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,16229717792730075583,7260394893240338945,524288 --field-trial-handle=2252,i,3916833157729077274,16094080216313495511,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:1680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ffbae83c728,0x7ffbae83c734,0x7ffbae83c740
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,13185668015552838996,9386981257368384475,262144 --field-trial-handle=2380,i,16789298902369992777,9165982107284864359,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
      4⤵
      PID:4512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1812,i,14904793584992475176,14978064936099106244,524288 --field-trial-handle=2380,i,16789298902369992777,9165982107284864359,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
      4⤵
      System Time Discovery
      PID:1632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy" --force-high-res-timeticks=disabled --metrics-shmem-handle=2032,i,4051793454487648644,4877169378238883769,524288 --field-trial-handle=2380,i,16789298902369992777,9165982107284864359,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:13
      4⤵
      PID:5884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2984,i,10604862494116314078,13854283811846031550,2097152 --field-trial-handle=2380,i,16789298902369992777,9165982107284864359,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:1
      4⤵
      PID:5420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2988,i,15083268493826944598,1528629617982993316,2097152 --field-trial-handle=2380,i,16789298902369992777,9165982107284864359,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:1
      4⤵
      PID:1696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3156,i,11881254914983802650,7655398225062279115,2097152 --field-trial-handle=2380,i,16789298902369992777,9165982107284864359,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
      4⤵
      PID:6168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3172,i,16534411483493208974,11168463286762043755,2097152 --field-trial-handle=2380,i,16789298902369992777,9165982107284864359,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:9
      4⤵
      PID:5468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3904,i,892499490050667011,3361775405334190721,2097152 --field-trial-handle=2380,i,16789298902369992777,9165982107284864359,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:9
      4⤵
      PID:3704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4304,i,8097251712604739997,15853104284534795717,2097152 --field-trial-handle=2380,i,16789298902369992777,9165982107284864359,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
      4⤵
      PID:2000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tctq5ogx.dmy" --force-high-res-timeticks=disabled --metrics-shmem-handle=4312,i,8997866071575859010,1947444010723834939,524288 --field-trial-handle=2380,i,16789298902369992777,9165982107284864359,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
      4⤵
      PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2c8,0x7ffb98b7c188,0x7ffb98b7c194,0x7ffb98b7c1a0
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1600,i,17330235851542479366,2647111966791032031,262144 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,4981479811882767692,1498835950766648546,524288 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
      4⤵
      System Time Discovery
      PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,14779262005874657613,13523631135166960034,524288 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:13
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3280,i,9255333331264902696,75099636124629697,2097152 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:6552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3288,i,15841870150385992220,9861581618757757068,2097152 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:6564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3688,i,15324502201714337881,7701989290001220938,2097152 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3668,i,8771983022742985130,14924405695789057435,2097152 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:9
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3752,i,16960300514355274132,4974706573260608555,2097152 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3808,i,18288610443479956478,9474997285366159243,2097152 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:9
      4⤵
      PID:3524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3816,i,9419879536163047334,6394551100786996234,2097152 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3840,i,3790519861295359282,10405670598490572215,2097152 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:9
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3912,i,1086349483228122021,16874382258536915774,2097152 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:1
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3920,i,11600761481141585522,17845934766806855000,2097152 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:9
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3960,i,7814656519345522057,8450351983116281853,2097152 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3956,i,13667015723192666658,1624895408797882159,2097152 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:9
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,17704628673728175364,8588997421703277968,524288 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,10052349885814235303,9166951278617001408,524288 --field-trial-handle=2304,i,11548908063757743793,9055516250301085679,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
      4⤵
      PID:6356
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbae83c728,0x7ffbae83c734,0x7ffbae83c740
      4⤵
      PID:6580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1596,i,15711535646003082315,17250267849124265777,262144 --field-trial-handle=2020,i,199936234471520256,7442828135438830269,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
      4⤵
      PID:5732
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1848,i,1789754289251674044,1992939924132092838,524288 --field-trial-handle=2020,i,199936234471520256,7442828135438830269,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
      4⤵
      System Time Discovery
      PID:4940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf" --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,15507622933844189698,10862203828474045133,524288 --field-trial-handle=2020,i,199936234471520256,7442828135438830269,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:13
      4⤵
      PID:3160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2996,i,4084071222054366341,2259304631933813912,2097152 --field-trial-handle=2020,i,199936234471520256,7442828135438830269,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:1
      4⤵
      PID:1828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3000,i,14215470807471776716,14190398525198232255,2097152 --field-trial-handle=2020,i,199936234471520256,7442828135438830269,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:1
      4⤵
      PID:6788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3240,i,12476584654544465447,5459173796670145575,2097152 --field-trial-handle=2020,i,199936234471520256,7442828135438830269,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
      4⤵
      PID:6748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3268,i,4928802264515453757,3183413588162848823,2097152 --field-trial-handle=2020,i,199936234471520256,7442828135438830269,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:9
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3796,i,18184650441455356449,3829589184851769982,2097152 --field-trial-handle=2020,i,199936234471520256,7442828135438830269,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:9
      4⤵
      PID:6944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4276,i,8950957067649081338,14520196539427733451,2097152 --field-trial-handle=2020,i,199936234471520256,7442828135438830269,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
      4⤵
      PID:4200
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf" --force-high-res-timeticks=disabled --metrics-shmem-handle=4340,i,6768916848085103007,17909702013035138501,524288 --field-trial-handle=2020,i,199936234471520256,7442828135438830269,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
      4⤵
      PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    PID:6848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x22c,0x32c,0x7ffb98b7c188,0x7ffb98b7c194,0x7ffb98b7c1a0
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1652,i,9314468335294093258,1112719111542905582,262144 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
      4⤵
      PID:6912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,5236126043915465913,7546598010773674953,524288 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:11
      4⤵
      System Time Discovery
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,18278863128510385917,18412377369266577334,524288 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:13
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3256,i,468170549878778384,15834653751268019346,2097152 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:7152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3260,i,16676216081515398146,2055074842627163722,2097152 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3704,i,17760443703261838196,7053708050247376996,2097152 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
      4⤵
      PID:6480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3736,i,12816774995465094715,15889903470778517639,2097152 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:9
      4⤵
      PID:6924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3760,i,11248967409619277208,5127059577456751985,2097152 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3808,i,8734974440002117398,17994013060861161621,2097152 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:9
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3824,i,8656315853012487693,5889690323739949049,2097152 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:1
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3852,i,17836620891549684757,1298903455925668962,2097152 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:9
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3876,i,7055352410105719493,6992766001369322471,2097152 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
      4⤵
