cobaltstrike | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Resubmissions

29/07/2026, 09:27

260729-le461adl4y10

25/07/2026, 16:39

08/11/2025, 17:35

02/11/2025, 23:51

01/11/2025, 12:53

01/11/2025, 12:49

01/11/2025, 04:57

31/10/2025, 18:11

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/07/2026, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4363463463464363463463463.exe
Size 10KB
Sample260725-t563aaag87
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
TLSH
T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor client crash credential_access defense_evasion discovery execution cobaltstrike lumma njrat remcos stealerium pyinstaller rat spyware stealer trojan

Malware Config

Extracted

Family

lumma

https://covvercilverow.shop/api
https://surroundeocw.shop/api
https://abortinoiwiam.shop/api
https://pumpkinkwquo.shop/api
https://priooozekw.shop/api
https://deallyharvenw.shop/api
https://defenddsouneuw.shop/api
https://racedsuitreow.shop/api
https://roaddrermncomplai.shop/api

Extracted

Family

njrat

Version

v2.0

Botnet

Crash

late-lil.at.ply.gg:35022

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Extracted

Family

stealerium

Attributes

email
[email protected]
url
https://szurubooru.zulipchat.com/api/v1/messages

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

Client

papilawdns.duckdns.org:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-865YOU
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Family: Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 52 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3936	chrome.exe
5952	chrome.exe
4172	chrome.exe
3432	chrome.exe
4460	chrome.exe
3068	chrome.exe
2952	chrome.exe
2068	chrome.exe
3284	chrome.exe
5268	chrome.exe
1300	chrome.exe
5592	chrome.exe
2372	chrome.exe
4696	chrome.exe
3776	chrome.exe
6044	chrome.exe
3204	chrome.exe
4284	chrome.exe
3276	chrome.exe
4608	chrome.exe
5928	chrome.exe
5224	chrome.exe
4548	chrome.exe
2996	chrome.exe
1780	chrome.exe
5696	chrome.exe
904	chrome.exe
2828	chrome.exe
2984	chrome.exe
4816	chrome.exe
5760	chrome.exe
6104	chrome.exe
724	chrome.exe
6104	chrome.exe
5004	chrome.exe
1120	chrome.exe
4304	chrome.exe
3260	chrome.exe
2296	chrome.exe
2548	chrome.exe
2560	chrome.exe
4876	chrome.exe
3404	chrome.exe
1672	chrome.exe
5124	chrome.exe
1988	chrome.exe
4788	chrome.exe
4768	chrome.exe
2304	chrome.exe
5164	chrome.exe
2232	chrome.exe
5856	chrome.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Fast%20Download.exe

Executes dropped EXE 7 IoCs

pid	Process
3472	0a1d01c296ced152dc4f10bd96e7d9bd933ecc95.exe
6040	ExtremeInjector.exe
3308	Fast%20Download.exe
3024	main.exe
3876	main.exe
1404	build.exe
3172	remcosraw.exe

Loads dropped DLL 41 IoCs

pid	Process
6040	ExtremeInjector.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe
3876	main.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
173	raw.githubusercontent.com
174	raw.githubusercontent.com
175	raw.githubusercontent.com
176	raw.githubusercontent.com
177	raw.githubusercontent.com
178	raw.githubusercontent.com
1	raw.githubusercontent.com
7	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6040 set thread context of 4560	6040	ExtremeInjector.exe	95

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral4/files/0x001000000001c558-62.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcosraw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExtremeInjector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fast%20Download.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

System Time Discovery 1 TTPs 12 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1852	chrome.exe
5456	chrome.exe
1344	chrome.exe
5400	chrome.exe
1516	chrome.exe
4512	chrome.exe
5044	chrome.exe
3516	chrome.exe
5080	chrome.exe
6068	chrome.exe
6020	chrome.exe
2436	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4812	timeout.exe

