c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
Size 82.5MB
Sample260818-e8l4ysej81
SHA256 c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d
MD5 89a92973fe92489862c359d94cbcae74
SHA1 216aa729af2c501dd4f54b2a9e6b0f84a4b3bd9e
SHA512 67746bbe5b7cf8f9d482615db77be6ab020aaf0ee76b5274c6ca300b17c8ff7e0a7488c253101ba7289e50034179bf03e5dc9cbb4d3242e4c43281348b31fa15
SSDEEP 1572864:St/cW4BFYK40QtX7uh9usaRkmYK8ROFfjVC1/EkVYo5g8N7hi2tZgQs:KEKKbQtX7uhx4kBKqAfjVGECYoa8NJtm
TLSH
T1271833137C855265CAAAD235D86682927720BC48973177D33F84EAF82E33BE25F39744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 28 IoCs

description	pid	Process	procid_target
PID 4240 created 5492	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	92
PID 4240 created 5748	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	117
PID 4240 created 4432	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	118
PID 4240 created 3328	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	121
PID 4240 created 3532	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	119
PID 4240 created 2768	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	122
PID 4240 created 2004	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	123
PID 4240 created 2508	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	141
PID 4240 created 1624	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	142
PID 4240 created 5748	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	117
PID 4240 created 5748	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	117
PID 4240 created 3328	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	121
PID 4240 created 3328	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	121
PID 4240 created 5692	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	94
PID 4240 created 1536	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	144
PID 4240 created 5864	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	145
PID 4240 created 3108	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	146
PID 4240 created 4576	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	147
PID 4240 created 4116	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	148
PID 4240 created 4740	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	151
PID 4240 created 2368	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	152
PID 4240 created 4120	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	153
PID 4240 created 4744	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	155
PID 4240 created 1416	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	156
PID 4240 created 1536	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	144
PID 4240 created 1536	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	144
PID 4240 created 3108	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	146
PID 4240 created 3108	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	146

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 4240 created 752	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	81
PID 4240 created 752	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	81
PID 4240 created 752	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	81
PID 4240 created 752	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	81
PID 4240 created 752	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	81