      PID:6736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3912,i,13488921528050929290,8178601697096943168,2097152 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3940,i,17180078054845448106,7537592363674463934,2097152 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
      4⤵
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3964,i,8850217512938408438,8868850635881543594,2097152 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:9
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,17423183703916397033,5146536199882443497,524288 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:14
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,5092578474275118732,3758635976951481959,524288 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,11210387367728901271,7727430453071205529,524288 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,5509079334451195001,10163323942891907718,524288 --field-trial-handle=2472,i,6047078317144942549,15665991378587357526,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:3424
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5y4e20yi.zv3"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:7140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5y4e20yi.zv3 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\5y4e20yi.zv3\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\5y4e20yi.zv3 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x108,0x13c,0x7ffbae96c728,0x7ffbae96c734,0x7ffbae96c740
      4⤵
      PID:5956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5y4e20yi.zv3" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1720,i,18029513347163151686,4853769985743678911,262144 --field-trial-handle=1884,i,9290476054385146536,3661998861042902637,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:7012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5y4e20yi.zv3" --force-high-res-timeticks=disabled --metrics-shmem-handle=1976,i,10930930039604004316,66309012791675530,524288 --field-trial-handle=1884,i,9290476054385146536,3661998861042902637,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:11
      4⤵
      System Time Discovery
      PID:2244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5y4e20yi.zv3" --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,15598214949468060118,3608693700338511497,524288 --field-trial-handle=1884,i,9290476054385146536,3661998861042902637,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:13
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5y4e20yi.zv3" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2992,i,16713114739653154703,7599535204495253190,2097152 --field-trial-handle=1884,i,9290476054385146536,3661998861042902637,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:1
      4⤵
      PID:7164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5y4e20yi.zv3" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3012,i,9572380365304471521,8789820251168699269,2097152 --field-trial-handle=1884,i,9290476054385146536,3661998861042902637,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:1
      4⤵
      PID:400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5y4e20yi.zv3" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3300,i,13771029212919944671,7588533052962858482,2097152 --field-trial-handle=1884,i,9290476054385146536,3661998861042902637,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
      4⤵
      PID:2144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5y4e20yi.zv3" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3332,i,2633977446782545825,3360634094355975033,2097152 --field-trial-handle=1884,i,9290476054385146536,3661998861042902637,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:9
      4⤵
      PID:6584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5y4e20yi.zv3" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3824,i,9845413270912201277,408209092548485741,2097152 --field-trial-handle=1884,i,9290476054385146536,3661998861042902637,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:9
      4⤵
      PID:3360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5y4e20yi.zv3" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4268,i,2984175188864556419,9285073276789114919,2097152 --field-trial-handle=1884,i,9290476054385146536,3661998861042902637,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
      4⤵
      PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2b4,0x7ffb98b7c188,0x7ffb98b7c194,0x7ffb98b7c1a0
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=2012,i,10841109476652093033,10214779605429077963,262144 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
      4⤵
      PID:6236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,3341638284884702282,15966344182475679041,524288 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
      4⤵
      System Time Discovery
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,9712928724570520839,12611226968876285773,524288 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:13
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,10787277071827808467,2372746026626167758,2097152 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,2893159651309341258,8113777184005089886,2097152 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,11102916785483968048,17039610545805633742,2097152 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
      4⤵
      PID:6820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,13958359542569627956,8862740598670161257,2097152 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:9
      4⤵
      PID:6596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4240,i,4477763495493615020,14245352846340517467,2097152 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,6954311507963347590,12411988767202507467,2097152 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:9
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4276,i,16569733878253046846,5722418191804993051,2097152 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4288,i,9185141512373812563,6126938106997206967,2097152 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:9
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4300,i,10267226188200512486,12320907661528861478,2097152 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4312,i,14868733892775066161,16026754922236512461,2097152 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:9
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4324,i,14159561609279752074,7776476689786311890,2097152 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4336,i,16626887281495640867,1347597276449363364,2097152 --field-trial-handle=2200,i,3389559063535402526,17921360380911492207,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:9
      4⤵
      PID:3364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    PID:1200
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x108,0x13c,0x7ffbae96c728,0x7ffbae96c734,0x7ffbae96c740
      4⤵
      PID:3272
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1624,i,123563360400062023,13543065757708361849,262144 --field-trial-handle=2064,i,1504999339566919652,5067906962227404905,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
      4⤵
      PID:2668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1780,i,17400532580043306265,3099222218339586911,524288 --field-trial-handle=2064,i,1504999339566919652,5067906962227404905,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:11
      4⤵
      System Time Discovery
      PID:6960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp" --force-high-res-timeticks=disabled --metrics-shmem-handle=1836,i,864091233527839386,14814056308573468659,524288 --field-trial-handle=2064,i,1504999339566919652,5067906962227404905,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:13
      4⤵
      PID:6648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2992,i,2383760031820765813,813553173902161437,2097152 --field-trial-handle=2064,i,1504999339566919652,5067906962227404905,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:1
      4⤵
      PID:2436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2996,i,10910319402706192986,10922363088496051967,2097152 --field-trial-handle=2064,i,1504999339566919652,5067906962227404905,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:1
      4⤵
      PID:2180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3220,i,1125513986963182930,16649302977337814754,2097152 --field-trial-handle=2064,i,1504999339566919652,5067906962227404905,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      PID:4276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3244,i,6564386516055876496,4806596745303440377,2097152 --field-trial-handle=2064,i,1504999339566919652,5067906962227404905,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:9
      4⤵
      PID:2156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3748,i,875257969564015670,384835676691809373,2097152 --field-trial-handle=2064,i,1504999339566919652,5067906962227404905,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:9
      4⤵
      PID:3472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4324,i,14331226426840062219,2232269281416566598,2097152 --field-trial-handle=2064,i,1504999339566919652,5067906962227404905,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
      4⤵
      PID:2548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\d1bqwwtc.2qp" --force-high-res-timeticks=disabled --metrics-shmem-handle=4420,i,8944998525980280645,7893621249529636534,524288 --field-trial-handle=2064,i,1504999339566919652,5067906962227404905,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
      4⤵
      PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lzekw3td.mxx"
    3⤵
    PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lzekw3td.mxx /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lzekw3td.mxx\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x270,0x7ffbad28c188,0x7ffbad28c194,0x7ffbad28c1a0
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lzekw3td.mxx" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1712,i,8187375458109869192,12841636232040437890,262144 --field-trial-handle=2156,i,14407582258642659508,2984730949241670205,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lzekw3td.mxx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,12234503965056151077,4921016010490082246,524288 --field-trial-handle=2156,i,14407582258642659508,2984730949241670205,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
      4⤵
      System Time Discovery
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lzekw3td.mxx" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,1471881335366840093,8359444025664297002,524288 --field-trial-handle=2156,i,14407582258642659508,2984730949241670205,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:13
      4⤵
      PID:3040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