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 18 IoCs

defense_evasion

pid	Process
2084	taskkill.exe
4444	taskkill.exe
256	taskkill.exe
4696	taskkill.exe
4500	taskkill.exe
4684	taskkill.exe
2628	taskkill.exe
5952	taskkill.exe
2524	taskkill.exe
4216	taskkill.exe
5784	taskkill.exe
2964	taskkill.exe
1660	taskkill.exe
916	taskkill.exe
3460	taskkill.exe
2432	taskkill.exe
2116	taskkill.exe
3180	taskkill.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2560	chrome.exe
2560	chrome.exe
5696	chrome.exe
5696	chrome.exe
6044	chrome.exe
6044	chrome.exe
1672	chrome.exe
1672	chrome.exe
2828	chrome.exe
2828	chrome.exe
4816	chrome.exe
4816	chrome.exe
5224	chrome.exe
5224	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	4363463463464363463463463.exe
Token: SeDebugPrivilege	3472	0a1d01c296ced152dc4f10bd96e7d9bd933ecc95.exe
Token: SeDebugPrivilege	3308	Fast%20Download.exe
Token: 33	3308	Fast%20Download.exe
Token: SeIncBasePriorityPrivilege	3308	Fast%20Download.exe
Token: 33	3308	Fast%20Download.exe
Token: SeIncBasePriorityPrivilege	3308	Fast%20Download.exe
Token: SeDebugPrivilege	4500	taskkill.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: 33	3308	Fast%20Download.exe
Token: SeIncBasePriorityPrivilege	3308	Fast%20Download.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeDebugPrivilege	5784	taskkill.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeDebugPrivilege	2084	taskkill.exe
Token: SeShutdownPrivilege	6044	chrome.exe
Token: SeCreatePagefilePrivilege	6044	chrome.exe
Token: 33	3308	Fast%20Download.exe
Token: SeIncBasePriorityPrivilege	3308	Fast%20Download.exe
Token: SeShutdownPrivilege	6044	chrome.exe
Token: SeCreatePagefilePrivilege	6044	chrome.exe
Token: SeShutdownPrivilege	6044	chrome.exe
Token: SeCreatePagefilePrivilege	6044	chrome.exe
Token: SeShutdownPrivilege	6044	chrome.exe
Token: SeCreatePagefilePrivilege	6044	chrome.exe
Token: SeDebugPrivilege	4444	taskkill.exe
Token: 33	3308	Fast%20Download.exe
Token: SeIncBasePriorityPrivilege	3308	Fast%20Download.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeShutdownPrivilege	1672	chrome.exe
Token: SeCreatePagefilePrivilege	1672	chrome.exe
Token: SeShutdownPrivilege	1672	chrome.exe
Token: SeCreatePagefilePrivilege	1672	chrome.exe
Token: SeShutdownPrivilege	1672	chrome.exe
Token: SeCreatePagefilePrivilege	1672	chrome.exe
Token: SeShutdownPrivilege	1672	chrome.exe
Token: SeCreatePagefilePrivilege	1672	chrome.exe
Token: SeDebugPrivilege	3460	taskkill.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: 33	3308	Fast%20Download.exe
Token: SeIncBasePriorityPrivilege	3308	Fast%20Download.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeShutdownPrivilege	2828	chrome.exe
Token: SeCreatePagefilePrivilege	2828	chrome.exe
Token: SeDebugPrivilege	256	taskkill.exe
Token: 33	3308	Fast%20Download.exe
Token: SeIncBasePriorityPrivilege	3308	Fast%20Download.exe
Token: SeDebugPrivilege	2964	taskkill.exe
Token: SeShutdownPrivilege	4816	chrome.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
2560	chrome.exe
2560	chrome.exe
5696	chrome.exe
5696	chrome.exe
6044	chrome.exe
6044	chrome.exe
1672	chrome.exe
1672	chrome.exe
2828	chrome.exe
2828	chrome.exe
4816	chrome.exe
4816	chrome.exe
5224	chrome.exe
5224	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 3472	2228	4363463463464363463463463.exe	91
PID 2228 wrote to memory of 6040	2228	4363463463464363463463463.exe	93
PID 6040 wrote to memory of 4560	6040	ExtremeInjector.exe	95
PID 6040 wrote to memory of 4560	6040	ExtremeInjector.exe	95
PID 6040 wrote to memory of 4560	6040	ExtremeInjector.exe	95
PID 6040 wrote to memory of 4560	6040	ExtremeInjector.exe	95
PID 6040 wrote to memory of 4560	6040	ExtremeInjector.exe	95
PID 6040 wrote to memory of 4560	6040	ExtremeInjector.exe	95
PID 2228 wrote to memory of 3308	2228	4363463463464363463463463.exe	100
PID 3308 wrote to memory of 4996	3308	Fast%20Download.exe	102
PID 3308 wrote to memory of 1388	3308	Fast%20Download.exe	103
PID 2228 wrote to memory of 3024	2228	4363463463464363463463463.exe	106
PID 3024 wrote to memory of 3876	3024	main.exe	107
PID 3876 wrote to memory of 4500	3876	main.exe	108
PID 3876 wrote to memory of 2560	3876	main.exe	111
PID 2560 wrote to memory of 6108	2560	chrome.exe	112
PID 2560 wrote to memory of 3760	2560	chrome.exe	113
PID 2560 wrote to memory of 1516	2560	chrome.exe	114
PID 2560 wrote to memory of 2752	2560	chrome.exe	115
PID 2560 wrote to memory of 3776	2560	chrome.exe	117
PID 2560 wrote to memory of 3432	2560	chrome.exe	118
PID 2560 wrote to memory of 4340	2560	chrome.exe	119
PID 2560 wrote to memory of 5928	2560	chrome.exe	120
PID 3876 wrote to memory of 5784	3876	main.exe	121
PID 3876 wrote to memory of 5696	3876	main.exe	123
PID 5696 wrote to memory of 260	5696	chrome.exe	124
PID 5696 wrote to memory of 1744	5696	chrome.exe	125
PID 5696 wrote to memory of 5080	5696	chrome.exe	126
PID 5696 wrote to memory of 3312	5696	chrome.exe	127
PID 5696 wrote to memory of 724	5696	chrome.exe	129
PID 5696 wrote to memory of 4876	5696	chrome.exe	130
PID 5696 wrote to memory of 1392	5696	chrome.exe	131
PID 5696 wrote to memory of 3404	5696	chrome.exe	132
PID 3876 wrote to memory of 2084	3876	main.exe	133
PID 3876 wrote to memory of 6044	3876	main.exe	135
PID 6044 wrote to memory of 1604	6044	chrome.exe	136
PID 6044 wrote to memory of 1732	6044	chrome.exe	137
PID 6044 wrote to memory of 6068	6044	chrome.exe	138
PID 6044 wrote to memory of 3716	6044	chrome.exe	139
PID 6044 wrote to memory of 5004	6044	chrome.exe	141
PID 6044 wrote to memory of 6104	6044	chrome.exe	142
PID 6044 wrote to memory of 2464	6044	chrome.exe	143
PID 6044 wrote to memory of 1120	6044	chrome.exe	144
PID 3876 wrote to memory of 4444	3876	main.exe	145
PID 3876 wrote to memory of 4304	3876	main.exe	147
PID 4304 wrote to memory of 2124	4304	chrome.exe	148
PID 3876 wrote to memory of 4684	3876	main.exe	149
PID 3876 wrote to memory of 1672	3876	main.exe	151
PID 1672 wrote to memory of 2852	1672	chrome.exe	152
PID 1672 wrote to memory of 3104	1672	chrome.exe	153
PID 1672 wrote to memory of 6020	1672	chrome.exe	154
PID 1672 wrote to memory of 5444	1672	chrome.exe	155
PID 1672 wrote to memory of 3260	1672	chrome.exe	157
PID 1672 wrote to memory of 904	1672	chrome.exe	158
PID 1672 wrote to memory of 1336	1672	chrome.exe	159
PID 1672 wrote to memory of 5124	1672	chrome.exe	160
PID 3876 wrote to memory of 3460	3876	main.exe	161
PID 3876 wrote to memory of 2828	3876	main.exe	163
PID 2828 wrote to memory of 1808	2828	chrome.exe	164
PID 2828 wrote to memory of 5436	2828	chrome.exe	165
PID 2828 wrote to memory of 4512	2828	chrome.exe	166
PID 2828 wrote to memory of 5308	2828	chrome.exe	167
PID 2828 wrote to memory of 4460	2828	chrome.exe	169
PID 2828 wrote to memory of 2296	2828	chrome.exe	170

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4996	attrib.exe
1388	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\Files\0a1d01c296ced152dc4f10bd96e7d9bd933ecc95.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\0a1d01c296ced152dc4f10bd96e7d9bd933ecc95.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3472
- C:\Users\Admin\AppData\Local\Temp\Files\ExtremeInjector.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ExtremeInjector.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4560
- C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4996
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1388
- C:\Users\Admin\AppData\Local\Temp\Files\main.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\Files\main.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4500
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe69d5c728,0x7ffe69d5c734,0x7ffe69d5c740
        5⤵
        
        PID:6108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1620,i,13054370626550750905,8271472594728770510,262144 --field-trial-handle=2028,i,16008001845495193487,13898510798658282032,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
        5⤵
        
        PID:3760
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1796,i,18086288700164070337,12074210488553996780,524288 --field-trial-handle=2028,i,16008001845495193487,13898510798658282032,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1516
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2080,i,14649320798913704141,10185375908195221505,524288 --field-trial-handle=2028,i,16008001845495193487,13898510798658282032,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:13
        5⤵
        
        PID:2752
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2904,i,14051713308576413940,4438839876752536154,2097152 --field-trial-handle=2028,i,16008001845495193487,13898510798658282032,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3776
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2908,i,15658282563840023140,7341175750269715648,2097152 --field-trial-handle=2028,i,16008001845495193487,13898510798658282032,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3432
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4240,i,10344199189669063544,6027798585438336190,524288 --field-trial-handle=2028,i,16008001845495193487,13898510798658282032,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14
        5⤵
        
        PID:4340
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4240,i,701637922924337769,14344096488686741288,2097152 --field-trial-handle=2028,i,16008001845495193487,13898510798658282032,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5928
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5696
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe69d5c728,0x7ffe69d5c734,0x7ffe69d5c740
        5⤵
        
        PID:260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1692,i,8297621235899611985,1069554746415223119,262144 --field-trial-handle=2032,i,3651591313281011560,7044779993613686306,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
        5⤵
        
        PID:1744
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,5483245567177762440,17395225123692571876,524288 --field-trial-handle=2032,i,3651591313281011560,7044779993613686306,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5080
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,11801791558894691435,12209734369312382996,524288 --field-trial-handle=2032,i,3651591313281011560,7044779993613686306,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:13
        5⤵
        
        PID:3312
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2900,i,112179932804001270,12295159906702886806,2097152 --field-trial-handle=2032,i,3651591313281011560,7044779993613686306,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:724
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2932,i,2418282055055556249,6162008810014899304,2097152 --field-trial-handle=2032,i,3651591313281011560,7044779993613686306,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4876
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4220,i,13698999697323430472,3510048672583831723,524288 --field-trial-handle=2032,i,3651591313281011560,7044779993613686306,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
        5⤵
        
        PID:1392
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4284,i,12296652620559483549,15906177115139130447,2097152 --field-trial-handle=2032,i,3651591313281011560,7044779993613686306,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3404
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6044
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x100,0x134,0x7ffe69d5c728,0x7ffe69d5c734,0x7ffe69d5c740
        5⤵
        
        PID:1604
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1628,i,244500799187642137,1167799749053700260,262144 --field-trial-handle=2036,i,13173266450280401493,9974808774260489473,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
        5⤵
        