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2248	chrome.exe
3328	chrome.exe
3108	msedge.exe
5436	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315014528580728"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{4E731840-7BAC-4D6F-A9CA-337DD080EEAC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
5748	chrome.exe
5748	chrome.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
4784	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4784	chrome.exe
Token: SeCreatePagefilePrivilege	4784	chrome.exe
Token: SeDebugPrivilege	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
Token: SeShutdownPrivilege	5748	chrome.exe
Token: SeCreatePagefilePrivilege	5748	chrome.exe
Token: SeShutdownPrivilege	5748	chrome.exe
Token: SeCreatePagefilePrivilege	5748	chrome.exe
Token: SeShutdownPrivilege	5748	chrome.exe
Token: SeCreatePagefilePrivilege	5748	chrome.exe
Token: SeShutdownPrivilege	5748	chrome.exe
Token: SeCreatePagefilePrivilege	5748	chrome.exe
Token: SeShutdownPrivilege	5748	chrome.exe
Token: SeCreatePagefilePrivilege	5748	chrome.exe
Token: SeShutdownPrivilege	5748	chrome.exe
Token: SeCreatePagefilePrivilege	5748	chrome.exe
Token: SeShutdownPrivilege	5748	chrome.exe
Token: SeCreatePagefilePrivilege	5748	chrome.exe
Token: SeShutdownPrivilege	5748	chrome.exe
Token: SeCreatePagefilePrivilege	5748	chrome.exe
Token: SeShutdownPrivilege	5748	chrome.exe
Token: SeCreatePagefilePrivilege	5748	chrome.exe
Token: SeShutdownPrivilege	5748	chrome.exe
Token: SeCreatePagefilePrivilege	5748	chrome.exe
Token: SeShutdownPrivilege	5748	chrome.exe
Token: SeCreatePagefilePrivilege	5748	chrome.exe
Token: SeShutdownPrivilege	5748	chrome.exe
Token: SeCreatePagefilePrivilege	5748	chrome.exe
Token: SeShutdownPrivilege	5748	chrome.exe
Token: SeCreatePagefilePrivilege	5748	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4808	msedge.exe
4784	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
1536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 4784	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	89
PID 4240 wrote to memory of 4808	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	90
PID 4240 wrote to memory of 560	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	91
PID 4784 wrote to memory of 5492	4784	chrome.exe	92
PID 560 wrote to memory of 5084	560	firefox.exe	93
PID 560 wrote to memory of 5084	560	firefox.exe	93
PID 4808 wrote to memory of 5692	4808	msedge.exe	94
PID 4808 wrote to memory of 5436	4808	msedge.exe	95
PID 4808 wrote to memory of 2496	4808	msedge.exe	96
PID 4808 wrote to memory of 2496	4808	msedge.exe	96
PID 4808 wrote to memory of 2496	4808	msedge.exe	96
PID 4808 wrote to memory of 3268	4808	msedge.exe	97
PID 4808 wrote to memory of 3268	4808	msedge.exe	97
PID 4808 wrote to memory of 2136	4808	msedge.exe	98
PID 4808 wrote to memory of 4168	4808	msedge.exe	99
PID 4808 wrote to memory of 2136	4808	msedge.exe	98
PID 4808 wrote to memory of 2136	4808	msedge.exe	98
PID 4808 wrote to memory of 4168	4808	msedge.exe	99
PID 4808 wrote to memory of 4168	4808	msedge.exe	99
PID 4784 wrote to memory of 2248	4784	chrome.exe	100
PID 4808 wrote to memory of 5864	4808	msedge.exe	101
PID 4808 wrote to memory of 900	4808	msedge.exe	102
PID 4808 wrote to memory of 2644	4808	msedge.exe	103
PID 4808 wrote to memory of 3412	4808	msedge.exe	104
PID 4808 wrote to memory of 3280	4808	msedge.exe	105
PID 4808 wrote to memory of 5864	4808	msedge.exe	101
PID 4808 wrote to memory of 5864	4808	msedge.exe	101
PID 4808 wrote to memory of 900	4808	msedge.exe	102
PID 4808 wrote to memory of 900	4808	msedge.exe	102
PID 4808 wrote to memory of 2644	4808	msedge.exe	103
PID 4808 wrote to memory of 2644	4808	msedge.exe	103
PID 4808 wrote to memory of 3412	4808	msedge.exe	104
PID 4808 wrote to memory of 3412	4808	msedge.exe	104
PID 4808 wrote to memory of 3280	4808	msedge.exe	105
PID 4808 wrote to memory of 3280	4808	msedge.exe	105
PID 4784 wrote to memory of 1576	4784	chrome.exe	106
PID 4808 wrote to memory of 1428	4808	msedge.exe	107
PID 4808 wrote to memory of 3352	4808	msedge.exe	108
PID 4784 wrote to memory of 1576	4784	chrome.exe	106
PID 4808 wrote to memory of 1428	4808	msedge.exe	107
PID 4808 wrote to memory of 1428	4808	msedge.exe	107
PID 4808 wrote to memory of 3352	4808	msedge.exe	108
PID 4808 wrote to memory of 3352	4808	msedge.exe	108
PID 4808 wrote to memory of 3948	4808	msedge.exe	109
PID 4808 wrote to memory of 2576	4808	msedge.exe	110
PID 4808 wrote to memory of 3948	4808	msedge.exe	109
PID 4808 wrote to memory of 3948	4808	msedge.exe	109
PID 4808 wrote to memory of 2576	4808	msedge.exe	110
PID 4808 wrote to memory of 2576	4808	msedge.exe	110
PID 4784 wrote to memory of 4448	4784	chrome.exe	111
PID 4784 wrote to memory of 4448	4784	chrome.exe	111
PID 4808 wrote to memory of 2948	4808	msedge.exe	112
PID 4808 wrote to memory of 2948	4808	msedge.exe	112
PID 4808 wrote to memory of 2948	4808	msedge.exe	112
PID 4784 wrote to memory of 2900	4784	chrome.exe	113
PID 4784 wrote to memory of 3568	4784	chrome.exe	114
PID 4784 wrote to memory of 2900	4784	chrome.exe	113
PID 4784 wrote to memory of 3568	4784	chrome.exe	114
PID 4784 wrote to memory of 5592	4784	chrome.exe	115
PID 4784 wrote to memory of 5592	4784	chrome.exe	115
PID 4784 wrote to memory of 1808	4784	chrome.exe	116
PID 4784 wrote to memory of 1808	4784	chrome.exe	116
PID 4240 wrote to memory of 5748	4240	c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe	117
PID 5748 wrote to memory of 4432	5748	chrome.exe	118

