a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
Size 84.5MB
Sample260818-e8slqsw1as
SHA256 a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9
MD5 f94c27a407ac87577036b90f0981815f
SHA1 1ca5b47ed93cdf9801ec0ff1ba70ab8f9ff091bb
SHA512 7e72ce71ccf47a6be1cc1dacd3034f685048a585e3ccdd2de044d5b16f33d144aa14c182d38ba5bdfe5966d8dd272eab2c9eff6be9d7212c73c3442c2af7587d
SSDEEP 1572864:Sq0R6DdmIvVZVpWJ/M5jCm11e/56uuq8owkkVLRwZDpvp5QcR31AIXg+vYEnpuc:BnDdDVZVkTm186hNVCZDBpZ1ALotR
TLSH
T1FE183313B88055A1C6AAE27984B692527720BC448B313BD33F95ABF42F737D15F3A790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 28 IoCs

description	pid	Process	procid_target
PID 4656 created 5448	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	92
PID 4656 created 1496	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	118
PID 4656 created 3184	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	119
PID 4656 created 3700	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	120
PID 4656 created 6000	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	122
PID 4656 created 5704	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	123
PID 4656 created 304	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	125
PID 4656 created 1052	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	143
PID 4656 created 3716	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	144
PID 4656 created 1496	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	118
PID 4656 created 1496	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	118
PID 4656 created 3700	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	120
PID 4656 created 3700	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	120
PID 4656 created 4684	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	94
PID 4656 created 1064	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	145
PID 4656 created 5688	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	146
PID 4656 created 200	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	147
PID 4656 created 1252	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	148
PID 4656 created 5448	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	149
PID 4656 created 6036	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	152
PID 4656 created 1580	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	153
PID 4656 created 5044	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	154
PID 4656 created 5816	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	156
PID 4656 created 6040	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	157
PID 4656 created 1064	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	145
PID 4656 created 1064	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	145
PID 4656 created 1252	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	148
PID 4656 created 1252	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	148

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 4656 created 5224	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	81
PID 4656 created 5224	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	81
PID 4656 created 5224	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	81
PID 4656 created 5224	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	81
PID 4656 created 5224	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	81