History

Path C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\2q3arhuq.psf\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h\Crashpad\settings.dat
Size 280B
SHA256 3dac22da212183b29d1fd5ae6f60573df9b3a62a606473bad20972935ad2f3ed
MD5 5f4039090aaf2baa8e416be54296d1f4
SHA1 1406e0395689e929dd013d1f8a4c3194a3df3b27
SHA512 91384dd864b91e723728a7c10af3c1bc50d1a81a454864d7ce258dcb5c76bb8aecb5d9e2121854e47277cf4c3c8f178c5b1e7029cc487f6854f80948c21e2fba
TLSH
T154D022003BA3E302C00EB230022AE30C8C038C8C8A8A032C0280280F08C002EE20B3CB
MD5 SHA1 SHA512 TLSH

Submit Download

c30e4cc8-0df9-4ad7-b83c-452abc7d50ec.tmp

Path C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h\Default\c30e4cc8-0df9-4ad7-b83c-452abc7d50ec.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h\Local State
Size 5KB
SHA256 5740ddfa95f69f38417d188cc8b72d269723169461c44f90ac4d73009d11b834
MD5 f6fda447f686712d845889e7323d69f8
SHA1 8c6795094468961cf6421af20e9930e5bbb49c71
SHA512 651534dee742fc18b22a687dbfb3d92697a8d51e40b7acdcbac7d9fc94e56fc6bdb1886cf5c6124e8833fe38baff15a2abce37da6167a3368b0020f3554eaecd
SSDEEP 96:8qGNkAQsjpfdED1kpN58Frh/cInURoDotovIcDKBl6Ov7P+sS0x4UOiwEq4a:nGNY6nek6ooDUwba3+sSXik
TLSH
T17EB1B5726429EC235EE6A95574C63363BFA47077DD85BF88EADC170C04DB348274A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h\Local State
Size 4KB
SHA256 7382385963022fd5a7f0ce193d3027bc44e3654cb249feb970d30f47449177a3
MD5 42bb5b4ac5f3e1efebbd95b42aaec697
SHA1 3359153edd604e7627b77bf4cad1f31b7e46b060
SHA512 073dd7ba23ba090fb42bbc1b0ac5d37c5ff0b6a987d2b030a2dbec3758f5892c66a21be1a69b3d8f0f78573841305b47815f2abef12cf6cf29f79fbd7a555ca3
SSDEEP 96:8qGNkvsIMfdED1kpN1dd/DZBl6Ov7P+sS0x4UOiwEq4a:nGNMHwekFv/3+sSXik
TLSH
T13781C5726424EC3359EA6554759633A3AFB470B3DE11AF44E9DC530804DB71C2B0E82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a44ea.TMP

Path C:\Users\Admin\AppData\Local\Temp\anwq4f0y.s3h\Local State~RFe5a44ea.TMP
Size 1KB
SHA256 cde6d200cb142096907eee2d1deb05adccdf80fa81e0094930aba081d78839e1
MD5 45d37a9267c3983526bfa7b924d384a5
SHA1 ad71bf6f18ee3fdf46d1bfb39b59c9f4ea8c0ef3
SHA512 3471e72a446f950e124aa36a1cdab935e9e967bbcf1d77fe2c5d97ce931c4339b1d8f2bd1a17e50d91f41c5f166e7e6c470f3f1b5a671a846628d225fcd058e4
TLSH
T1D8318675A8586C73FC6295567245B7677F70617486916B8825EC120C05E359C630FC3F
MD5 SHA1 SHA512 TLSH

Submit Download

e023fa7c-9f5d-4758-ae73-a3031892939e.tmp

Path C:\Users\Admin\AppData\Local\Temp\e023fa7c-9f5d-4758-ae73-a3031892939e.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell\Crashpad\settings.dat
Size 280B
SHA256 fff9348154643205236a02db0e4ba08694c70e59a66afbcacca3b20e5354bd1a
MD5 f6f40812c72c43e620946b2f8dc72872
SHA1 0b7102bfac4d7ce39f3c7e88a7050fe17aba4cf6
SHA512 1153cfa3509fd285e80fbffd45c223b2fd7bb2bf423c64858eb561524ab33c4824fd223a85b94aca7aecc7b6158e65b31d0aaab0dab6a9fd2c9e4d50b20349d3
TLSH
T186D00262F341C325E60F287697A18B240651A861A20D72A6FBF731D97EC46B2404F3C8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell\Local State
Size 5KB
SHA256 b7895b80f1e0aa39e6237f1040c064d673849e1ea8d9be151f9cb40d0ece7cc6
MD5 6e468e6496b00ec5ac008ea70e74a105
SHA1 64890306c25c483ed231ac25c66c39e04bf66d95
SHA512 629533a18f4ff585f968d3b01e866db09f310dd75a56c07ea0c43adc8f882d45097f1c9dad09c0fe1d36b71e5e1f14cb9d8d1044e339c4289f899a6898b4af84
SSDEEP 96:kqGNkkNQsjpfd6VJ58Frh/cInURoDotovKyEWD4B0PBKv3mik0x4UO4fzGDq4a:PGNJW6nZooDUw6QMeBhikX47GM
TLSH
T112B1C5766424EC275AEAA945B8C6275BBFA42077DC45BF88E6EC160C04DB358270EC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell\Local State
Size 4KB
SHA256 9a51b164d9954e6a86eb16b6e78c9ad7b3696db99eefe9b2273eeaa55237bfa5
MD5 a8c55b8c82f1f64d8346af52e1a6c0b8
SHA1 deccb4b006e4baf78e8828830a0fee3ac9e4e9d2
SHA512 44d8076fa563953a2ed48888e5ed28321b19b18fc5aa1390da366c3bf7efd8ed3f6b3d0d1f4e644508bd845daa43c4ef4b17ce536fb6650d8814bf194dd7bce6
SSDEEP 96:kqGNkkWsIMfd6VJ1XDAWDPB0PBKv3mik0x4UO4fzGDq4a:PGNJWHwM0Q5eBhikX47GM
TLSH
T1A691D6726424EC2756E9AA45B5862797AF7830B7CD01AF80F6DD530C04EB71C2B0E82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5b2fb7.TMP