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:752
- C:\Users\Admin\AppData\Local\Temp\c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\c22e1f7c93fdcc7a02f7a09ee5da92e93cd3ba7c636d34b5e3b6d67e2d84cd8d.bin.exe"
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\4b1093cc"
    3⤵
    PID:3008
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\0fba1e64"
    3⤵
    PID:2348
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\e83b92f5"
    3⤵
    PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\0fba1e64" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\0fba1e64 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\tasSnc\0fba1e64\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\tasSnc\0fba1e64 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffd72d8c728,0x7ffd72d8c734,0x7ffd72d8c740
    3⤵
    PID:5492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\0fba1e64" --force-high-res-timeticks=disabled --subproc-heap-profiling --field-trial-handle=1800,i,6398512467317104658,2549115435959560774,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1952 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\0fba1e64" --force-high-res-timeticks=disabled --subproc-heap-profiling --field-trial-handle=1800,i,6398512467317104658,2549115435959560774,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2184 /prefetch:13
    3⤵
    PID:1576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\0fba1e64" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1800,i,6398512467317104658,2549115435959560774,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1796 /prefetch:2
    3⤵
    PID:4448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\0fba1e64" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1800,i,6398512467317104658,2549115435959560774,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    PID:2900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\0fba1e64" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1800,i,6398512467317104658,2549115435959560774,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:3568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\0fba1e64" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1800,i,6398512467317104658,2549115435959560774,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3788 /prefetch:1
    3⤵
    PID:5592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\0fba1e64" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1800,i,6398512467317104658,2549115435959560774,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3808 /prefetch:9
    3⤵
    PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\e83b92f5 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2d4,0x7ffd6c40c188,0x7ffd6c40c194,0x7ffd6c40c1a0
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2508 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2476 /prefetch:2
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1724 /prefetch:13
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4168 /prefetch:1
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3380 /prefetch:9
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4304 /prefetch:9
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4436 /prefetch:1
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4868 /prefetch:9
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4960 /prefetch:9
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4440 /prefetch:9
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4964 /prefetch:1
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\e83b92f5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2480,i,11291491734289965868,504708094389748147,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:2948
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\4b1093cc" about:blank
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\4b1093cc about:blank
    3⤵
    - Checks processor information in registry
    PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xac,0x134,0x7ffd72d8c728,0x7ffd72d8c734,0x7ffd72d8c740
    3⤵
    PID:4432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1656,i,16640802738311451194,9496527817820938052,262144 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:3532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,13676215922050817216,6336632034207091093,524288 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,4722542491819569411,7524947279530033999,524288 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
    3⤵
    PID:2768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3008,i,9648113445912211713,9407737281718162456,2097152 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:1
    3⤵