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4276	chrome.exe
2860	msedge.exe
3700	chrome.exe
1252	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315014740579324"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{C94F42E5-1354-4E01-A825-1F3C19F9C37D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
5832	chrome.exe
5832	chrome.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
1496	chrome.exe
1496	chrome.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
5832	chrome.exe
5832	chrome.exe
4824	msedge.exe
4824	msedge.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeDebugPrivilege	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe
Token: SeShutdownPrivilege	1496	chrome.exe
Token: SeCreatePagefilePrivilege	1496	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4824	msedge.exe
5832	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1496	chrome.exe
1064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4824	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	89
PID 4656 wrote to memory of 5832	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	90
PID 4656 wrote to memory of 2896	4656	a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe	91
PID 2896 wrote to memory of 1512	2896	firefox.exe	93
PID 2896 wrote to memory of 1512	2896	firefox.exe	93
PID 5832 wrote to memory of 5448	5832	chrome.exe	92
PID 4824 wrote to memory of 4684	4824	msedge.exe	94
PID 5832 wrote to memory of 4276	5832	chrome.exe	96
PID 5832 wrote to memory of 1420	5832	chrome.exe	95
PID 5832 wrote to memory of 1420	5832	chrome.exe	95
PID 5832 wrote to memory of 4152	5832	chrome.exe	97
PID 5832 wrote to memory of 4152	5832	chrome.exe	97
PID 4824 wrote to memory of 3780	4824	msedge.exe	99
PID 4824 wrote to memory of 2860	4824	msedge.exe	98
PID 4824 wrote to memory of 3780	4824	msedge.exe	99
PID 4824 wrote to memory of 3780	4824	msedge.exe	99
PID 4824 wrote to memory of 3292	4824	msedge.exe	100
PID 4824 wrote to memory of 3292	4824	msedge.exe	100
PID 5832 wrote to memory of 932	5832	chrome.exe	101
PID 5832 wrote to memory of 3956	5832	chrome.exe	102
PID 5832 wrote to memory of 932	5832	chrome.exe	101
PID 5832 wrote to memory of 3956	5832	chrome.exe	102
PID 4824 wrote to memory of 2600	4824	msedge.exe	103
PID 4824 wrote to memory of 4264	4824	msedge.exe	104
PID 4824 wrote to memory of 2600	4824	msedge.exe	103
PID 4824 wrote to memory of 2600	4824	msedge.exe	103
PID 4824 wrote to memory of 4264	4824	msedge.exe	104
PID 4824 wrote to memory of 4264	4824	msedge.exe	104
PID 5832 wrote to memory of 5508	5832	chrome.exe	105
PID 5832 wrote to memory of 4180	5832	chrome.exe	106
PID 5832 wrote to memory of 5508	5832	chrome.exe	105
PID 5832 wrote to memory of 4180	5832	chrome.exe	106
PID 5832 wrote to memory of 5148	5832	chrome.exe	107
PID 5832 wrote to memory of 5148	5832	chrome.exe	107
PID 4824 wrote to memory of 5636	4824	msedge.exe	108
PID 4824 wrote to memory of 5636	4824	msedge.exe	108
PID 4824 wrote to memory of 5636	4824	msedge.exe	108
PID 4824 wrote to memory of 3180	4824	msedge.exe	109
PID 4824 wrote to memory of 1128	4824	msedge.exe	110
PID 4824 wrote to memory of 764	4824	msedge.exe	112
PID 4824 wrote to memory of 4184	4824	msedge.exe	111
PID 4824 wrote to memory of 4652	4824	msedge.exe	113
PID 4824 wrote to memory of 3180	4824	msedge.exe	109
PID 4824 wrote to memory of 3180	4824	msedge.exe	109
PID 4824 wrote to memory of 4144	4824	msedge.exe	115
PID 4824 wrote to memory of 4104	4824	msedge.exe	116
PID 4824 wrote to memory of 4140	4824	msedge.exe	114
PID 4824 wrote to memory of 1128	4824	msedge.exe	110
PID 4824 wrote to memory of 1128	4824	msedge.exe	110
PID 4824 wrote to memory of 764	4824	msedge.exe	112
PID 4824 wrote to memory of 764	4824	msedge.exe	112
PID 4824 wrote to memory of 1712	4824	msedge.exe	117
PID 4824 wrote to memory of 4184	4824	msedge.exe	111
PID 4824 wrote to memory of 4184	4824	msedge.exe	111
PID 4824 wrote to memory of 4652	4824	msedge.exe	113
PID 4824 wrote to memory of 4652	4824	msedge.exe	113
PID 4824 wrote to memory of 4144	4824	msedge.exe	115
PID 4824 wrote to memory of 4144	4824	msedge.exe	115
PID 4824 wrote to memory of 4104	4824	msedge.exe	116
PID 4824 wrote to memory of 4104	4824	msedge.exe	116
PID 4824 wrote to memory of 4140	4824	msedge.exe	114
PID 4824 wrote to memory of 4140	4824	msedge.exe	114
PID 4824 wrote to memory of 1712	4824	msedge.exe	117
PID 4824 wrote to memory of 1712	4824	msedge.exe	117