        PID:1732
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,702874426385591964,5461986130397583299,524288 --field-trial-handle=2036,i,13173266450280401493,9974808774260489473,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,4536512308332634638,16082652432754912781,524288 --field-trial-handle=2036,i,13173266450280401493,9974808774260489473,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:13
        5⤵
        
        PID:3716
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2920,i,1388750161724716176,14446420882709194183,2097152 --field-trial-handle=2036,i,13173266450280401493,9974808774260489473,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2924,i,5149784558381203732,5330731643892924243,2097152 --field-trial-handle=2036,i,13173266450280401493,9974808774260489473,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4240,i,13773098665352080308,172687060257463669,524288 --field-trial-handle=2036,i,13173266450280401493,9974808774260489473,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:14
        5⤵
        
        PID:2464
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4324,i,5292800629964486246,3715174897350022107,2097152 --field-trial-handle=2036,i,13173266450280401493,9974808774260489473,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1120
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Suspicious use of WriteProcessMemory
      PID:4304
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe69d5c728,0x7ffe69d5c734,0x7ffe69d5c740
        5⤵
        
        PID:2124
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe69d5c728,0x7ffe69d5c734,0x7ffe69d5c740
        5⤵
        
        PID:2852
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1616,i,8343758516260736104,6168406257734874516,262144 --field-trial-handle=2416,i,4020263334645083201,15849676251963103137,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
        5⤵
        
        PID:3104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,4343506546718972964,11199088227363478016,524288 --field-trial-handle=2416,i,4020263334645083201,15849676251963103137,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6020
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2036,i,6585499724574583096,9367869474672393714,524288 --field-trial-handle=2416,i,4020263334645083201,15849676251963103137,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:13
        5⤵
        
        PID:5444
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2908,i,4084706854494684539,2719015146604681490,2097152 --field-trial-handle=2416,i,4020263334645083201,15849676251963103137,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,12321302586914462346,12019132292388929965,2097152 --field-trial-handle=2416,i,4020263334645083201,15849676251963103137,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:904
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4272,i,15347238805093000767,14700240234575427949,524288 --field-trial-handle=2416,i,4020263334645083201,15849676251963103137,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
        5⤵
        
        PID:1336
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4312,i,13471553629170458743,13964011050637021883,2097152 --field-trial-handle=2416,i,4020263334645083201,15849676251963103137,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5124
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3460
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe69d5c728,0x7ffe69d5c734,0x7ffe69d5c740
        5⤵
        
        PID:1808
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1616,i,2991954109632005225,11073885905934616116,262144 --field-trial-handle=1976,i,15537658297817373000,18260849615650269328,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
        5⤵
        
        PID:5436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1152,i,2491050884964441715,6874802637625304637,524288 --field-trial-handle=1976,i,15537658297817373000,18260849615650269328,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4512
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,6880584362024724267,1810488346042288229,524288 --field-trial-handle=1976,i,15537658297817373000,18260849615650269328,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:13
        5⤵
        
        PID:5308
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2884,i,10122216877519028072,10986746318982697256,2097152 --field-trial-handle=1976,i,15537658297817373000,18260849615650269328,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4460
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,16208370876236313995,3173635415343911609,2097152 --field-trial-handle=1976,i,15537658297817373000,18260849615650269328,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2296
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4192,i,2594398528940363698,9655645690122050182,524288 --field-trial-handle=1976,i,15537658297817373000,18260849615650269328,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:14
        5⤵
        
        PID:2040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4292,i,86788290446565190,15991185358240069842,2097152 --field-trial-handle=1976,i,15537658297817373000,18260849615650269328,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3068
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:2984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe69d5c728,0x7ffe69d5c734,0x7ffe69d5c740
        5⤵
        
        PID:960
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:4816
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe69d5c728,0x7ffe69d5c734,0x7ffe69d5c740
        5⤵
        
        PID:2000
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1616,i,15918438003818867341,17142611854466800046,262144 --field-trial-handle=1988,i,640642898768684259,8625069873067534213,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:2
        5⤵
        
        PID:2728
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,16976240543465013305,1879878767032832428,524288 --field-trial-handle=1988,i,640642898768684259,8625069873067534213,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,1781832947871188238,3618109943419436178,524288 --field-trial-handle=1988,i,640642898768684259,8625069873067534213,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:13
        5⤵
        
        PID:3476
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2888,i,1813493363377688701,13690241674022604300,2097152 --field-trial-handle=1988,i,640642898768684259,8625069873067534213,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5164
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2892,i,331777758409625724,702805429692015965,2097152 --field-trial-handle=1988,i,640642898768684259,8625069873067534213,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2304
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4224,i,9503253634046610117,2252134963652939522,524288 --field-trial-handle=1988,i,640642898768684259,8625069873067534213,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
        5⤵
        
        PID:5940
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4360,i,14194747322231064399,17839460474656066988,2097152 --field-trial-handle=1988,i,640642898768684259,8625069873067534213,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5760
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:2548
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe69d5c728,0x7ffe69d5c734,0x7ffe69d5c740
        5⤵
        
        PID:4356
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:4696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:5224
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe81b5c728,0x7ffe81b5c734,0x7ffe81b5c740
        5⤵
        
        PID:5148
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1608,i,11069437753495020541,475895161200799042,262144 --field-trial-handle=2040,i,768844203405376440,5079131478941786548,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
        5⤵
        
        PID:5784
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1308,i,7678041111161384429,5436017012054195154,524288 --field-trial-handle=2040,i,768844203405376440,5079131478941786548,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1852
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,2341240451308861668,11320314280736072208,524288 --field-trial-handle=2040,i,768844203405376440,5079131478941786548,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:13
        5⤵
        
        PID:2372
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2884,i,1526032708767646369,13883111222761203225,2097152 --field-trial-handle=2040,i,768844203405376440,5079131478941786548,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2232
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2888,i,14094879024738387015,16571779254829792322,2097152 --field-trial-handle=2040,i,768844203405376440,5079131478941786548,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2952
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4224,i,4786488574277319308,426184866215066978,524288 --field-trial-handle=2040,i,768844203405376440,5079131478941786548,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
        5⤵
        
        PID:5004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4260,i,17895367388523494946,13310712555562287365,2097152 --field-trial-handle=2040,i,768844203405376440,5079131478941786548,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5856
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2432
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:3204
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe81b5c728,0x7ffe81b5c734,0x7ffe81b5c740
        5⤵
        
        PID:236
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:5952
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:4284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ffe81b5c728,0x7ffe81b5c734,0x7ffe81b5c740
        5⤵
        
        PID:972
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1616,i,11292670646572574232,2806141140503070803,262144 --field-trial-handle=2508,i,3945722455565540984,8651268805366956339,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
        5⤵
        
        PID:4308
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,14125815946528940011,15789736398699514930,524288 --field-trial-handle=2508,i,3945722455565540984,8651268805366956339,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5456
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,17547686535917870675,13120563079229964173,524288 --field-trial-handle=2508,i,3945722455565540984,8651268805366956339,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:13
        5⤵
        
        PID:3132
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2892,i,3465273353083345341,15276742052124940756,2097152 --field-trial-handle=2508,i,3945722455565540984,8651268805366956339,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5592
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2896,i,8173351337058689611,16737543998442409662,2097152 --field-trial-handle=2508,i,3945722455565540984,8651268805366956339,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1988
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4300,i,659764018550248881,17470701751505577988,524288 --field-trial-handle=2508,i,3945722455565540984,8651268805366956339,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
        5⤵
        
        PID:4504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4324,i,17894970584323200096,7113624054535590031,2097152 --field-trial-handle=2508,i,3945722455565540984,8651268805366956339,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4788
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:4768
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe81b5c728,0x7ffe81b5c734,0x7ffe81b5c740
        5⤵
        