    PID:2004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2996,i,12126174720278528722,16929328738257079474,2097152 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:1
    3⤵
    PID:6008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,12607290732427880324,11148557246189293596,524288 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
    3⤵
    PID:4832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5124,i,16022635923462759887,1334048896601940573,524288 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
    3⤵
    PID:1204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5188,i,14204800132004042964,15551007391407929111,2097152 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5176,i,13437407350025147882,10895043768962145470,2097152 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5268,i,14338726367239442222,12123838854499167772,2097152 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:4232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,4924619472356696103,3531136725628510637,524288 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:4624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5692,i,18057544549151914531,13722762797412380239,2097152 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:3556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5244,i,6092293756609475178,11623459681642743445,2097152 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:4452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,16771787899812395791,5887882877123517408,524288 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:4728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5744,i,8040679831378086074,12537422397422217101,2097152 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:2120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5796,i,18441255177920748317,10533156462455961659,2097152 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:5492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5136,i,14441028485847771331,16004103523685500476,524288 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:2644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5164,i,8993047429021592562,7297617309135281537,2097152 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
    3⤵
    PID:4912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4472,i,11950026679303657148,5223668707675341420,2097152 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:9
    3⤵
    PID:2508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3052,i,5350532543285199156,11016600985687046336,2097152 --field-trial-handle=2008,i,7965786298662392229,10165227699839040156,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffd6c40c188,0x7ffd6c40c194,0x7ffd6c40c1a0
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,17468579200505971051,6870988122411484755,524288 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1676,i,14581560041470580039,11853072906563755130,262144 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:2
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,12720788048363513547,13176245290884895579,524288 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2500,i,12592639571580151495,13523374820477772305,2097152 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,431080142552921116,16613636368067116150,2097152 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,3582431124720406054,6123051009034809235,2097152 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,6263098989541358626,656131172706595023,2097152 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:9
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,9172129130188493565,8261715797053436670,524288 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,5826199251631247842,4328939685427129070,524288 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,14407329812890116387,7553222294181985854,524288 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,14140141169237351126,3610853102910820895,524288 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,14140141169237351126,3610853102910820895,524288 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,1695117345886726686,17410164456213404047,524288 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,1348336651729205730,5114369882638083753,524288 --field-trial-handle=2776,i,10528942351905547153,7887419552052533157,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:5600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f88f9f8f-2e04-47fe-9754-78699e75566c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f88f9f8f-2e04-47fe-9754-78699e75566c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 103ee8a6ec5ea2552aeb815e42e0f565e7c355589050aced7f3f8ac202ae0712