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5224
- C:\Users\Admin\AppData\Local\Temp\a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\a2e2e529ced9867fa6edfca59f0b71a558aa01028d9691a57a4c628d80179ae9.bin.exe"
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\6797c9b9"
    3⤵
    PID:684
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\bc92ca97"
    3⤵
    PID:1456
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\48f572e0"
    3⤵
    PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\bc92ca97 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\tasSnc\bc92ca97\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2c4,0x7ffdb18cc188,0x7ffdb18cc194,0x7ffdb18cc1a0
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2564 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1408 /prefetch:2
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3020 /prefetch:13
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4076 /prefetch:9
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4052 /prefetch:1
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4336 /prefetch:9
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4424 /prefetch:1
    3⤵
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4468 /prefetch:9
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4540 /prefetch:1
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4340 /prefetch:9
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4724 /prefetch:1
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bc92ca97" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2536,i,13737757242236544062,14608983232431661915,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4316 /prefetch:9
    3⤵
    PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\48f572e0" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\48f572e0 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\tasSnc\48f572e0\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\tasSnc\48f572e0 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffdbacfc728,0x7ffdbacfc734,0x7ffdbacfc740
    3⤵
    PID:5448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\48f572e0" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1808,i,13903594064033849006,4737465545310775533,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1800 /prefetch:2
    3⤵
    PID:1420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\48f572e0" --force-high-res-timeticks=disabled --field-trial-handle=1808,i,13903594064033849006,4737465545310775533,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1988 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\48f572e0" --force-high-res-timeticks=disabled --field-trial-handle=1808,i,13903594064033849006,4737465545310775533,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2276 /prefetch:13
    3⤵
    PID:4152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\48f572e0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1808,i,13903594064033849006,4737465545310775533,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\48f572e0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1808,i,13903594064033849006,4737465545310775533,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\48f572e0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1808,i,13903594064033849006,4737465545310775533,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3752 /prefetch:1
    3⤵
    PID:5508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\48f572e0" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1808,i,13903594064033849006,4737465545310775533,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3780 /prefetch:9
    3⤵
    PID:4180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\48f572e0" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1808,i,13903594064033849006,4737465545310775533,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4532 /prefetch:9
    3⤵
    PID:5148
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\6797c9b9" about:blank
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\6797c9b9 about:blank
    3⤵
    - Checks processor information in registry
    PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdbacfc728,0x7ffdbacfc734,0x7ffdbacfc740
    3⤵
    PID:3184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1440,i,3312213320110710151,14041072493733294034,524288 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1648,i,11230377643199035488,15889319778623743692,262144 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:6000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,753903357461173487,11620167760221274924,524288 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:13
    3⤵
    PID:5704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3064,i,15074072536164430492,12062208840042716358,2097152 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:5236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3076,i,12198786434102957846,10962133667476389930,2097152 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4636,i,14413831357452626620,14141310196923759974,524288 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
    3⤵
    PID:1692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,9678496266172335763,17107593549540049090,524288 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:5216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5496,i,7724569944460240588,5387183203053988865,2097152 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:4184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5536,i,7728509523729428073,11491530189608474272,2097152 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:3960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5488,i,11629090587095268941,11108630741379333971,2097152 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    PID:1372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,16310492756508795243,12139062831958290673,524288 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
    3⤵
    PID:3352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5560,i,16923944165538918140,1410702665956262005,2097152 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:5976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6256,i,5419468588916680976,5880008789596505609,2097152 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
    3⤵
    PID:1064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6260,i,2842610438512894020,1959000630861440499,2097152 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:1176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6248,i,13731785071270355036,7629196343537740297,2097152 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
    3⤵
    PID:1428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6188,i,9648040575680043417,4136223174502943634,2097152 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
    3⤵
    PID:984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,12494637651297013148,17773722979605768637,524288 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:2560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,2469851649093176948,14475509885644058387,524288 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
    3⤵
    PID:3976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6520,i,1292597893078672304,3000585788966231940,2097152 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