        PID:2040
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:2068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ffe81b5c728,0x7ffe81b5c734,0x7ffe81b5c740
        5⤵
        
        PID:5308
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1612,i,5526372270847627879,2337767638316288567,262144 --field-trial-handle=2016,i,12023682177123883604,8233853016218984622,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:2
        5⤵
        
        PID:3108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1864,i,15239621859536283501,674674789964977113,524288 --field-trial-handle=2016,i,12023682177123883604,8233853016218984622,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5044
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2092,i,3877734225383880661,14180423804885998213,524288 --field-trial-handle=2016,i,12023682177123883604,8233853016218984622,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:13
        5⤵
        
        PID:5548
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2936,i,11187974609498492995,9751911369304899790,2097152 --field-trial-handle=2016,i,12023682177123883604,8233853016218984622,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3936
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2952,i,14235982559857070818,2882442668200137410,2097152 --field-trial-handle=2016,i,12023682177123883604,8233853016218984622,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,5854775158211418974,11717590371358165494,524288 --field-trial-handle=2016,i,12023682177123883604,8233853016218984622,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
        5⤵
        
        PID:1004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=2892,i,6346780041879949604,33456344637028499,2097152 --field-trial-handle=2016,i,12023682177123883604,8233853016218984622,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5952
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:3284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe81b5c728,0x7ffe81b5c734,0x7ffe81b5c740
        5⤵
        
        PID:2024
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,3868913848545279300,6106633457769843699,262144 --field-trial-handle=2452,i,7831694900605652118,4479864591338433036,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
        5⤵
        
        PID:6056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,17484463324372607294,8031950422255212237,524288 --field-trial-handle=2452,i,7831694900605652118,4479864591338433036,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3516
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,12539173822444541952,4037462082948042325,524288 --field-trial-handle=2452,i,7831694900605652118,4479864591338433036,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
        5⤵
        
        PID:6092
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2948,i,2759640520833946487,11158748675394079946,2097152 --field-trial-handle=2452,i,7831694900605652118,4479864591338433036,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3276
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2952,i,17387264576753414072,14254603100411462945,2097152 --field-trial-handle=2452,i,7831694900605652118,4479864591338433036,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5268
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4252,i,11680974013862168460,13300588940700762924,524288 --field-trial-handle=2452,i,7831694900605652118,4479864591338433036,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:14
        5⤵
        
        PID:4212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4284,i,5538324908311247865,11557964508370280089,2097152 --field-trial-handle=2452,i,7831694900605652118,4479864591338433036,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4548
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:3180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:4172
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe81b5c728,0x7ffe81b5c734,0x7ffe81b5c740
        5⤵
        
        PID:4536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,15074446299660292490,16468821113910986087,262144 --field-trial-handle=1992,i,15903163568167057815,18169730771051708212,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
        5⤵
        
        PID:2348
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1844,i,2591809419801094093,10213673732886023190,524288 --field-trial-handle=1992,i,15903163568167057815,18169730771051708212,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1344
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,8212661912754101431,274523109552625417,524288 --field-trial-handle=1992,i,15903163568167057815,18169730771051708212,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:13
        5⤵
        
        PID:1796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2908,i,3213069025757177742,7680489372419217354,2097152 --field-trial-handle=1992,i,15903163568167057815,18169730771051708212,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2372
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2932,i,11045761122436598849,9446518288319571723,2097152 --field-trial-handle=1992,i,15903163568167057815,18169730771051708212,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1300
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4228,i,5011864221490141743,7995472897727158516,524288 --field-trial-handle=1992,i,15903163568167057815,18169730771051708212,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
        5⤵
        
        PID:5132
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4124,i,11735626235765516039,14017052964384384093,2097152 --field-trial-handle=1992,i,15903163568167057815,18169730771051708212,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4608
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:4216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:2996
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe81b5c728,0x7ffe81b5c734,0x7ffe81b5c740
        5⤵
        
        PID:5312
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1616,i,17886623036439953749,16678632046246589914,262144 --field-trial-handle=2004,i,14108836387940904661,5196134934494823280,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
        5⤵
        
        PID:3736
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1844,i,3405433422915360968,14006834564222247419,524288 --field-trial-handle=2004,i,14108836387940904661,5196134934494823280,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5400
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2088,i,6666886854984765462,6876633820812991124,524288 --field-trial-handle=2004,i,14108836387940904661,5196134934494823280,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
        5⤵
        
        PID:5948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2884,i,15640978723508939885,9305965638637138532,2097152 --field-trial-handle=2004,i,14108836387940904661,5196134934494823280,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1780
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2648,i,13659795120011923488,12945312061048628981,2097152 --field-trial-handle=2004,i,14108836387940904661,5196134934494823280,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4696
- C:\Users\Admin\AppData\Local\Temp\Files\build.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\build.exe"
  2⤵
  - Executes dropped EXE
  PID:1404
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\64d28a91-60f5-444c-a170-cf16a92e7f96.bat"
    3⤵
    - Executes a command shell one-liner
    PID:2444
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3964
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1404
      4⤵
      Kills process with taskkill
      PID:1660
  - - C:\Windows\system32\timeout.exe
      timeout /T 2 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:4812
- C:\Users\Admin\AppData\Local\Temp\Files\remcosraw.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\remcosraw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3172

