c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
Size 83.5MB
Sample260818-eet8gafc32
SHA256 c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2
MD5 d4a9a4ae5a520501915e4c11b0b03cf0
SHA1 dfdff95d6b5a793f4bfefa97ecb48d77c45d38b9
SHA512 9d698f6b62ddfc237bab1e37a1793f28a61ad3177c13742d9446f71c0166fcb61b61430802adad6884674d969ef75c5128e4e3a9aca00b1a6f1ea3502370bbe0
SSDEEP 1572864:S16O3DUNlkC46yjuOW0bkMK6dkvJAzks/w3tZXHEEYtbcu+pRTInB:yb4Mh6Y1W0I9vJYkTzHERtbc/piB
TLSH
T11B183343BC8551A5DAAAE235C96642A27B20B84487313BD33F94EBF42E337D15F39790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 28 IoCs

description	pid	Process	procid_target
PID 2644 created 1436	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	91
PID 2644 created 4464	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	111
PID 2644 created 2264	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	112
PID 2644 created 684	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	115
PID 2644 created 1088	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	113
PID 2644 created 3120	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	116
PID 2644 created 3800	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	118
PID 2644 created 2112	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	136
PID 2644 created 1484	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	137
PID 2644 created 4464	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	111
PID 2644 created 4464	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	111
PID 2644 created 684	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	115
PID 2644 created 684	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	115
PID 2644 created 5096	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	92
PID 2644 created 2956	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	138
PID 2644 created 5272	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	139
PID 2644 created 4244	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	141
PID 2644 created 5108	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	142
PID 2644 created 3672	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	143
PID 2644 created 880	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	145
PID 2644 created 4728	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	146
PID 2644 created 2680	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	147
PID 2644 created 756	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	149
PID 2644 created 2912	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	150
PID 2644 created 2956	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	138
PID 2644 created 2956	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	138
PID 2644 created 4244	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	141
PID 2644 created 4244	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	141

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 2644 created 3168	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	80
PID 2644 created 3168	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	80
PID 2644 created 3168	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	80
PID 2644 created 3168	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	80
PID 2644 created 3168	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	80

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2376	msedge.exe
4108	chrome.exe
684	chrome.exe
4244	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314987568055828"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{8739EA64-EB15-4F30-B02F-DAB1FEBD22A6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
4464	chrome.exe
4464	chrome.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4168	msedge.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
2956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 5492	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	88
PID 2644 wrote to memory of 4168	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	89
PID 2644 wrote to memory of 1532	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	90
PID 5492 wrote to memory of 1436	5492	chrome.exe	91
PID 1532 wrote to memory of 5820	1532	firefox.exe	93
PID 1532 wrote to memory of 5820	1532	firefox.exe	93
PID 4168 wrote to memory of 5096	4168	msedge.exe	92
PID 4168 wrote to memory of 4804	4168	msedge.exe	95
PID 4168 wrote to memory of 2376	4168	msedge.exe	94
PID 4168 wrote to memory of 4804	4168	msedge.exe	95
PID 4168 wrote to memory of 4804	4168	msedge.exe	95
PID 4168 wrote to memory of 5476	4168	msedge.exe	96
PID 4168 wrote to memory of 5476	4168	msedge.exe	96
PID 4168 wrote to memory of 724	4168	msedge.exe	97
PID 4168 wrote to memory of 724	4168	msedge.exe	97
PID 4168 wrote to memory of 724	4168	msedge.exe	97
PID 4168 wrote to memory of 904	4168	msedge.exe	98
PID 4168 wrote to memory of 904	4168	msedge.exe	98
PID 4168 wrote to memory of 904	4168	msedge.exe	98
PID 5492 wrote to memory of 2268	5492	chrome.exe	99
PID 4168 wrote to memory of 3944	4168	msedge.exe	100
PID 4168 wrote to memory of 4248	4168	msedge.exe	101
PID 4168 wrote to memory of 3944	4168	msedge.exe	100
PID 4168 wrote to memory of 3944	4168	msedge.exe	100
PID 4168 wrote to memory of 696	4168	msedge.exe	102
PID 4168 wrote to memory of 1984	4168	msedge.exe	103
PID 4168 wrote to memory of 4248	4168	msedge.exe	101
PID 4168 wrote to memory of 4248	4168	msedge.exe	101
PID 4168 wrote to memory of 696	4168	msedge.exe	102
PID 4168 wrote to memory of 696	4168	msedge.exe	102
PID 4168 wrote to memory of 2780	4168	msedge.exe	104
PID 4168 wrote to memory of 1984	4168	msedge.exe	103
PID 4168 wrote to memory of 1984	4168	msedge.exe	103
PID 4168 wrote to memory of 2780	4168	msedge.exe	104