    3⤵
    PID:1052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6548,i,1260206101281165035,1154100030502344543,2097152 --field-trial-handle=2028,i,11313809725019141474,14777548035120110118,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:9
    3⤵
    PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x274,0x7ffdb18cc188,0x7ffdb18cc194,0x7ffdb18cc1a0
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1656,i,4838000615494714778,3319597367855256350,262144 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,14319023192987240759,4837370673835769026,524288 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,10545734985906813073,1852437493087777967,524288 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:13
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,5181488646185724018,11565828762430478921,2097152 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,16491918695363553448,4463326129088062711,2097152 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,10978156802421003331,6698803813020895621,2097152 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,15432576273099962810,2132808879829130503,2097152 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,14218759246209918827,9327678330029405353,524288 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,14286679514101251075,9550872052164524521,524288 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,268556142073368527,14549742140934330038,524288 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,17113740032121956184,7293362362959579232,524288 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,17113740032121956184,7293362362959579232,524288 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,8557499168583681690,9738773421092678458,524288 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,1781890035344060647,4349342618601908218,524288 --field-trial-handle=2320,i,15054078641271613715,4182590107237997216,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
    3⤵
    PID:2724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5a380fb82d5d9486522430babfef9589863288e487689c319daed99583125ae5
MD5 b96456dfdb747454915e5e3fe9a83f25
SHA1 36c5e9e0880c0842659445dad3848cc450437286
SHA512 9ab4a44f9e7036ee2f1e3165e5c2d2471a29bfa17013c5b9bd6addfaf521dc6f00b6d48b362c3acc26f506294199f739480bbf9c922564575967d4c23334d717
SSDEEP 192:dRz/b4WLv7DvAPRp2X964Hsb+WNn+vPC+/af47AVyIsnAUge:dRzjJzH6XUbwKPva+Ee
TLSH
T1AB32B53EB924697BADCAC329F9617A53D7F5102225903E84F7FC962C14E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 202fc66af8c8515202db594913f42870760ec824559921b499618cd36bd971b4
MD5 a6ad7776b15257e8c052141a50065411
SHA1 eab75bb5ddd7b5fd999a948c0ccd2dd48d712240
SHA512 042bea91313e3adb61d44877b6f23d1191aab7a5b28774d80c0bca6311152efd0be18825adcb33f8e997a4ef782eb38c5c9bb679a7c2bc98e49474801a6088d6
SSDEEP 384:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzSXODxQ+ErU3J0HGj7RqPq:l/xQ7KxkXqKf/pUZNCgVLH2HfgsNAON3
TLSH
T1D7520967648D9A3F0FC8DA8CD8277F4FADF501576668092497FA9C0803E5BCA124A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 722988f8a3fc068f9813e10655fe7d04fe64ec6fcaccf593e2d1f24dafd6b954
MD5 b8ef0a311bc75d144a6ceb6aaa288e5a
SHA1 ad22eacc74483a85995e1887b2acc65dda778916
SHA512 f377c10d8b62545a22708e4bb678d56a15784984942b765b758a80773f41e93d1ae290601b14d30952fabd000124f155f238ac0354a727c6d77131d10c4e79d4
SSDEEP 3072:cZrFkKjkxP4NagXDrVGi02XhAo5IQSwo6VSO2wD+8Hp6pY6V63:5E0gT3VGi6lSzrpQY6V63
TLSH
T194D312793D0D3F55EF2266F1D2605D0B8FE0942A9F98F0B76AE25F95C0875D22A18433
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 27a97c4947a8565007d87a7ebd14e092c8276ca0c924f5d842ce7aa1b491bfce
MD5 df1c29174293b722b6e767ff21bc7b6c
SHA1 83970ea8d9aefd367d7d6dc6e0f5289aed380819
SHA512 2b9fc073d93a5fbe576575541b59c36831be02a103031f9fa0851f31291ad13c3aa386b99c79a02169f98586e402779c8d8c9d33c23fc8e25aa4aeb8e76ac9ca
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5uCDWB6/dGyv95S/ehbb2Jv4a:gC0LA/TE57cDUDZGUweSGhbKl
TLSH
T1F2A1F771B4A95AB75DB5D684F4827E83CF68A117AA227E80D8DC1F0C10E70EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2cd0ed86bcda63eb2e0fee851be311c240eb03da02651a897f9a9bc78cf2863c
MD5 f5fd2f94aa839ce9bacaf2e93dd53c0f
SHA1 ac03fedb0bb43c7a79df4395f8f2f64ec4d206b8
SHA512 ea4f65ac1af493a80eb2caeafbf381e8cd481f321d12d86e1b879150c97f38e6fc7263655332282e0828af81b988abee43103513d995bffcee46d8194ea42c87
SSDEEP 192:sxRaRTC9f/ffsKvkEZm4+jorzoA8pi/g6+WNIYn83hoG1IgVjNJ:sxRaw9f/ffsKvk63Ki/5ITRdd
TLSH
T1C332B8156A28A93B4CC7E25DFB657F53D6F95032A1D42E48EAFC861C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 601028a9532250c3714e19bca24320096c30402ec5bfdc537253b01f218a4328
MD5 d0707434c3793a8d8d72695403ba1aab
SHA1 c67b6381eb4e98836eabd12e26a5c0496cd290f5
SHA512 d740cec34989cde1fbf57eade0c47bcf24ff57b55d09bb8c1d69e69810b85887a86be55a02dfaa62c8cd3c067909e1b0dbc7f6d6fd816a8d90fbe5c6ca6096da
SSDEEP 768:wb8dgg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQpmu46kroh265q:wb8dgsE7r6Wgouf6Mu1ja7pmV6vNc
TLSH
T1C4D2DA7B740DCB7E4F800ADDAC19BE9F6DA802CB96D8C94447FA951C02C6BEA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0bf3e7e2d6c532b79fbe18546a9400aaa035115062a1881cfbf10e358f626fe0
MD5 47b4e7b2bf649c8ebe24cb856b311693
SHA1 09a2e567674fe660871157b7042a9ff83c9c7885
SHA512 175ff02b31c76a7dcd2b4e619565edaa1a5917f41cfd2a3e18a5b2d202c09057c5a15ecc24f04805442e4ef1371f362c559fe5cf38db2e432fc772a1ef60fb3d
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHwBUAyeSIWWLbgIIK4Ng6Icoob6XtWKOMz:CeTieYgQxAl+eODgc1W+9M+XHwBUAye/
TLSH
T107912140357613903DBF691C84AAD91BD68275633718F52B7BB801630BA7E466CFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 88f5ace6384001d97c10051f5a3cb54b6daa962ee6a1bcb978f71aa73587c9fc
MD5 299067475af8b913647b36d272d13039
SHA1 698a7333dd2a3004c5035a2d9634ab1168566e1c
SHA512 969ad149919e281e54234c3359ef711413336861c8c3221be193963951261831473dcc1febd196af864341039fa1e3020f538cc7bc6178e98640163ab9f1767a
SSDEEP 768:w3IzhE3BWDZIO0t9Nzc4ReyIsP5TX9m6yM4:w3I+3x9tc44bshxm6V4
TLSH
T10DF2AE75BC20AAA7ECE66B85B6077693BEF0102B80D83D98D9D95F0D09871DE135B422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8421cb7fe368b127617dca6362081baea4e8cf59abb987bb1ce34b21d32604aa
MD5 eb6ed5e352f05882f54385234c4c442a
SHA1 2c15c40f865e9b25cfb36443c76719cfe6a582d8
SHA512 2d97397553e3789aab05620a6ce959d5f05b93359a437ca20bb0570d8a28607b55b2db6e132975939b60b1841ac0b187320aedee8cd1307f4dba56b080820052
SSDEEP 768:6rv+4UNbds3ZoDZIO0toNzc4ReyIsXLeVH1S5D:6bsbS3Hotc44bs7EH1Y
TLSH
T14B03DF32A8788A77ACF66785B54776537EF8512BC2881E84C5DE5F0C4A8B1ED130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 172e9ca90aff1d5f41c2f7662b5f71feb61f2bc46bfea993681935342ec42e80
MD5 d5cf1696c6433b65dfce9465c03e8234
SHA1 311c4ad443d875687e745b7cf2c09ec37772480b
SHA512 125b6614d178b1defbfa8f19990fa7f9b6c1cbe3992a9c0b450fb385b7ebfe7f1af130ea01295956df028e56f4a5c415c9bebaf9eae7e0136b25c0f1070fed9f
SSDEEP 768:trv+4UNbds3ogDZIO0tlNzc4ReyIs25eVH1S5D:tbsbS34ltc44bsWEH1Y
TLSH
T19C03CF32A8389A73ACF66B85F44776433FF8212B81C81E94C8DA5F4D4A4B1DD031B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c686604-2541-43cf-9e6f-86a201720578.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0c686604-2541-43cf-9e6f-86a201720578.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7ae5d7c8-ef30-4b2c-837a-b007fce34459.tmp