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3012

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5232

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6020

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a46870a4f28554c5509a47642c26ea22c1a78e05fb0f2dc74fed97e95994a6d9
MD5 506af1388af22dbe29616f39ea82bc4f
SHA1 9cff40cb637867de4dc78249328adafda4abf41e
SHA512 866f5b5c612958f2c3ed7dad6f23775e511c08b2d1dea6ee850f4c0aabca1ff7f59dfdc560fb41ed601c52c6436ffef557f055f81a1bd5cd77066bfe003fe327
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5a6085c2db4628b0573fea8d7d8bc1d2dcbec4837612acb49d2babedb6b528e7
MD5 8ea4dfbd91ac07a15dd9eb905d44b287
SHA1 bec4d2b1342b558002492ea82a1b9fea855a9bbc
SHA512 21acf1b397c734bb3aebd8693a094d4d8a85cc3bdca306c6aeb74a9fa1b6008c36438ab1cc0c897dc49a2cfb0d8e72957c65436c47607a5e0c038a375f8d31f9
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5XmD9B6nGyvn0bFT8pybJW4a:xC0ITo+TQ0InDUDwjPPbFT8pyby
TLSH
T172A10836A0684D774476D44AB1622A43CFB9706BE972AF94EADD0F0D24FB0EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a699be22cd99c97376035b0d3412a5930af8517595a42b1b3392a9aeb9baab44
MD5 7a073261575a9c174639504ad3f4a62b
SHA1 13b7e54f73646768787607e1ce8e900c4d69bbfe
SHA512 294e08251e6f1d059f2565856df1d9da88276d171b02b4c399bab71d146c600ac94bbc1f054331e719d06df187918e960a6bdb953a72c0013a242f6e3e4ed5bd
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5XmD9B6nGyvn0bKT8CybJB4a:xC0ITo+TQ0InDUDwjPPbKT8Cybv
TLSH
T181A11836A0684D774476D44AF1622A43CFB9706BE972AF94EAD90F0D24FB0EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 51bc49a1a815631dd1ac171e6ef6de5d7bee935dc3cf2bc1f9580d9d728a31e6
MD5 7b53d5e07e47fb26878a8bf5edabc394
SHA1 31bdec4f63687376886daed1d9403c13bec4c1f6
SHA512 e1724e8eaf7478dccba41113a78a35ee7226aace289eb08d48181785cccbe47ec5dcf7a3c96aa378a0a32c19f719a4630fdc17c8d68e52952828bbf5423b4a49
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5XmD9B6nGyvn0b4T88ybJv4a:xC0ITo+TQ0InDUDwjPPb4T88ybl
TLSH
T1D2A10935A0684D774476D446F1622A43CFB9706BE9B2AF94EAD90F0D24FB4EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 6126ce10a9f9642334b06393088266080a2384dd692deb84f7860cc7427bc445
MD5 db95cce1f71b7835f787d66db389337c
SHA1 423e18b18583d847878b86944eab68f219542cdb
SHA512 1a08f4350ec19f7fadb9f55cc5401d03f70e53bfd06003ca32994ed08c4e14d867141cd3be5420dd228092377f1c10fb4b4b799cf0ee26ac04b6887c362ffb15
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5XmD9B6nGyvn0bMT8uybJz4a:xC0ITo+TQ0InDUDwjPPbMT8uyb5
TLSH
T1ECA10935A0684D774476D446B1626A43CFB9706BE972AF94EAD90F0D14FB0EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f815788722ac0ee9226c1ca8fdf0d336e934d9bd095e2ee8b3599609e455080d
MD5 dff0313ff977200f4afb57ac66a821f7
SHA1 c76989d1e69a5785422883645b54a2fd1ce8ee1f
SHA512 f0fbf454ebda4049ed9b583e0dc3c46bf1e6d1071784983b82d291ce560a489d599487bcb11a5b8493710917bb6e2496185fd50d1649158672b87b8c0340a653
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5XmD9B6nGyvn0bwT8+ybJCL4a:xC0ITo+TQ0InDUDwjPPbwT8+ybY
TLSH
T1A9A11936A0684C774476D44AF1626A43CFB8706BE972AF94EADD0F0D14FB0EC1342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 dbb28223cde74031cef784ad727987417a14367847209464d62c983ae2c8a681
MD5 83ca3cc6267d0dd227b79ccd542b236f
SHA1 203b04d3b919f478c7303d84543d4b9f17e161bd
SHA512 0158e32ae77ac3debb9ffe4da830dfb827a1195b16680699099d3d06964d354f792fe386c17f894015b3632748a8018a41727d2fa6569d01cc9c8bebc36d9fa5
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5XmD9B6nGyvn0bHT8MKybJn4a:xC0ITo+TQ0InDUDwjPPbHT8pybN
TLSH
T140A10836A0684D774476D446B1622A43CFB9706BE972AF94EAD90F0D14FB4EC1342A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 eeabaeebb1648f030ff09ec103d95cdf84406b20451181d05d640634659eb434
MD5 544bbdce98d91ae298eb81e82769c31b
SHA1 a60dc6233f81a1cf53e8bd83d35f2a33ebd4ef4c
SHA512 8e367b614d87c63233c721f61d645952a1efe28e3a3d5cdad0616d0bf73c7048ea79c1d4be2efd9a25327818b8d4b0336befcff1ecb911c55fbeb60bb510d83f
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5XmD9B6nGyvn0bqT88pybJ94a:xC0ITo+TQ0InDUDwjPPbqT8Cybr
TLSH
T1EBA11935A0684C774476D44AB1622A43CFB8706BE972AF94EAD90F0D24FB0EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 6e3e11e194f3039e7f86cbd398e8b17af298bbd000e09de103623ddd42ecccbe
MD5 e83cbe3ba20d5bfd9dcf35a445001985
SHA1 ac1d826ed7595511a9896f03ced3798db73a1e1b
SHA512 dcc35466d7eca0c6d89d7443b972644f454201e730169263a9894b3352d506dc055dad3ed2aff7ed4dcef6c2575e1dbbaf2da864d07dfce0bc20c6122e92b2b9
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5XmD9B6nGyvn0bjT8iybJw4a:xC0ITo+TQ0InDUDwjPPbjT8iybE
TLSH
T135A11936A0684C774476D44AB1632A43CFB9706BE972AF94EAD90F0D14FB0EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e190a3be590d6da577e2ac6572c403edbf0dc8cbbd79a069775b58b06ceea21c
MD5 228c9a55f938d8575c110ff0b994335e
SHA1 29fd4ffa28936fc82ec7314cdc67002ab5cd4cdb
SHA512 66823dfd42bddcb85d8643356187f8ca7b15d907607a41e447e68acc8dbede1e5e51d38c203b0246025273a189a7928701f4ca09dd210fb9a11355700cd15a46
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5XmD9B6nGyvn0bWT8pybJNf4a:xC0ITo+TQ0InDUDwjPPbWT8pybTz
TLSH
T1D6A10936E0684D774476D446B1622A43CFB9706BE972AF94EAD90F0D14FB4EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7613cbe27559025729c9073a4123c6fc8280c282a19ff5e10ff472b7640bf02a
MD5 9c63e61e53f6b69a8304d6fc4376af9d
SHA1 9a29f347ee154b45245f69de9f3d3ec342202509
SHA512 dfeb551b23a01f4f216596cf270b668a7a5041aa297d2e89e4200fcf14ddfe9b255acb5ee25582f99b027aea6c008ec7dda46d35b8b45812acd66a0066012b55
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5XmD9B6nGyvn0bkT8SybJH4a:xC0ITo+TQ0InDUDwjPPbkT8Sybt
TLSH
T152A10836A0684D774476D48AB1626A43CFB9706BE972AF94EAD90F0D14FB0EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 76cc912d42200fef8a55c91f2c0e7bbeab9a03c99c28551fafb3a2e5cd2a3618
MD5 30320e66fdf958029f1ca2599383b7b7
SHA1 92841a4a964e6a64ea4f774903313177e1454f35
SHA512 2e29561bc6baf60a0a7b030f5e35f07bf82faffc9da6dd45e3edfd2fcda304ffdae554139c3afe89fec32d98aad4fe5c5ac817d9230ec725cadea4502be44e00
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5XmD9B6nGyvn0bpT8SybJ64a:xC0ITo+TQ0InDUDwjPPbpT8Syb2
TLSH
T1D0A11836A0684C774476D44AB1622A43CFB8706BE972AF94EAD90F0D24FB0EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 2b09826d3f908b1e002a7399b836555d4f92b4b58851163864a8b4040dcbc013
MD5 74686f3b64b2876dae287e7fc35e01b5
SHA1 3ed28f4342dc50f1c4e52b3e4ba0559b17a2f09e
SHA512 4d66c704e7e83337121e9054aebcf5e3bace6388db08c8dd416768af0f584a364f66a95554f06305f2bca9c6f2e26b425c3b6f0e3acb52c9d9c301ce6f9a24ea
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5XmD9B6nGyvn0bK4T8vybJu4a:xC0ITo+TQ0InDUDwjPPbJT8vyba
TLSH
T12CA1F736A0684D774466D446B1622A43CFB9706BE9B2AF94EAD90F0D14FB0E81342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