MD5 e298ed4c7e52b178dad24a5f0fce8cbe
SHA1 a78b760c6115764dc82547c7e35f77ec3c762491
SHA512 66531f2915086d62054e178ac7936a958aadae696c45060ec743067bbd20be43111fe676e5ffde13d298fc055a08eb194725752e41a77ed62ba3be90c5669bc3
SSDEEP 192:rRRobCmkv7IvAPRp2l98Hsb+WNnuOPuFAkwnaykVyIsnAUge:rRmbPA86Xauw1PhHayge
TLSH
T1BD32D52EBE64797B5CCAC62AF9213743D7F5102161D42E84EBFC8A6C14E75CC222B11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 286d22fb1869e08f68a3a48539ae5987f75db562b103da000b238deb562d38bd
MD5 cb8e9ef4dff60242fbb9b32c01cebcec
SHA1 27c2a256bc08d27d33337e35bd4f69934f292a6f
SHA512 5d2d1b7d119ead1318f324920cbb54ae4a47287c07007caba999787074e5ff979bc6013c25ee887e1430debd20b7bab3ad7fcb8a689b446578a8b9cfccce0cca
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2HfgslN1XODmd+ErU3Gv3vHG8t2ru+gd:MKm97KxkXqKf/pUZNCgVLH2HfgsLROqH
TLSH
T15052F867684D9A7B0FD8C98CDC176F8BACB6025762780D2456FB5D0803A5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 9b6d5b8f441d675640a614146043d13c178240a0be42d3f8333fb133ea756920
MD5 d66bb4574ac7ee8781e55cdb5d2c27cd
SHA1 75ff7cdfedd6e58040728233d65c79fe06f7340a
SHA512 39f45226066dad8b248ee85f95ae47ef46a01e1bd580cd78dfbfbc01a05f81b094cb99022df0b14d28802d09c2a992cbaeb4d7ad4f7c891c601fa3e0fb096b6f
SSDEEP 3072:jZrFkKjkxP4NagXDrVGi02XhAo5IQSwo6VSO2wD+8Hp6pY6V6+:oE0gT3VGi6lSzrpQY6V6+
TLSH
T1DED312753D0D3E66EF23A6F1D1601D0B8FE0952A9B8CF0B76AE25F96C0575D22618433
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 80431eb0f6fe576b62c7ddbbce37a52c6181629bbec339dfb77aad14762e2e2b
MD5 a9ed5782a0738f516d3984e41e235f8b
SHA1 3f2aab617a13d6be4fcac1527e2f9f4daf092f70
SHA512 9f2b576f34d2574fd506d5fdbc25296b53e0693c3be98799df2b79df133b94ac9548427d29d81133e0dfc3ee039468d9e6917a47844057b3872ba0cbad96d34e
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok54aHDvB6eGyvkonO7ob1v4a:MC0HJm5FHuPgXDUD/ZW8nO7obZ
TLSH
T1F2A12AB1A4A94CB759B7D785F9833A83DEA4A2276990BF80D9DD1F0C11F31D81341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 52404156fab3c0767b416e02e26d7f3a9bba5c5bd0128da82b428616e3f18bdf
MD5 1d0c2607b7f7c2a131f66f71199f1996
SHA1 d5cf6a5b896bf2ea5506ca7452133d0ddf3a29bf
SHA512 c40d8e5b35f11ae6f49aa1493d4bbbec0c039865aad120c321b88f2613d789c740018b4b071caf00eace5e4b65a409b972750cb540288de8375052dd69811122
SSDEEP 192:sxRIR5C0/f0sR3xeZnu3zoD8pi/g6+WNIYCyuOJpGMIgV7J:sxRIG0/f0sRxYn4i/5IQJDf
TLSH
T11E32E9156D28A93B8CC7E30DFB65BF53D6F95032A1902E48EAFC861C14EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 82b910af80540e2481008630cdf412a876803b6eb282945b7ce0f2f13b59f89e
MD5 7879b3d3af857d4f44a2f12b0ada77e3
SHA1 3ed26ce1bccff72efd8ebfc4ea1e6ca2992eca12
SHA512 990788b5a006ad90e0818efb78421ddf88ed6127342aa9dfd8d2a8cf36c47a250fd0680ef250ebbc872bc70ef30c7f126ecad3c9e9c7ab6fb03517d08589d39c
SSDEEP 768:jC+vqN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFQ0Qqc0roZVI:jC+vq7E7JQWgQ+f4+u1jaGQ0Vcfw
TLSH
T14ED2EB7B640DCB7F4F804ADDEC197E9E6DA802CB9698CD4047FA941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 93c91e9ea4e099158eed78b1f915d7d2bb9f3018c086a368d32f62bb8bfa2da0
MD5 7ece65649d4202e31af5add6d5b81f9a
SHA1 da5acf3db86cf4011433fad75ec0d4460668fa07
SHA512 9d885ffa603aae206862bd2da625e7d326575320ba6e443c0698089131ece5afefed661cec23307283034da59ce82da37d7423140058669cacea590445b0489d
SSDEEP 768:v3IzhL3SaH5u5Op8+p3bd66j+4BRv86aLIWBTX9m6yMG:v3I93SrI8+p3Z6n4yzxm6VG
TLSH
T1E2F2AE72F8A59EB3DCE6DB85B2563743BFF4016385D01E94D8DD6B0E108719E270B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 927d0411abbae9e2cd488ecf710da9db5763e8e96b833969d8eb32c9e6234ae0
MD5 04cec415d02602b33f63fd52866b3686
SHA1 7bddafadc71cb0bb3e9704f8f7bdde41d0a70eb7
SHA512 c2a4c82ef5a103509f402b0f72638c20f446e30b71c097881c45fe37aa6d3c3677caa06aa0aaff1a2577cd64cef6440f18ff6f080ddd98f4da9028f4c193e283
SSDEEP 768:Irv+4UNbdD3Cc5VNp8+p3bd66j+4BRv86aLIio2bwCl1:Ibsbp3JL8+p3Z6n4yC0ww
TLSH
T11103BE33E8A899739CF6C648B24676437FF851A396C10EC4E4DD2B4E419A19E630B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 36d3ea38642a8be44694b65e26cd588169b422569185a00e054936ab9d277142
MD5 4f897220c9b3b37c23dc7e79141f967e
SHA1 470cc94a2f02d9ccf44f2f5480ab47bcb03d4b3a
SHA512 238ffeb1dc6cb2d6f1bb662cfdc6b1b519ced35e43b83cb6ef593523e4773e0335e943d9f37fd79356ea81963208a8a41efe41240aa479449466ab74729d7450
SSDEEP 768:rrv+4UNbdD390x5u5Np8+p3bd66j+4BRv86aLITB2bwCl1:rbsbp39jL8+p3Z6n4yM0ww
TLSH
T10003BE72E868A9739DF7CA44B2467B437FF851A395C10ED4E8D96B4E014B19E230B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e762516-7cea-4536-95f7-ec05bef64d05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7e762516-7cea-4536-95f7-ec05bef64d05.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