Path C:\Users\Admin\AppData\Local\Temp\7ae5d7c8-ef30-4b2c-837a-b007fce34459.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1064_533474718\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1496_735672600\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\tasSnc\48f572e0\Crashpad\settings.dat
Size 40B
SHA256 fdfa4425f9496cd3e5660e4d5a3dfbe17997185fb5f92f7271a0b81836001f3c
MD5 ee8aac45b521d6014a1435041203aca2
SHA1 c906cb25479cafd53c2b3c0c604f714f3d053591
SHA512 3bb80f1ba1f23d191bd46cd29b3f326c86a0895fd0975ee806e12b07031c63f006e828edbb1a257e45051085b2999073dfb174b8a8e250ea496e707da077f4c3
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\tasSnc\48f572e0\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\tasSnc\48f572e0\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\tasSnc\48f572e0\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\tasSnc\48f572e0\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\tasSnc\48f572e0\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\tasSnc\48f572e0\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\tasSnc\48f572e0\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\tasSnc\bc92ca97\Crashpad\settings.dat
Size 280B
SHA256 58089cce4fef5bdb932946733fa139123d228ab47ef3447088f45a57146872fa
MD5 182dd2788416e909da6e101791426718
SHA1 6f6525b36d725e8f85d659af383fd9c438fc43c0
SHA512 144f8b04db9f04aac19fe62fbdce16f28a1e59b9a0ea077880130a989a0fda58c059037bf2c02bb2a8515d737f0594bf9dcef8fc2b638e69be5b077864850c04
TLSH
T1F1D02233BB8AB080E88320B300208320B220CCB0000BC3BA3C22B00A3C2C8C0E8002C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\tasSnc\bc92ca97\Crashpad\settings.dat
Size 280B
SHA256 aadf2223badc2be7ea7acfb6b983af9b67412cec14d250903808bcb8f2f9d83b
MD5 1014da3104947420eb8a33b9c35aa7c2
SHA1 0058390ba4938956284d316f101cb6fbc04b306d
SHA512 6919f5924ddfab56e4d111c822c9ed2910711c5c89cc7880126ec6601ebe747013417905d262a12cb84d156b40c634418363d906b68b01465b259f1d4cbade7e
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\tasSnc\bc92ca97\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