Path C:\Users\Admin\AppData\Local\Temp\ghal2qv1.ell\Local State~RFe5b2fb7.TMP
Size 1KB
SHA256 5cde1bc343ca3ee800832b96e30b0fec699026ad08bde45b4e29d16409b2291a
MD5 67cab8c772dc849c9916db0eec3e5dc1
SHA1 d697958c43ac87a3738dcb8d05050408cc655c5c
SHA512 2160f6f019ba3489c3d3da5544c7b99a9bfac550de99bad30135594fd0a524e8351d3b150a7d0d2c5faf5d12b75df74fea2abd4c434683448329d70e9db8a0d0
TLSH
T17031A7B5A8642C7BA8A18983B288771B3F751175C1115E8452FD920C45E769D521FC3E
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Temp\j01asmkn.xu2\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3\Crashpad\settings.dat
Size 280B
SHA256 36c43ce6fe0d8b91524c1084b6e5e728f1945c88ab42118b0f5e3f05b00de0e2
MD5 a228c3b1cd8e607a37dd0b3ad6634e0d
SHA1 0ed828e09ffdad103cc619ec97c5699260de82b1
SHA512 728424973bf6c7c780b824c5de2fd86971dabb438444a95d24be4c5667275e7bdee78c633f4371209bf17a025f624b7ac7b3fd74ad302c99ef7fea35ec98a84c
TLSH
T170D02223BF82C0A0C8C223FA02BC3382032CCC0C0002008C008A8C0CF8E8003C032C8A
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3\Default\History
Size 200KB
SHA256 9327a2e2697141395e726166b20bae44dd4d139272b1c2f51aa5d2d618ce431c
MD5 290f5f4586f08001e086b4bc5044a8bf
SHA1 7857d24f564bd07915947982e9a6c91a6778e758
SHA512 985b9539abf09b0e18f4870c0f5fdeb034d1a7ff66797b13af0b78e0d7af080e4241a27d2be5df1d716e38514da058c9c994c580aa84519fc715e2455ee566b6
SSDEEP 96:UttejzH+bF+UIYysX0fxQp97xEHt/DfLjLqL/XbtotOQpwfC4JnMrXPFs+pFRGiE:UqH+bF+UI3iWGVxWN3qL/Ru3
TLSH
T1D414DE1E5F253721CDBD913669EA44A35C7CF03FCB5326DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3\Default\README
Size 182B
SHA256 a0c9abae18599f0a65fc654ad36251f6330794bea66b718a09d8b297f3e38e87
MD5 643e00b0186aa80523f8a6bed550a925
SHA1 ec4056125d6f1a8890ffe01bffc973c2f6abd115
SHA512 d91a934eaf7d9d669b8ad4452234de6b23d15237cb4d251f2c78c8339cee7b4f9ba6b8597e35fe8c81b3d6f64ae707c68ff492903c0edc3e4baf2c6b747e247d
TLSH
T15BC0123585C365A5521A02F2694152826606E923A82ADD6097DD804C1703BF1F2112DB
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 dc3067bbd9aab49ac217ac488bb0caf5adf74b90ba2001bec882c92512eb28f8
MD5 c0a1d1d29777b374ff9e565dfde93eec
SHA1 d5a976d7419f694062a8148e82d662c6ce44a4c9
SHA512 34a4fe891bee18e4cf186243806a2b6e41231e746cfbed070329dd80c4d6d873666e96ea5f5e2ef488b968fdeaed825c0633092a5ab51ce65608c99801d9261b
TLSH
T1A8D02BBE2DBA4810D97F83E65472848000133E68DA49AC8E001E758710F23326956D61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5ad226.TMP

Path C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5ad226.TMP
Size 153B
SHA256 760f3e2df4df4d7fe608d92a37a452a4164f774e0ddad091732a5ebeaa354b92
MD5 648f2e16fa5d698e2b7c3295b97a6f49
SHA1 8b40d4122609d5812a524d63cf6803730c0ea0fd
SHA512 99ebae0fba78e59d82d4533bdb462cdf7f076b0d1b6a5a0079c0df76d5173824b4ca515e7f34b9289920ebf8c40f26084ae330a7d83014972c5b47571fc8c4b2
TLSH
T13FC08CBF185A0800DA1A82E24031C49441332D8C8A80AC9E401EB4C320B22327962D21
MD5 SHA1 SHA512 TLSH

Submit Download

arbitration_service_config.json

Path C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3\Default\arbitration_service_config.json
Size 18KB
SHA256 4f80297878efc766ea56228d59d559df416d36f3911a2ee240ba81a4eb27ca0f
MD5 0a4dfb2ee74365913fccd8dd47c41600
SHA1 7b99062fdbc83cd072d84457ed071c549eb2dfa7
SHA512 778351717d71b5b21f9be013dc112f0596c1b667fa450e2913d413e56183d115379b04de51b6d6e456459ec0be7338db03924ad05c2e60192026a676e7ad0b8b
SSDEEP 192:vQeqfRR+nft0joCxc/i4utSfnwzjOq52ef8Hw54ecoaSbqG/I5zT85:vQeiKF0jojq4uGE18efsSraSbqG/H
TLSH
T1C392D251FD5B7D6F7BBAC0346A9468075CAA475EA870900AF2BCCD049FEDF240216D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3\Default\default_cloud_config.json
Size 8KB
SHA256 2e7a7f0b9bc75d0c3b20042b5027d5c2fa5d51565ddfa38ae863242b5d231550
MD5 1f2ae372fc4cbb3ea21331f7fdb3992f
SHA1 ce8823aff176eee15937b362606b033fbb353c0e
SHA512 031ed30270536d7b7396ad25a739e3c3dda311a4cc4d175a03848540e1cf90feb52e542364ebaed33fdbe994e3420533e748f9ad2a5e94ac263c6287fe0bacde
SSDEEP 96:RR2F2jKrEFYNSdJeRgPAn8XckvgGVFqAQ2ghEFq9Q2gERflbPER4q0IqoY0dwWtT:weggaRIskvFa9k87En4GpU7REH9z0YN
TLSH
T1F002AB7AD2215C7729B452AC9CBC4793F210137F5281880FB8BC656C4F7BA76A488F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3\Local State
Size 5KB
SHA256 2e7fc2f22cdfe948641f1b1bb7a5847a066d7e19823fd8a9bbe14d1bbf58db4f
MD5 1a138dd483d7b5624794498e6e93a637
SHA1 3fc861d38de1868be6bbdda2fe998a08db9e820a
SHA512 ee10df0a6732dc73c6c3989588d97cad995c155b42de27548a24909cc7ed3c3e588d7fe5e2916a17efc072aa88c25ba290b82d74452d3565473f141b6a7d00de
SSDEEP 96:rqGNkvQsjpfdqkYxI58Frh/cInURoDotovM5DPRB7Qv26ZCbz30x4UOkCXXZq4a:uGNT6nqVtooDUwC/WybXkCa
TLSH
T13EB1E7766464EC231AF6AA44B8893753AFB86177DD44BF88E9DD1B0C04D7388270E827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3\Local State
Size 4KB
SHA256 221047b30cdeb01809266b9e862fa1e79c2f6c12a6354b9bd80aec8a81963395
MD5 f8d6f32b368aee1eb88cb85a7ee83939
SHA1 8b97cfb7a7b198244c910dfc2a72d0f48deee16f
SHA512 7a2afe8db4a8e2abe2352dc7fa557f0dab0d665d3d5d94e9b509f9d8acda206eb29a1dfd00726bbc783508477d1bb92c73e5babd916ff2ff120917dfbf7e99a3
SSDEEP 96:rqGNkssIMfdqkYxI1pyDP6B7Qv26ZCbz30x4UOkCXXZq4a:uGN3HwqVIiyWybXkCa
TLSH
T19681D8726464EC3366EA6A54B88A37A39F7870B3DE01AF54E5DD530C00DB7582B0E837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5ac10f.TMP