PID 4168 wrote to memory of 2780	4168	msedge.exe	104
PID 4168 wrote to memory of 1336	4168	msedge.exe	105
PID 4168 wrote to memory of 1336	4168	msedge.exe	105
PID 4168 wrote to memory of 1336	4168	msedge.exe	105
PID 4168 wrote to memory of 756	4168	msedge.exe	106
PID 4168 wrote to memory of 756	4168	msedge.exe	106
PID 4168 wrote to memory of 756	4168	msedge.exe	106
PID 4168 wrote to memory of 5156	4168	msedge.exe	107
PID 4168 wrote to memory of 5156	4168	msedge.exe	107
PID 4168 wrote to memory of 5156	4168	msedge.exe	107
PID 4168 wrote to memory of 5424	4168	msedge.exe	108
PID 4168 wrote to memory of 5424	4168	msedge.exe	108
PID 4168 wrote to memory of 5424	4168	msedge.exe	108
PID 4168 wrote to memory of 3300	4168	msedge.exe	109
PID 4168 wrote to memory of 3300	4168	msedge.exe	109
PID 4168 wrote to memory of 3300	4168	msedge.exe	109
PID 2644 wrote to memory of 4464	2644	c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe	111
PID 4464 wrote to memory of 2264	4464	chrome.exe	112
PID 4464 wrote to memory of 1088	4464	chrome.exe	113
PID 4464 wrote to memory of 684	4464	chrome.exe	115
PID 4464 wrote to memory of 1088	4464	chrome.exe	113
PID 4464 wrote to memory of 3120	4464	chrome.exe	116
PID 4464 wrote to memory of 3120	4464	chrome.exe	116
PID 4464 wrote to memory of 2744	4464	chrome.exe	117
PID 4464 wrote to memory of 2744	4464	chrome.exe	117
PID 4464 wrote to memory of 3800	4464	chrome.exe	118
PID 4464 wrote to memory of 3800	4464	chrome.exe	118
PID 4464 wrote to memory of 1284	4464	chrome.exe	119
PID 4464 wrote to memory of 1284	4464	chrome.exe	119
PID 4464 wrote to memory of 4360	4464	chrome.exe	121

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3168
- C:\Users\Admin\AppData\Local\Temp\c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\c110494170a5ebcb6a3d4b90f5677107780e1ac329552efaa1af8b5beb043cb2.bin.exe"
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\bd2720fa"
    3⤵
    PID:1092
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\18680d00"
    3⤵
    PID:1204
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tasSnc\2af013c4"
    3⤵
    PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\2af013c4" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:5492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\2af013c4 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\tasSnc\2af013c4\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\tasSnc\2af013c4 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ff8370fc728,0x7ff8370fc734,0x7ff8370fc740
    3⤵
    PID:1436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\2af013c4" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2384,i,6485155899811018787,1390661712833640402,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2376 /prefetch:2
    3⤵
    PID:2268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\2af013c4" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2384,i,6485155899811018787,1390661712833640402,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2412 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\18680d00 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\tasSnc\18680d00\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2b8,0x7ff82521c188,0x7ff82521c194,0x7ff82521c1a0
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2880 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2452 /prefetch:2
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2924 /prefetch:13
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4144 /prefetch:9
    3⤵
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4176 /prefetch:1
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4320 /prefetch:9
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4556 /prefetch:1
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4836 /prefetch:9
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4860 /prefetch:1
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4872 /prefetch:9
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4224 /prefetch:1
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\18680d00" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2492,i,14787126989813444416,4601896831982546755,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5376 /prefetch:9
    3⤵
    PID:3300
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tasSnc\bd2720fa" about:blank
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir=C:\Users\Admin\AppData\Local\tasSnc\bd2720fa about:blank
    3⤵
    - Checks processor information in registry
    PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8370fc728,0x7ff8370fc734,0x7ff8370fc740
    3⤵
    PID:2264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1720,i,10139897994801960292,8943951434669662264,262144 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    PID:1088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1880,i,3847574092208656928,10145233797918009875,524288 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
    3⤵
    - System Time Discovery
    PID:684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,15554548771228418195,8360239062587575126,524288 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:13
    3⤵
    PID:3120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,12344159643970995019,17622722603755227149,2097152 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
    3⤵
    PID:2744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,13637664147686783846,14737387925195919145,2097152 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:3800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,51362258338595571,11576914063792138011,524288 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