ARBITR~1.JSO

Path C:\Users\Admin\AppData\Local\tasSnc\bc92ca97\Default\ARBITR~1.JSO
Size 18KB
SHA256 4f80297878efc766ea56228d59d559df416d36f3911a2ee240ba81a4eb27ca0f
MD5 0a4dfb2ee74365913fccd8dd47c41600
SHA1 7b99062fdbc83cd072d84457ed071c549eb2dfa7
SHA512 778351717d71b5b21f9be013dc112f0596c1b667fa450e2913d413e56183d115379b04de51b6d6e456459ec0be7338db03924ad05c2e60192026a676e7ad0b8b
SSDEEP 192:vQeqfRR+nft0joCxc/i4utSfnwzjOq52ef8Hw54ecoaSbqG/I5zT85:vQeiKF0jojq4uGE18efsSraSbqG/H
TLSH
T1C392D251FD5B7D6F7BBAC0346A9468075CAA475EA870900AF2BCCD049FEDF240216D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

THE-RE~1

Path C:\Users\Admin\AppData\Local\tasSnc\bc92ca97\Default\CODECA~1\js\INDEX-~1\THE-RE~1
Size 48B
SHA256 022262c4d30c3669738eb47dfa90afe37c452d4f5f920613ea80a5e912011c99
MD5 8ba7793267c1acb88f9d2c03bd7ecd16
SHA1 c196249a26d1efa8b854b5c7d6dde5054809dd09
SHA512 baf532ffd585eb69005751c689230b9d1792d44a7cf5e07197eb93bdbfe90e394febba49fe0cf4c26dd8a76f7b8d05654ce72c321abdef281cdcc02966e49b4b
MD5 SHA1 SHA512