50bee94c-cd35-41a6-b10f-4f1ae1870865.tmp

Path C:\Users\Admin\AppData\Local\Temp\50bee94c-cd35-41a6-b10f-4f1ae1870865.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_546049193\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5748_173452758\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\tasSnc\0fba1e64\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\tasSnc\0fba1e64\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\tasSnc\0fba1e64\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\tasSnc\0fba1e64\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Crashpad\settings.dat
Size 280B
SHA256 6e06a53fae0061b7bf3c3c84a7a3ff99f16b669991e5b1743c9a1af0edb28c27
MD5 a774aa4ccbd2bba00ed77a65229f7327
SHA1 088fe61c9c7b32536ccfe066b3f93a5b58b0ce58
SHA512 a16a75e1c036c7f57f61d9fa95db4e4627c3694dde839c3045e5264f8deb0b537e02a5b85ff54096ab2f6704f770bc1f1f70ee1cccefba98e7cfa7786ab2396f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Crashpad\settings.dat
Size 280B
SHA256 7a5b11c5ccd6a8bd66a901560e81ae22942b390a8b2a923fb0e31db73a32f609
MD5 7bbfe82dbc807a37887c26cb4307dbfc
SHA1 1c39d22a74d772e2ea1482f238fc693cc04ff014
SHA512 3b4bebeb5b445b02d62bc5435b4d6bdbd6ec5b1fab39781ba7cce5b7cbc878b0471a3b50c67128815ee179b5cb9d4b207d7bee0e5f6f0485f78999eb8e81d88b
TLSH
T1A9D0022EB38C141BD0602A72B0746FFA6172FB884952A6F84065D89EDFE20F3D91718C
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

ARBITR~1.JSO

Path C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Default\ARBITR~1.JSO
Size 18KB
SHA256 4f80297878efc766ea56228d59d559df416d36f3911a2ee240ba81a4eb27ca0f
MD5 0a4dfb2ee74365913fccd8dd47c41600
SHA1 7b99062fdbc83cd072d84457ed071c549eb2dfa7
SHA512 778351717d71b5b21f9be013dc112f0596c1b667fa450e2913d413e56183d115379b04de51b6d6e456459ec0be7338db03924ad05c2e60192026a676e7ad0b8b
SSDEEP 192:vQeqfRR+nft0joCxc/i4utSfnwzjOq52ef8Hw54ecoaSbqG/I5zT85:vQeiKF0jojq4uGE18efsSraSbqG/H
TLSH
T1C392D251FD5B7D6F7BBAC0346A9468075CAA475EA870900AF2BCCD049FEDF240216D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

THE-RE~1

Path C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Default\CODECA~1\js\INDEX-~1\THE-RE~1
Size 48B
SHA256 df0c0be93b8ad36dc68f329e544f8226d9c01e33ea42db8ffa605b0f7526699d
MD5 528f7e7da08e2edeb432ea1348bf06d1
SHA1 2cac4c36a1cdf12392ada9fa4637d0bb2cd62942
SHA512 59263b4cb1cc6b99bf8fd74d21e703b54a1dfa6ec21b9d49924ff985df370ae5daf9cf6798a935d633ee61a555bc50098f9464fa27e3ccd23476c95a58c1b9d9
MD5 SHA1 SHA512