452cf171-5a92-4848-911b-8edbaebbd76a.tmp

Path C:\Users\Admin\AppData\Local\Temp\452cf171-5a92-4848-911b-8edbaebbd76a.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02.08.2022.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe
Size 234KB
SHA256 b565cea0200de0c7e65ce76a00899c548704e77b95aee9c7db0b7de044f9b578
MD5 a1a5102e42fe259698cf24122d2ad23a
SHA1 e3e9fd474b128faad4fa17c1ce5642cff14de725
SHA512 093310ddcd824efde9654b17fb267011873d87abef4d18adb480e755db6510e3d10cddde6a2a6937d11e6159f4f45e1bcee38079ea39a403394e49258ad8f735
SSDEEP 6144:/Mh1Jd2K/aCottwzDP+PJAjdQfHCtUIZNh:0ddrNotizKRGSHCtUMNh
TLSH
T16F34BD6AC5537DB6E1C02E3AB9FFE34A35712A73DA3A9B23C43B71E079E90904175214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a1d01c296ced152dc4f10bd96e7d9bd933ecc95.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\0a1d01c296ced152dc4f10bd96e7d9bd933ecc95.exe
Size 27KB
SHA256 716d698765e5bc3f936f7d28edc5b47839dfe8568a1311a57d2f8dbf73654b7c
MD5 dcf04df282f98a48203a51e9b79b4d46
SHA1 8b8ed92cbdffa9259bf55ca58735a7b9f9ad3722
SHA512 c7fdbbeb4bb9554430b349d2f7379c29630e521e4896d4dff13c9928df659e615b85f17b77f2440089ba17cd693c6271f78176ac8f8fe794a39c148481ab870f
SSDEEP 768:Y/0WS84xSf8JebY9c80FQr0BdpkvorjXego:Y/0nxGb85m9rjOj
TLSH
T141C21949ABE806A2E8BF0B356D72468647B2F0866523C74F09CD948B1FF779049127F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtremeInjector.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\ExtremeInjector.exe
Size 550KB
SHA256 e17bf83e09457d8cecd1f3e903fa4c9770e17e823731650a453bc479591ac511
MD5 ee6be1648866b63fd7f860fa0114f368
SHA1 42cab62fff29eb98851b33986b637514fc904f4b
SHA512 d6492d3b3c1d94d6c87b77a9a248e8c46b889d2e23938ddb8a8e242caccb23e8cd1a1fbeffee6b140cf6fd3ea7e8da89190286a912032ce4a671257bd8e3e28a
SSDEEP 12288:SQ5vTleU6iA6AiJ/uJxZjUXUxYcuORWETWOORGzbZr4QClJJRJAr6Ok:SQ5pexaALoXe4
TLSH
T14FC428DC759072DFC85BC872CEA91C64EA5034BB871F9203A0675AED9A4E897CF141F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fast%20Download.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe
Size 27KB
SHA256 345d5d2759abd08a84c4c2e2a337a1babd02b5eda3921db1b83eb5d5f5ccc011
MD5 97d80681daef809909ac1b1e3b9898ba
SHA1 f0ecc4ef701ea6ff61290f6fd4407049cd904e60
SHA512 f90bb8868612f5bc52c07cf90c4e62daf47ba3a3418fae3a82030bff449d62cd83ce185b22fdae632abdb661c8e3a725cc5fa5c44e47ca34f9ccbda6fafd21da
SSDEEP 384:YL1q6J1G4APO7l0j8YCYPPdR9MZAQk93vmhm7UMKmIEecKdbXTzm9bVhcaW6mr6s:mccEY6AZA/vMHTi9bD
TLSH
T12DC2F82D37B68232D1EE067E9562EA5043B5D04BF633FB0E4CD954DD4B1B38A0A41EE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\build.exe
Size 3.6MB
SHA256 8855b1f83a7e27bce8569c4daa9b7d61b775fac6170c9b466612690f5af7a091
MD5 234fb84a9ba904511148d7eae8815c44
SHA1 2fcd1cb06bd51a7e779ff42c0621ca8413c8d676
SHA512 4742d1c7c28bb0a66543ee9c8936fa65a35f99748963c42f718e51983340e0028b8536162ba2e2717df5a7e6d56e64e1858ffc3c133f86f408a8c3e003547a57
SSDEEP 98304:kikqXf0FlL9nrYAWAZi6sfLxkuahjCOeX9YG9see5GnRyCAm0makxH13:kikSIlLtzWAXAkuujCPX9YG9he5GnQCL
TLSH
T11006230073F8064AF2FF6F78A9715211AE36B6579477E64C1998109C0FB3B84AD21BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\main.exe
Size 10.4MB
SHA256 2443d1fe25f8afbd5b9cd95fdb45e7c6c5b688e815f44f93158e534308d9f9fb
MD5 9b3fafa68ef718b5b7bf3f1f46c698df
SHA1 cd2de4a0a94d42c278bab73d29d716369ec644f4
SHA512 a8f180bdf01a59a36e69708420774c2a8607869f8c34ae1e0d40b8298db3b9d88efd0251aa3444b9cdbadad1bf6d8b9d61fb270a41be18f81b10a0505b1b1f28
SSDEEP 196608:Cg9Yi0gXJnA1HeT39IigwTauDXURuACfdHXmbhPgfjvsAC:B9YiVG1+TtIiF2uARuACFXmbdgfi
TLSH
T166B63358A7E208F6F6F5963E827AC24DF265B5971764E6CF63A001024F376D14B3AF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remcosraw.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\remcosraw.exe
Size 513KB
SHA256 748c32e3718319e569d7a71eab5ace7589ed012764902b55475faab82a63c89b
MD5 c29ddb54bb464846ba7e2de1d3eff471
SHA1 49d293bee3fe99fbc0cf857347d9e5259dc41b94
SHA512 42b201b66dfdb6f8f5b7955a5ca7d951a08c669ed477a491c18c16e4a95eb0e5ca1b91e9b953c95a4977d99667b9bb3595d347576177b179518bd0301c3f4945
SSDEEP 12288:C97mmDmUefn1CvVkeClYRLwvcHk2c+IsPZOrys:ClxDmRnkvVkhYHk2c+DZe
TLSH
T122B4BF01B6F2C1B2DA7654300935E735CEBC7C21183699AB63D61D5BBD30291DB3ABB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\Crypto\Cipher\_raw_cbc.pyd
Size 12KB
SHA256 6ba9c910f755885e4d356c798a4dd32d2803ea4cfabb3d56165b3017d0491ae2
MD5 40390f2113dc2a9d6cfae7127f6ba329
SHA1 9c886c33a20b3f76b37aa9b10a6954f3c8981772
SHA512 617b963816838d649c212c5021d7d0c58839a85d4d33bbaf72c0ec6ecd98b609080e9e57af06fa558ff302660619be57cc974282826ab9f21ae0d80fbaa831a1
SSDEEP 192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
TLSH
T14E420A0BFAA449B9E017423AC0330A45E9B6BB147351A7DF137052962D737C2323D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\Crypto\Cipher\_raw_cfb.pyd
Size 12KB
SHA256 18d568c7be3e04f4e6026d12b09b1fa3fae50ff29ac3deaf861f3c181653e691
MD5 899895c0ed6830c4c9a3328cc7df95b6
SHA1 c02f14ebda8b631195068266ba20e03210abeabc
SHA512 0b4c50e40af92bc9589668e13df417244274f46f5a66e1fc7d1d59bc281969ba319305becea119385f01cc4603439e4b37afa2cf90645425210848a02839e3e7
SSDEEP 192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
TLSH
T190423A49F6E448B8F49B42BAC977464B9DB5B504235123CF0311909D1D73BC13B3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\Crypto\Cipher\_raw_ctr.pyd
Size 14KB
SHA256 4d86a90b2e20cde099d6122c49a72bae081f60eb2eea0f76e740be6c41da6749
MD5 c4c525b081f8a0927091178f5f2ee103
SHA1 a1f17b5ea430ade174d02ecc0b3cb79dbf619900
SHA512 7c06e3e6261427bc6e654b2b53518c7eaa5f860a47ae8e80dc3f8f0fed91e122cb2d4632188dc44123fb759749b5425f426cd1153a8f84485ef0491002b26555
SSDEEP 192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
TLSH
T1A5620A16E69044B9F667427888678B0FE6BEB4442352BBCF033192662E237C4333F791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\Crypto\Cipher\_raw_ecb.pyd
Size 10KB
SHA256 5d1c2c60c4e571b88f27d4ae7d22494bed57d5ec91939e5716afa3ea7f6871f6
MD5 80bb1e0e06acaf03a0b1d4ef30d14be7
SHA1 b20cac0d2f3cd803d98a2e8a25fbf65884b0b619
SHA512 2a13ab6715b818ad62267ab51e55cd54714aebf21ec9ea61c2aefd56017dc84a6b360d024f8682a2e105582b9c5fe892ecebd2bef8a492279b19ffd84bc83fa5
SSDEEP 192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
TLSH
T1E922D84DFE5188EAEA2982B885730F49F176B710172273CF1370952E1E627CB357A742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ofb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\Crypto\Cipher\_raw_ofb.pyd
Size 11KB
SHA256 d9fda05ae16c5387ab46dc728c6edce6a3d0a9e1abdd7acb8b32fc2a17be6f13
MD5 19e0abf76b274c12ff624a16713f4999
SHA1 a4b370f556b925f7126bf87f70263d1705c3a0db
SHA512 d03033ea5cf37641fbd802ebeb5019caef33c9a78e01519fea88f87e773dca92c80b74ba80429b530694dad0bfa3f043a7104234c7c961e18d48019d90277c8e
SSDEEP 96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
TLSH
T1B232094BFAE049BAE0164236C4734A09EAB6BA10B35177DF1370925B2D737D6323D395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\Crypto\Hash\_BLAKE2s.pyd
Size 13KB
SHA256 032b83f1003a796465255d9b246050a196488bac1260f628913e536314afded4
MD5 d54feb9a270b212b0ccb1937c660678a
SHA1 224259e5b684c7ac8d79464e51503d302390c5c9
SHA512 29955a6569ca6d039b35bb40c56aeeb75fc765600525d0b469f72c97945970a428951bab4af9cd21b3161d5bba932f853778e2674ca83b14f7aba009fa53566f
SSDEEP 192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
TLSH
T19D52074BE66445F9F91B41B881B35A0DA6BAB5006361B7CB036092AA2D237D1737F3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 034bb8efe3068763d32c404c178bd88099192c707a36f5351f7fdb63249c7f81
MD5 f24f9356a6bdd29b9ef67509a8bc3a96
SHA1 a26946e938304b4e993872c6721eb8cc1dcbe43b
SHA512 c4d3f92d7558be1a714388c72f5992165dd7a9e1b4fa83b882536030542d93fdad9148c981f76fff7868192b301ac9256edb8c3d5ce5a1a2acac183f96c1028b
SSDEEP 96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
TLSH
T10422F84DFA528CF6E91981B9C5770F4AF076B710572163CF2370962A1E623CB313A782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\VCRUNTIME140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
TLSH
T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_bz2.pyd
Size 82KB
SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