Path C:\Users\Admin\AppData\Local\Temp\kj4b0uah.dh3\Local State~RFe5ac10f.TMP
Size 1KB
SHA256 a75d56fb2423852e2b38fdda08f20792b397bfd5e4de23484e26d9eb9452f52a
MD5 532cfd02b50bb0736b3bb514df2e83ee
SHA1 b742fb831eec341fb4888189bc2bcf5ff3d8cdac
SHA512 18b23612a3729cafed28118ab85bd9722e2ce134d62cc024430dd2346460d26220a5436cd27430b9055e7cd2321d9b6db9cab2c7966fd2d32b97368c30e1d271
TLSH
T1BD31C87568946CB3BDA12B9972097F236F786179C3105F4855ED460C01E768CA72EC3B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu\Crashpad\settings.dat
Size 280B
SHA256 b1c6f37c5b62f952efe506bdf0873250c8518ae6d76a62f9f75d91c17acece9d
MD5 eb95d4bf0f7a1f9756220beb2362bbb5
SHA1 94c00a48b081fa19fb070721548dbd6a9e9a49be
SHA512 2a921fc7ad66508e61017cffc3324b4459cbc5e406b6c76c7dfb6aaaef47c7e73938c8e2faae5c46ed269e8c26e5b87f890394886334bb007766450dc1e67d06
TLSH
T1ACD01100A3822020CA220B3A80A82BA202ACE800080A0AA2AA82222E2803808E083000
MD5 SHA1 SHA512 TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu\Default\Cache\Cache_Data\f_000001
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu\Local State
Size 5KB
SHA256 51e494fc99ab2aeebdbd9742d0665be89afd30355f5ec1301a90cd7f6a06537c
MD5 0b45e29f3aa6bf6d30eb5b76f77ea9c8
SHA1 2752505231b8574bcc1e65306f252b406dd9f927
SHA512 5aaa2572bb536cb37bd7df5181f4e155671286ba720edf741448e7c4dd0c6b6ed9615436c874696157ef4a23c1fa4367f4aafe4deafb62994eb67ac37f92141d
SSDEEP 96:iqGNkpQsjpfdw18bUkA9O58Frh/cInURoDotov+cDbB2Av/v0KS0x4UOknvIq4a:ZGN16nyI49NooDUwLlB0KSXkn1
TLSH
T1ACB1D6325475EC2319F6A945B5C93363AFB46073ED85BF88E6EC060C04DB358274A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu\Local State
Size 4KB
SHA256 a34f91ccf74e5b0ccbd9074566e81116b2db50a0153db690cd3e0a26fb917207
MD5 e9e3a083f24c6df1871ee1e6d08528a1
SHA1 39be93ea26524f6a04e06965f2352b52d7004e22
SHA512 0c738f3ee9bbe128f128a06022e9b505bf372a29d7f07a402dfc7333f46464a18bbed05b096ec8e0da90523a2a1488d2a0378943da36ce83f5649558157b57ca
SSDEEP 96:iqGNkCsIMfdw18bUkA9O1TjDMB2Av/v0KS0x4UOknvIq4a:ZGNNHwyI49ojAB0KSXkn1
TLSH
T13581C7722425EC3365F96559B59A33A39F7870B3DD06AF84E6E9530C04DB2183B0E82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a809b.TMP