Submit Download

THE-RE~1

Path C:\Users\Admin\AppData\Local\tasSnc\bc92ca97\Default\CODECA~1\wasm\INDEX-~1\THE-RE~1
Size 48B
SHA256 34c1d82a20960340a5c504d24873348e10d82d96ae8f9dd3fe2717d84aee414c
MD5 e1d88a99c03b935e368c6b728af0587b
SHA1 cfe8603850e1f87ea148d33a0e28331bb2a32433
SHA512 ea1d975a9f6052c6f9861bee46c2088b252927683f886dc2a91d81a59deb96f0841c9069de5f779eaea9214e2939a54fd8715cc73aafb879c764c42101baefb4
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\tasSnc\bc92ca97\Default\DAWNGR~1\index
Size 256KB
SHA256 29a19841d110e80477515406b93502fe9168240a2794616f0ace048c6f91382b
MD5 f36cc1f9c8a909ec29ed96a23ac5d82c
SHA1 4d102e13eaa183b0060ea2faaf86f03acb6522b9
SHA512 a182b9e6067fdd840b942515b0242176c7df32882c13b130d912d4b0af095a58f9bd6843903d715a7ef8083ba71c2ac222d88b9373b3e24818cad3e181fcfb22
SSDEEP 3:LstlNllklkXlrESe:LsX3lPrEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\tasSnc\bc92ca97\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\tasSnc\bc92ca97\Local State
Size 3KB
SHA256 e61c169cfae38b98a7dbf4119716cabdfaead72da01da5cf6a009527dc4d00e0
MD5 1d27c8759b33aff2872841398d5d2731
SHA1 4d4436ea046dcd25244efcf96f1be6fe674466bb
SHA512 51fde3702ded4195bcc3e08154d4c811c40ef7e8dbea3be7c034d77e768f9b6e0a5fb742bc20be5b9399639493f598a60ddde6ec3d973f892f13f54c835bd2e6
TLSH
T1AA81A773A864AD7B9ED16AC4B48636038F78D223D6597B5055CC331C06FF56C9306C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\tasSnc\bc92ca97\Local State
Size 4KB
SHA256 033b65d896dcfd0bfb032d8d4a429458128936cc1311012de429738a18a19be8
MD5 074184500417528524dfc43663e5f511
SHA1 d034b772fd57c57d43d8e138c031430e5f093c68
SHA512 f4437b17b3d006bd0a2f6058098a3cc49205c7aca4eb0f12eb042779b35ada753c0f043b2cdffd694a9e5a7a41ebd68d9caa2b37ef295152ecaf9b19d1f35ab1
SSDEEP 96:brqGNktQsFffso+OoI58Frh/cInURoDotovXOqDRBeYvxTPorl0eUcvCSDS4SYSV:qGNNGKooDUwXnnzorl1g
TLSH
T130A1B873A474ED2B5EE1AE84B4C53603AFA89233E5887B94D5DC2A0C06EF69C5305C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59678a.TMP

Path C:\Users\Admin\AppData\Local\tasSnc\bc92ca97\Local State~RFe59678a.TMP
Size 1KB
SHA256 1bb4ed0612d482d9d94a559e6d7b9ae08aca9c2855a0b811bb96e90b3d72575a
MD5 dd324a00aa9012df27cb836e35514043
SHA1 649c3be8d25c48420dc0ceb851b571a191153897
SHA512 969b811bdc047dd0d13e2e964dcd539e3cc1f8dfb33bd561c1c64cb425b1fbd38fbedfcae170b9e2bc0fc85769a5d219fd03a928e2f10b1a778b1c0d8fed19c9
TLSH
T13031B7B2E86C3D77F9916A86B285B7836F3C1171C055364845DC26192BEB6DC221AC37
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4656-760-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-744-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-337-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-336-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-343-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-344-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-345-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-335-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-334-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-725-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-723-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-729-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-730-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-728-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-736-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-737-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-735-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-738-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-743-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-746-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-752-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-754-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-753-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-751-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-330-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-762-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-769-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-770-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-768-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-761-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-759-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-755-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-745-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-342-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-739-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-767-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-19-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-20-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-18-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-791-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-792-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-798-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-797-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-796-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-801-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-804-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-16-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-17-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-15-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-14-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-13-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-12-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-11-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-10-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-9-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-8-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-7-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-6-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-5-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-4-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-329-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-303-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-289-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-1-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-0-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/4656-1302-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download