MD5 aa1083bde6d21cabfc630a18f51b1926
SHA1 e40e61dba19301817a48fd66ceeaade79a934389
SHA512 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c
SSDEEP 1536:CX8z7RFgpNVu5eYu00NI5OhgYNxx8bhm+uVIYCVH7Symxs:CszlF+uyIkNxebhEVIYCVHL
TLSH
T190839E93E3605AF5E45B92B9A6A04357E331BE49035093EFF75883162F13F813D6836A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_ctypes.pyd
Size 121KB
SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
MD5 565d011ce1cee4d48e722c7421300090
SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5
SSDEEP 3072:QjyeQXVhflFZtc/uTfLImTi6pX5DJIYLP0i:QGeI+/uTfLIm+cXxp
TLSH
T113C36B0B23581099EAA7807CC5B35F17C7B1B859171087CF02A4CAAD2F637A36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_decimal.pyd
Size 249KB
SHA256 980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278
MD5 c88282908ba54510eda3887c488198eb
SHA1 94ed1b44f99642b689f5f3824d2e490252936899
SHA512 312b081a90a275465787a539e48412d07f1a4c32bab0f3aa024e6e3fe534ac9c07595238d51dc4d6f13c8d03c2441f788dff9fe3d7ca2aad3940609501d273bd
SSDEEP 6144:E7W/Dmi0FD5KaN7VqqO9a3juVQt07Ou9qWM53pLW1AT3Otjm1+Br:L/Ki0FdVI9a3juKeqcO+Br
TLSH
T11C446C57A2490CA4DE738474D89B9B47FBB278854320C3CF03A48AA76F577A323B9744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_hashlib.pyd
Size 63KB
SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
MD5 b4ff25b1aca23d48897fc616e102e9b6
SHA1 8295ee478191eb5f741a5f6a3f4ab4576ceec8d2
SHA512 a7adcf652bc88f8878dae2742a37af75599936d80223e62fe74755d6bafaafd985678595872fb696c715f69a1f963f12e3d52cd3d7e7a83747983b2ee244e8a2
SSDEEP 1536:r5m8HQNUbaxjTvKzl9mjNLOjxNHeuNIYOIa7Syuxrm:r5m8H79mJOjPHeuNIYOIaum
TLSH
T174538E46A69544A4D96781B9CDA34F57E9F2F1001710ABDF0368C18D2F233C3ABFA766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_lzma.pyd
Size 155KB
SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
MD5 b86b9f292af12006187ebe6c606a377d
SHA1 604224e12514c21ab6db4c285365b0996c7f2139
SHA512 d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312
SSDEEP 3072:esdh8kZbsOb0Mt4zorT81qjznf09mNoqCPAaQVIYZ1Ncf:esdhBZbsm0hi78YOqtX6
TLSH
T122F33A92A394F4D5F7628C78D6624F17DBF678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_queue.pyd
Size 31KB
SHA256 3f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c
MD5 7f52ef40b083f34fd5e723e97b13382f
SHA1 626d47df812738f28bc87c7667344b92847fdf6a
SHA512 48f7723a8c039abd6ccb2906fbd310f0cfa170dcbdf89a6437dd02c8f77f20e6c7c402d29b922cdaabd357d3a33e34c3ad826127134f38d77a4d6d9c83371949
SSDEEP 768:R7Vej6rsdmxUnJIYQUA5YiSyvyAMxkEbF:R7LsdWUnJIYQUS7SyIx3F
TLSH
T1D1E29F83AA586C46C437C47594E25E39E876FA42570183EF2219C25D1F333427BBA765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_socket.pyd
Size 77KB
SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
MD5 b77017baa2004833ef3847a3a3141280
SHA1 39666f74bd076015b376fc81250dff89dff4b0a6
SHA512 6b24d0e038c433b995bd05de7c8fe7dd7b0a11152937c189b8854c95780b0220a9435de0db7ac796a7de11a59c61d56b1aef9a8dbaba62d02325122ceb8b003d
SSDEEP 1536:kHan8OG4wAM/Hh2JO9/s+S+pzpTzVs/tiTFVf77neJIYLw47Syt6xr:8an8OAF2JO9/sT+pzVVs/tYFVT7neJIh
TLSH
T1BE736B11A69011AAD2B3C07AC5634F23F774F4C1179597CF1264CA6E5F23782EE7AB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_sqlite3.pyd
Size 117KB
SHA256 ff6a2a2f38b21b7784f97d604c99961d8c07ef455f7908110a4e893835d42b76
MD5 68d89aaab48b82a7d76fb65e9c613a24
SHA1 b872497ebe4aba49025c9f836f4b2a3f1f033e5e
SHA512 5eec9169ab29c291010f0e171c3123552d8c68e943a615dc2f8e1ae75f809a54343572737279d9582b585997ed390af856f551dadeada85ae2f1aa908fc9b39c
SSDEEP 3072:+EgLOUA2h7LvTgi3CLl147ZvV9NdrRvdO5yRAui1BMJHMMTqg26bNIYOQzX:DwOAhHrgD5NGJHh7bX
TLSH
T1EFC34A27631810AAE5B741B8C5630A03EB35F461437193CF92A0C6891F777C3AF7AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\_ssl.pyd
Size 174KB
SHA256 ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678
MD5 0f02eccd7933b7a7c2bdedca2a72aab6
SHA1 0b4c551d8fe34d8128e5cf97daa19eb4c97db06e
SHA512 90a64082dab51380e05c76047ee40e259c719d7170fb4acb247b68a03b710461b350da3821b426fd13167895ded32f9c5ec0e07587ad4125683a18a3495f5ed5
SSDEEP 3072:mn5VVb4iZpIy+vgSf36XK7DapGB4JQELqOlh59YL48WKqgVl5pVIYC7Nb0CY:m5Vp4EaDD36XK7r4JkQY
TLSH
T10E047C47B59469B7E817E4FEC1230802EBB5F005331157CE49D6DA8A0F07746AEAAB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\base_library.zip
Size 1.4MB
SHA256 cc41b4f03c4adca6aa46223cd57f39b23a45e3fc21de217df0ca4f409437d546
MD5 18bc0b09751b5b52fbde8f7ddd7ddf82
SHA1 8b5899829110e730990ada7d0fe7899a96cc3fba
SHA512 363c188a443e0d7428f4d937c0cbbaccfbe04cff3dbf8d7d57e1fd842b0a07809d78b481fb880ba0b199b3d39ffda3e0e39578f5bcfcf322d45be0b5caea602b
SSDEEP 24576:mQR5pATGCfR5lUKdcubgAnyfbu36Uwjwh5dmzxP7aHHHY:mQR5pKfR3Kpn
TLSH
T1556509817982B5B7F804F3BB4026090DB328C5B4FB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\certifi\cacert.pem
Size 292KB
SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
MD5 50ea156b773e8803f6c1fe712f746cba
SHA1 2c68212e96605210eddf740291862bdf59398aef
SHA512 01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0
SSDEEP 6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
TLSH
T1E8547C964F269C052C9FE1C1CA9B1357DD3A027B99FEF0F1394A2448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\charset_normalizer\md.cp311-win_amd64.pyd
Size 10KB
SHA256 06032e64e1561251ea3035112785f43945b1e959a9bf586c35c9ea1c59585c37
MD5 cbf62e25e6e036d3ab1946dbaff114c1
SHA1 b35f91eaf4627311b56707ef12e05d6d435a4248
SHA512 04b694d0ae99d5786fa19f03c5b4dd8124c4f9144cfe7ca250b48a3c0de0883e06a6319351ae93ea95b55bbbfa69525a91e9407478e40ad62951f1d63d45ff18
SSDEEP 96:Y0fK74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFuCQAAZWQcX6g8H4a81:gFCk2z1/t12iwU5usJFKCyHcqgg
TLSH
T193220B0CFA6548D9DA164178C52B5E07F0B5B720172273CF43B0957B2FB63E6A93AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
Size 118KB
SHA256 1d9aba3ff1156ea1fbe10b8aa201d4565ae6022daf2117390d1d8197b80bb70b
MD5 bac273806f46cffb94a84d7b4ced6027
SHA1 773fbc0435196c8123ee89b0a2fc4d44241ff063
SHA512 eaec1f072c2c0bc439ac7b4e3aea6e75c07bd4cd2d653be8500bbffe371fbfe045227daead653c162d972ccaadff18ac7da4d366d1200618b0291d76e18b125c
SSDEEP 3072:3Ives1m094QtwqlaZTwuQMS/Pf+vGTVmEU:3PsQIJmE
TLSH
T1A5C3292653840076C667417E8CB75916CBE2B4910B3157DF05E4CA69AF03BE6BFBEB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
TLSH
T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\python311.dll
Size 5.5MB
SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
MD5 387bb2c1e40bde1517f06b46313766be
SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
TLSH
T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\select.pyd
Size 29KB
SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
MD5 e4ab524f78a4cf31099b43b35d2faec3
SHA1 a9702669ef49b3a043ca5550383826d075167291
SHA512 5fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee
SSDEEP 384:oG0ICxeeLn0XHqYK/57AvB0KJIYQGFHQIYiSy1pCQuRWAM+o/8E9VF0NyMl+:tieOGHqlGxJIYQGp5YiSyvHAMxkEN
TLSH
T15ED28F57AF646845D923C9B2ACE28E1ADE31B6924710C2CB3368C15D1F317C27BB77A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\sqlite3.dll
Size 1.5MB
SHA256 314bba62f4a1628b986afc94c09dc29cdaf08210eae469440fbf46bcdb86d3fd
MD5 89c2845bd090082406649f337c0cca62
SHA1 956736454f9c9e1e3d629c87d2c330f0a4443ae9
SHA512 1c467a7a3d325f0febb0c6a7f8f7ce49e4f9e3c4514e613352ef7705a338be5e448c351a47da2fb80bf5fc3d37dbd69e31c935e7ff58ead06b2155a893728a82
SSDEEP 24576:ozx+dvHgdXZW1s4gLLk56J0s3XyBh4mqWvqS/cm4ynZ3YSoXkMEKp:ApW1cd0s3CMmqWSS/ci3YSTk
TLSH
T118659C4BF2B801ADC0A7C1B9C91B570BEBB27405177497DB5594CA692F23FE217BA320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30242\unicodedata.pyd
Size 1.1MB
SHA256 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02
MD5 fd9132f966ee6d214e0076bf0492fb30
SHA1 89b95957f002bf382435d015e26962a42032cb97
SHA512 e35729abc45e5561aae1fb9e0e7c711dd7d3c1491520aa5c44fcc50c955f549f81d90897959327e930d02a5356afe08d6195adf002c87801a7a11235670639b5
SSDEEP 12288:bdYbfjwR6nbYonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD85U:RYbM10IDJcjEwPgPOG6Xyd4685U
TLSH
T195355BC9BB828D66D87B31B944D2212F1361C273476B133BB65513285C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp110.dll