Path C:\Users\Admin\AppData\Local\Temp\ounr0vjp.gdu\Local State~RFe5a809b.TMP
Size 1KB
SHA256 21cea22355511d250efdb0bb4b45f4b258f1cfcbd3a362a8ef3f0ae5166af85c
MD5 fdef4afb7e9fdd949073228d53af32ae
SHA1 baf0a64bd0f445bc01a51a078f0955ed2f14d677
SHA512 fd2f13f6d6fda72063982643787ce534787cf784bd0fd6a0600746821070380558b1332ac6cabeac7cb8fe018da44fc82f2158a7c1c8a6aacd35259c911bb9c0
TLSH
T18531F87158E81CB3B8B1564FB38DB7636F746171C1565B8892ED020C01E769C571F83B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs\Crashpad\settings.dat
Size 280B
SHA256 e4c35b8abed8d85c15cd566a5ccd36e9986ca16945cdf8eb41b867f0108d1f2c
MD5 7c457310c51b8b6ff715e91abc4c78b2
SHA1 2ba660c9c91529403e0e60104212453fc0aa4fa4
SHA512 e458d096d648b46354b4d05100795aca046199da2ea3395926dd4c5bc16833f3f45e7a0fe27f7c98bb861e07fd5f1bce6997458f27f94f51abd6d37330a14726
TLSH
T140D02280330A208EC2C3803B0032BB8C0302CC0A32832200E82F00CFAA820F0008BFA0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs\Local State
Size 4KB
SHA256 48a7e8ac2e2885a8a80fd4584ab2a64138808c7fb2b1279ffe63dca758e8daa6
MD5 d369ebe475b271f13691b7cd0a23098e
SHA1 566d34ad93c21e3463f874dbf5a9cdf554f2e1f9
SHA512 bf285b76fbc22dca4cfa923ba3a6944b1ec1251d2dd8a968592d0f0d2f22baa068baa64b4673bce8fb1a34e4d5150e2a73e14cbfba192cf96327731981c06c0b
SSDEEP 96:uqGNkOsIMfdoKw91AS11DDdBALvHNZSA0x4UO+NluYBKq4a:VGNZHwNodDmSAX+NlTBH
TLSH
T1F781A5726425DC3316E76955B89637A39F747077DD01AF41F6D9530804E772C2B0E827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs\Local State
Size 5KB
SHA256 db38b17d62bb165dc820a405a09ac2f54fbe53706bcbcb2f8a312767f62fe1aa
MD5 c567762df9802465e146461750cd26dc
SHA1 0a6911eec119c59d2d4a5fe96066a32b547862e7
SHA512 5c4af145eb502323f5c4dcfb619b12691911651cc5cabdaf603546b041cf778cc9ebfaeaaee8471ef68365438e780ca705ef718c6901fb8fb1ddd61026fb6169
SSDEEP 96:uqGNkFQsjpfdoKw91AS58Frh/cInURoDotovgYDeBALvHNZSA0x4UO+NluYBKq4a:VGNB6nNNooDUwBemSAX+NlTBH
TLSH
T100B1D5766435EC371AE3A905B88637A7AFA47037E985BF85EADC060C04E7358270E817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59c654.TMP

Path C:\Users\Admin\AppData\Local\Temp\rntth44p.4qs\Local State~RFe59c654.TMP
Size 1KB
SHA256 cd036a69e86a314db2651a6a0f3c683844f922b4575203891e322e158253e415
MD5 e0f280662e265364c8b4e216d8ac28b7
SHA1 dd2c3b18ce133b327bd13fe368514b60947b96c5
SHA512 e39da9948cef7caea25d7c04bfa7e9ba54ef0d9de59b5fec07b1ef89d76b285ee71fb83d7fa084596f47cee3fe33d630ee27f3f7976d1e2c4ae086e5944bd09a
TLSH
T1FF31D476AC681CB378A30606B24677AB6FB02038D242AA40B6ED410C05F31BC170FC3F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3\Crashpad\settings.dat
Size 280B
SHA256 258ba178a858b2025fa52430a2613eb81d932f049284b98396776ca610a7faf0
MD5 c8e6551f27d0a4f29b76c77c44818f22
SHA1 c14f28ccd9bba213191c76425b33a70b50e76d26
SHA512 f06367db768e1364b673286ce90deb38e4e4e763c2e8055556d7c4df5c46632f62e8f538e94f3eb3756a0f773a796b84c691518b64f345058ae35aeb6fc0e7be
TLSH
T1A8D00273FBB799C5C17C56BBD3D4C2410198FB4401939A5C0A58A4293CD3A65505A4AD
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3\Local State
Size 5KB
SHA256 126497295f2f4fbef2f600b708cafb1c4da71772ade34e7c94ad54f845028703
MD5 299ad8cf0209d5438548c52001deff9a
SHA1 fb91aca8dcc8d4b333b5deb99ea57251165b1181
SHA512 ed7d63513cd117e463f31850fcd8f06ef9cd592e0a8ee91e165298aca5f5cdadee2839da79b40419b8e9d4ed99ebb495cf03ad894eb6c5e17826fa53ebf094d6
SSDEEP 96:kqGNkVQsjpfd0ppm58Frh/cInURoDotovSUDwBxDTvbtLaLn0x4UO7EmyOq4a:PGNJ6n0dooDUwH07LaTXNI
TLSH
T1AEB194366538ACB79BF29F46B5863713AFE4613BD5913B94EDD80A1C04CB7882346827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3\Local State
Size 4KB
SHA256 29ca6c3442b667fcd9a71299a39c40d6f0490eb3dd773b5a4f9797fd991f61f3
MD5 e69417fe3e465c164e312333a02df318
SHA1 9f87f78bd67aaf7da2eee35073da14df4a2fe55e
SHA512 407443f0eb197ca73eb0d364549ca14b6fc865789a205505db952f17828f63b22e8ea28bfa3421390cc9291a8f72875d728b0673b2026b3dd829d49cfc1f1742
SSDEEP 96:kqGNk+sIMfd0ppm1/FDXBxDTvbtLaLn0x4UO7EmyOq4a:PGNBHw04FR7LaTXNI
TLSH
T1CD81B5326534ACB397F75F4AB6862B039FB8B13BD5612B50EDD8062804CB64C234683B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a089c.TMP