Submit Download

THE-RE~1

Path C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Default\CODECA~1\wasm\INDEX-~1\THE-RE~1
Size 48B
SHA256 5897f1151e4ba3e39beb98a259273eadd803d0e9541ba52bbe2537d817786c33
MD5 0e9e64ce36c1d7ef8de33c94e62c9167
SHA1 ff7e689f20dcd4f23d492fa958dd644b03128abb
SHA512 22153629ed52a7565f35d6077e2ecc83b34ec358adf61431765b93dbf9797368c4e39f71727f966d35f08ec2965b368feb49809b920e6575abfd2a1d89525bc6
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Default\DAWNGR~1\index
Size 256KB
SHA256 895c49bb938691ecb73283b56c3f804e81e95093a7647ba53a69d65d0c6c8689
MD5 c9c97db387c99ff00901a1faf4f2f1ed
SHA1 9556df753963fc445d5a968d550ab6aa3eee1dea
SHA512 0a03053f1900cee4aee42238c57b303e636f6f92201f3f11e9d51e75f26f39fd434d06ad5c4db36d70ecdd41da2a5eddccc1768f69c8a0e2a4fa609018a6c80d
SSDEEP 3:LstlNllklkXlYKll/:LsX3lPTt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Local State
Size 3KB
SHA256 a0641a07f159213367804748741f7d0d9c9dcf21e749c0d389cd743e6a4106f7
MD5 825937e06840db9a4a5970bf84351e2e
SHA1 2a1d9f1093ef62c708660f0dcaf39bbdb07549d9
SHA512 a2dd0c5fd41b4bfd7837991c488d2821acf45a00e59edffa87f50bfe2dc431db506e60ada9c51c5907a345e31b52ce409900be74c6742a716662370f3f72b251
TLSH
T1A68195736424EC278AE16AD4B58A35038E74D217E7597B9456DC232C06FF59CD30AC27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Local State
Size 4KB
SHA256 511bb513fc5e1eefffcd4765d24a4c4c884bb807302197dab2cdf36204216382
MD5 da8e57ff6d27bbcde44af0f9a7ecd275
SHA1 766dcb90ba0db32a2cb0a5c2074f1994af72f8d5
SHA512 12dbece6ebf49a159129234aff4bb3db604dad80f9c5431473b8935dc5dc26570c1b77a4e7c1251e2527aa0ebeb58f89a527557e21dfb2e465a55a1a11417ca0
SSDEEP 96:mqGNkvQsFfDCL6nV958Frh/cInURoDotovEWcDHBTuvaw0yN0eUcI7+SDS4SYSuV:tGNTWvaooDUwCh+0yN1I7l
TLSH
T18DA1B8776464EC274EE1AA84B58536039FB4D227E6987FD4D6DC261C06FF29C8306C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe593dca.TMP

Path C:\Users\Admin\AppData\Local\tasSnc\e83b92f5\Local State~RFe593dca.TMP
Size 1KB
SHA256 85158f64a721fe13e266a8676ba1ba66d2e023f5c171f97cc4f1bcbd912acfcc
MD5 72fd27ed2deed6badcea467d38f2bf5d
SHA1 1fcc2711280d1bf7c66d6afe2e67dcdaefc1bd78
SHA512 f25ab81518a6bb65f35b8ce1532575b46999d1d41870a5237588b5e7474012b92dc19b0ccb6003c71faa661a47ba9310d987e8eb7cb1249749375a51e24e3f13
TLSH
T12B31B571A464AC37E8A15795F3897B935EB0A1B8D2692ED802EC021915FB1CC830BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4240-691-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-741-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-311-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-310-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-306-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-303-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-312-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-304-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-302-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-298-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-297-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-296-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-689-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-276-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-695-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-694-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-696-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-701-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-703-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-704-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-702-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-710-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-712-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-711-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-718-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-720-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-717-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-719-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-709-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-705-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-20-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-21-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-19-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-313-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-747-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-746-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-745-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-748-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-754-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-755-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-756-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-753-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-761-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-764-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-763-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-770-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-769-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-762-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-757-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-17-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-18-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-16-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-15-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-14-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-13-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-12-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-11-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-10-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-9-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-8-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-7-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-6-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-5-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-4-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-1-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-0-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4240-1265-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download