Path C:\Users\Admin\AppData\Roaming\msvcp110.dll
Size 642KB
SHA256 59d3999d0989c9c91dae93c26499f5a14b837a0fe56e6fc29f57456f54a1f8a2
MD5 9bc424be13dca227268ab018dca9ef0c
SHA1 f6f42e926f511d57ef298613634f3a186ec25ddc
SHA512 70a1abb35bd95efc40af6653d5db2e155fab9a8575b7ae5b69ab3fbcd60925c66a675dac6cba57564a430e9b92f1a2ea9e912c4d7f356b82696ed77e92b52715
SSDEEP 12288:nJI8uppE72y/eXDUh+op+xzCLj+oOYRxUws:G8un/jUt+xzWj+oOY7U
TLSH
T143E49D9DAE2CE4B3E44B6473B10583E3D47D17B28D468A773F484E2D3A7A49643092E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1404-380-0x000001A18B9B0000-0x000001A18BD48000-memory.dmp

Download

memory/2228-0-0x0000000074982000-0x0000000074983000-memory.dmp

Download

memory/2228-1-0x0000000000AD0000-0x0000000000AD8000-memory.dmp

Download

memory/2228-2-0x0000000005610000-0x00000000056AC000-memory.dmp

Download

memory/2228-44-0x0000000074970000-0x000000007512C000-memory.dmp

Download

memory/2228-43-0x0000000074982000-0x0000000074983000-memory.dmp

Download

memory/2228-3-0x0000000074970000-0x000000007512C000-memory.dmp

Download

memory/3472-17-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/3472-45-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/3472-27-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/3472-29-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/3472-18-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/3472-46-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/3472-16-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/3472-15-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/3472-14-0x000001FC86F90000-0x000001FC86F9C000-memory.dmp

Download

memory/3472-13-0x00007FFE66FBF000-0x00007FFE66FC0000-memory.dmp

Download

memory/4560-42-0x0000000000580000-0x00000000005E5000-memory.dmp

Download

memory/4560-39-0x0000000000580000-0x00000000005E5000-memory.dmp

Download

memory/4560-37-0x0000000000580000-0x00000000005E5000-memory.dmp

Download

memory/6040-30-0x00000000000A0000-0x0000000000130000-memory.dmp

Download

memory/6040-38-0x0000000074982000-0x0000000074983000-memory.dmp

Download