Path C:\Users\Admin\AppData\Local\Temp\wfz1skrp.xj3\Local State~RFe5a089c.TMP
Size 1KB
SHA256 0ad29fe9d775db251b6a1babf1495674a5ec26cb5cd272a5926e5ba1ce029030
MD5 f241b7c58412f33d1f57d68b68062ad1
SHA1 bd4008cc507e073230bc8aca88d16072ea79a47f
SHA512 473b74e17c57aa2c7b9ca24347b99bcd66a45b547cdf8583386aa7012d176afe870499ccd05837bf51e5711cff08de9e42f065ea2813d435bad433d5d6d1f1e8
TLSH
T1F831A876A9746CB3E8A3574B6385BB17AFB09139C2516A4865DD451C01D378C230BC3F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Crashpad\settings.dat
Size 40B
SHA256 b320685032c3a5ad90a42f59c5410587ca3608525bff313b91f8ec141a0e0682
MD5 d57298aa77cc979f29fbc1ca73ca34ee
SHA1 0e7819bb8ee16f56388846fd91e62b34c8613cf7
SHA512 a65bcdcf37bf7b575a02a539a7a44abff755b900ff23a332899c553d15ad958cab40b2d71a16325cb84b9c78e970264f285e894a6d20be6b72e3d007e7078a79
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 33a21cbf1451b24d63b650e9cf2fcbdf0c32f83accd17ce56b49680ff2c3bafb
MD5 c5cb67aec147069a9abd2dcb25fa467e
SHA1 c0cc9041ad49a57ffd1c3d7959bf0b16e4fc5755
SHA512 b864f4daaa8fad4053956dd8f59ac6de14abda747e3825f457a1a609bff32b7cb552c120744b8b3ab482b2ff823a499535962c52bcf2846797ac9a1ed871ae0f
SSDEEP 6:/FoEXERFikNcTFQSfGj+4eu1Yq9ijoTQk4kEXmvcfvkllqtiwiKgZQ:d7XSFHNcTFQpe/qG2QjkEmvcf8/qt9s
TLSH
T1D51352BF87812D23CB99207D44CB3BB03372D80BAA52A203603836223202B21F809203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 397a32272e1ab167a4149d595b82b326de827ce7b26a6a9d3dc94e4c8dc42e3f
MD5 4d1b6ce8a8b90a0015aad61a2bd34edc
SHA1 f51a4dc9865cf2ae54f3da6dbc52f6f2cba789b3
SHA512 e3c96f3077f75a5c52b41bd8464d40d4b7fcf9d134b44ea1f3f20f7e55e382266dd95a9c4ca948d6d2ccf2b852e984d3ce8463c7293bd9ab95a899ce5a40d46b
SSDEEP 48:KflQ+yYxmsDJO5eD0HCNKceM1XghuXT40MmXgdVEPLVBKWwtl:KNbLIsFO5eR5eughOT40jeVOLHKWol
TLSH
T1B94485F72D00DAC6DA18CBB86C41A23CDE3296272CAAED75F53884A255507E73218667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 58d9261bd3e4ea4096798f7e161d6d896c4fc99c6eaea571525ce2d9b8536873
MD5 af38b3397559416e0fd09dbb1f9b92df
SHA1 c97a427c8765d4d2deef935dfb40a929a0edc43b
SHA512 1d285d55dd13382ee8fa04f109a5a0e6eac26a7951507d6e43a486a5e42c0ebd75597464e5b466ec5da124e6ad6709d001dd1499f24e04b01309074f6a34e737
SSDEEP 768:3UfDPLSgcRUv+T4GUfDPLSgcRUv+z4fUfDPLSgcRUv+l4IfDPLSgcRUv+m4AQz4t:l5KpwzJxIzqz
TLSH
T15C166DB74F68A946D781EEB0FBCDED1C3C7022C6ACD25C92F112926949E4FC42B8515E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 df8dfe5b3b1e1dd19ee4b24bb827cac3f8d8c64c47142034a2364c26f3e7897a
MD5 4fe4ecd855142d5fc69b82db7a7175e1
SHA1 bcce057ea5e34ac8b2232787c8e94adf338bd368
SHA512 ba47822e4239597288cd1c0ea30b36b17f085b479df562ea4822a0b6bb33723b9c974defe123fa508d80b563aa6c148143c7341a8acf9a788cfe08e2ccfa9059
SSDEEP 768:RHXHXN18vgt1rSDgcuCulovyzxmejBpXUXgAa6nhroGgjOSXL:Rf8vIUDJuCuOvy5p8g+nhgL
TLSH
T1B2030226098A97557311F30AB3D6D12A55C2F2B436D34DFCED2D8D839C9D8E2E282DA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 6a61b95e873e0f5505dd480208c00ac0e32a4d913209648a9825332eb8b9b6fd
MD5 7637378e46397a3f66a65894969d73e7
SHA1 cda8574cdb9a71fb96e173cfd0a1d9189604c08b
SHA512 fc3e5fbfdc0c873271c306c8fa75150d43366463cff354b2c146dfb3dbf195eda1d87077a90177ad5c2e6e993ae1f823bb1eb7535afa5c041c632d62fa67b971
SSDEEP 1536:ZEqcbzcJJpTE0N6EvOHns627rRH/WipIdENTEQVInkL/XKjaaZVjC:ZEq4zgTRN6IOHG7VfWipCE1BFjKhNC
TLSH
T1B063120A8BD6953ED5F73F867B38630D235A70DDC74288A7FB20A4A12356C2D916346D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Cache\Cache_Data\index
Size 256KB
SHA256 0a283c0cb7068fe65ce3faf382210ef51c9d5d9315cb4e42c6c118e34cb3399c
MD5 697a28bdea54b261afd9364239c4e319
SHA1 89c882c1be9467ba7a8126e5562c77912a86b88e
SHA512 aa59215218bbe83e7cf2b8c9dc62513be8c6b3a987567d5e14f20cf5db0c9b46faa1d950d8273e22d205dd3db42c7209443aa6850e9def53f78a07d88d6aad63
SSDEEP 3:LsLllFlklNllklkXlrFXollLll/nMll//Zllll/ZNtlmNtl3Nl/lglNlXl:LsRa3lPh4yltzlllhkNH
TLSH
T19F44125E93811E06C2C403FC800757107334C405CA8FC303170421206CC03402D0F110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 f14f45cdbe30b7cfcaa3f9a7fe84ab555624e1d5eae697cfc6aa6c981dd203ea
MD5 4686f96e9a78223aefc0227213fd79c3
SHA1 42a3569b8b2e72cd7713f1b295127f069b24c8af
SHA512 192985627bcb3627cbc7d34f01a50ca36c8bd334fcafdf2d65b13b5483ccb7344ea6c61b1a5dcfcef5576c4f200985a0cb180ca2e967cbd233a504536d1923a0
TLSH
T138E02B81824C0F1DD33D96F7CDA603044A0A82C429BF7603B980C2C233529241248223
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 a9cbbdc2c4f891408a88f2246456f1bd582d23ee67473f8736e963f3af08fae6
MD5 2cd63bbda9144fda691a7edc0492cc3c
SHA1 42df0a8c23d1bd42a560f4b921a36465987b4965
SHA512 99b7e8d86178a26428ce328ca687ac7721a8489bd5e8bd5e6d61e35f0d5582b58b9e8afde63a9fe3d8380e13b27ff814113481282f7dad470b7c994aa09785c9
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\DawnGraphiteCache\index
Size 256KB
SHA256 4ce435f7d159ba0df6140b5e612a37c1f7b0374e00fe1b7e5e2394ca0444b7d5
MD5 eda7ed5140e5f707563de0ed0c839069
SHA1 f297038d3f1d00350b407f945de5cd6a30b6d1cf
SHA512 8175dcacd93fa30ad00fca9baccb6bd63f809b8d2ad87c19fd3f78d5dc1499bd247380010a9f21f8bbd599a6200fa654cb21565fc03da482684418a0f57055f4
SSDEEP 3:LstlNllklkXl6m:LsX3lP6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\DawnWebGPUCache\index
Size 256KB
SHA256 960e120c1edd6b4fdfb6f12d01ab3fbe6044dce125876782ecba3a6a15e78983
MD5 561d1254d3c97c6c53175b6efc49b610
SHA1 06a23f85c14ed2e438258e4b573a698b14ae2268
SHA512 c354cf7d704e1bf9ae127a19631c44b04d45731144343254354ca7a2c9920e6e5d61b13225f0098b17c4df63f8fb95f0e99000563c60dbb40f0be6eeb9d285b7
SSDEEP 3:LstlNllklkXlC:LsX3lPC
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\GPUCache\index
Size 256KB
SHA256 efdf3595734605f77bc1c20edd31706ee34e04fedad68915d6b60fd8c1609093
MD5 24ea0394b5603ca75f5b13575ba215b6
SHA1 272e9b4293ebba3ce995e6065270ea25c623d0b6
SHA512 21739ffca296abc46eeca6479eb2c8723668b7a135d3eee65888e6ffe1f39e5d12a5f4477429998d8542c2c61d9fc60bd4688c42ea4cf03967a789a0c51b243e
SSDEEP 3:LstlNllklkXlVbdfflX:LsX3lPxdfflX
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b45b56a9d11337e9a95821154fc7699ca9bf6fcc17df376a474ebbe37e414ba1
MD5 ef2813c4ef1878153b0279c1db7d31ea
SHA1 1b9f64b52fe47a4d014dad11d7eda179c9bd4c33
SHA512 dbd7078c8bb62ba05e689f68a7ae959b23971ef53f2917c91e004a8cda89a8d1545458a66254e916d70435b6a9df482c79ca0fb752ec97939d2fba8e4e10ff38
TLSH
T19EA0021107548136C10407B42D0293882620FA26800406137ED4434ACC641619A26249
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 a1ffcebad84f1739b931281cad6519b01cdcc1fcad33588ab7720f2e0693c96f
MD5 15c24618d2455d9a36e8209f4fc14895
SHA1 de4c0830d4a3fd57f961fab5838ca16ce3824140
SHA512 404eaa972d2626f3c0f11e1c523fec123cee97dac342fb02ccaa7824627708f33045e3fef638604b76f37171e9f3093f10a8e2b584f0d3d8c43528e268a27903
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wzcl3ag4.5ui\GraphiteDawnCache\index
Size 256KB
SHA256 98230cd2e03a5c4208d1bdcb47f90b3a78b925555729a2a7421e1ca628bb5c2d
MD5 33f8c0e58b73c312693d9cce0560aa16
SHA1 cecc512996102efc677688a8947c113609d1c2ad
SHA512 d3ca06ca8538a919ba44e8df6021bec0802d44d61525a4c3627922b482abab42b4f42956ca2267045a36392f6fabcfa39d9a88fc2b7e04e1e2b7afc949db43b8
SSDEEP 3:LstlNllklkXlnlc4e:LsX3lPG4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/564-2226-0x0000021B27000000-0x0000021B270F2000-memory.dmp

Download

memory/1876-1283-0x0000017DEA7A0000-0x0000017DEA892000-memory.dmp

Download

memory/2008-168-0x000001B23CC00000-0x000001B23CCF2000-memory.dmp

Download

memory/2008-176-0x000001B2245B0000-0x000001B2245E2000-memory.dmp

Download

memory/2156-1489-0x000002DDAA490000-0x000002DDAA582000-memory.dmp

Download

memory/2416-17-0x0000021F6FC70000-0x0000021F6FC88000-memory.dmp

Download

memory/2416-22-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-0-0x00007FFBB5A1F000-0x00007FFBB5A20000-memory.dmp

Download

memory/2416-3-0x0000021F6F680000-0x0000021F6F6A2000-memory.dmp

Download

memory/2416-4-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-5-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-6-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-7-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-8-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-9-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-10-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-11-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-12-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-13-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-14-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-15-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-16-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-18-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2416-19-0x00007FFBB5890000-0x00007FFBB6234000-memory.dmp

Download

memory/2576-30-0x0000000006F20000-0x0000000006F86000-memory.dmp

Download

memory/2576-28-0x0000000006960000-0x0000000006A52000-memory.dmp

Download

memory/2576-24-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/2576-26-0x0000000005750000-0x0000000005828000-memory.dmp

Download

memory/2576-129-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/2576-23-0x00000000745F2000-0x00000000745F3000-memory.dmp

Download

memory/2576-20-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/2576-128-0x00000000745F2000-0x00000000745F3000-memory.dmp

Download

memory/2576-25-0x0000000005380000-0x00000000053FC000-memory.dmp

Download

memory/2576-34-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/2576-27-0x0000000005670000-0x00000000056BC000-memory.dmp

Download

memory/2576-172-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/2576-33-0x00000000073E0000-0x0000000007430000-memory.dmp

Download

memory/2576-438-0x0000000007350000-0x0000000007362000-memory.dmp

Download

memory/2576-29-0x0000000006E30000-0x0000000006E62000-memory.dmp

Download

memory/2576-439-0x00000000745E0000-0x0000000074D9C000-memory.dmp

Download

memory/2576-31-0x00000000077D0000-0x0000000007D8A000-memory.dmp

Download

memory/2576-32-0x0000000007130000-0x00000000071C2000-memory.dmp

Download

memory/3080-1138-0x000001799D080000-0x000001799D172000-memory.dmp

Download

memory/3272-2426-0x000001574DC50000-0x000001574DD42000-memory.dmp

Download

memory/3476-1891-0x000001A2BADC0000-0x000001A2BAEB2000-memory.dmp

Download

memory/4128-435-0x000002266D560000-0x000002266D652000-memory.dmp

Download

memory/4128-436-0x000002266D190000-0x000002266D1C2000-memory.dmp

Download

memory/4920-930-0x000001D8382D0000-0x000001D838302000-memory.dmp

Download

memory/4920-929-0x000001D838350000-0x000001D838442000-memory.dmp

Download

memory/5740-576-0x00000201ADCA0000-0x00000201ADD92000-memory.dmp

Download

memory/6168-2156-0x0000014C7D7A0000-0x0000014C7D892000-memory.dmp

Download

memory/6168-2157-0x0000014C65110000-0x0000014C65142000-memory.dmp

Download

memory/6672-1647-0x0000020CABFB0000-0x0000020CAC0A2000-memory.dmp

Download

memory/6672-1648-0x0000020C93820000-0x0000020C93852000-memory.dmp

Download

memory/7144-782-0x0000022FB7130000-0x0000022FB7222000-memory.dmp

Download