    3⤵
    PID:1284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5112,i,7355488418975769814,3087781601261490909,524288 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
    3⤵
    PID:4360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5168,i,600484573089580215,2359600180564836935,2097152 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:4492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5216,i,9495121965585740827,7534300748984165972,2097152 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:4652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5232,i,4607135757323486680,17917335228043549584,2097152 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,6189841791580943035,12047020366214238972,524288 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
    3⤵
    PID:4240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5468,i,13760510421389418835,7139392553615919470,2097152 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:5596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5604,i,15206946830574550844,487779491224962136,2097152 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
    3⤵
    PID:2872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5176,i,847065913697088593,14785821907417075186,2097152 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:2268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5580,i,12715138435765115527,1298943204854916411,2097152 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:4892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5208,i,11429232350653636042,12229683769310192519,2097152 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:1112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,12248708222260613355,5814502440536234769,524288 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
    3⤵
    PID:3696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,12551766036920096469,15640218369913703441,524288 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:14
    3⤵
    PID:4372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5324,i,2363772512365133193,2480875697643691582,2097152 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:2112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5104,i,17657867717068603682,11282853321919402287,2097152 --field-trial-handle=1976,i,12196512042214708133,5106180187119805235,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:9
    3⤵
    PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff82521c188,0x7ff82521c194,0x7ff82521c1a0
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,11576864836564330026,3749915430227462742,524288 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1920,i,12880919962801789286,11374598899918467869,262144 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,14779657720906373415,962402766846573915,524288 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:13
    3⤵
    PID:3672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,2590076320040634456,15765108818577642603,2097152 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,9627070787672009191,14574512380146645589,2097152 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,13658602751824141303,7517891981428562292,2097152 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,4012690007361837924,1304272946152285695,2097152 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,12891273427102845661,5600866490671483135,524288 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,7884919746877737871,1587498201937023279,524288 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,139654969299229615,3336798368724420294,524288 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,431807466303296868,15907732404955869287,524288 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,431807466303296868,15907732404955869287,524288 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,3765009033808413464,11916548580292931912,524288 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,16616150046483653696,251877249754825334,524288 --field-trial-handle=2504,i,5201946867469732090,17243545501512587543,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
    3⤵
    PID:1896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31ecd370-2965-46f1-8766-aaf87270d7d1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\31ecd370-2965-46f1-8766-aaf87270d7d1.tmp
Size 11KB
SHA256 ad7afe880659533cf85dd353e4be67eb4b270d0b39d595dff0a01664069e9948
MD5 5a303f2e83f4f104e87ced9f1cad7c47
SHA1 cbc17378dcc54abf78907b3ba1678d799d47617a
SHA512 612def70130815928ae08c1a72d38caba3711a9936c7b1c2103c49199b857e3f2856ee8d6b96ce92c1da24bbe7ab7da65c6c05282d7392999e8d3d4df461a104
SSDEEP 192:yRklAxt/v7zvAPRp2s9EHsb+WNnpRPqKD2z9nUkwza6iBVyIsnAUge:yRklQtX/6X7mwHPqM2z9UTanne
TLSH
T19F32952EAD15793B6DCED21AFA21B793D3F5102121A42E84EBFC893C25E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 f916a9549b572fda722b0f6cbd485b8ea47032de544165affc0521e18a1a678b
MD5 253cbe99ca9f22e7fdb1430779a9acf2
SHA1 8009812f7376291a5b51a5770b7c18270b43abe6
SHA512 503a2603831674dfef69b87fc70db7a07de29d3ee9a6b296934bda8aeeab66e2c141a4135846855cebccc47cfbbe6cf12fd1825cdd643d8eb132c38555e19892
SSDEEP 384:WQjZ07KxkXqKf/pUZNCgVLH2HfgsljhRXODZ8+ErU37JHG3pGYqF:WUZ07KxkXqKf/pUZNCgVLH2HfgsH1O1D
TLSH
T12D52F967684D9A3B0FD8D94CDC12AF8FADB5025666B80C2497FA5C1803D57CB114B2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 48f4dfdbd672965272e25473e26237282432b99b8887925648ca8f5297fc8047
MD5 e47c877e3558b969cba5fe17e6902077
SHA1 3159dbc0a642b044c6f38c003e14cfa87df62a0a
SHA512 180ee2b6d25f3211c9ae78cb6ce2dc28c7c684253d2f0a2fa4d1ba47b05019a88876099579fe05c49b1fc6d49cf072d9449e2f5abe0360f56138169ec85e24e0
SSDEEP 3072:sZrFkKjkxP4NagXDrVGi02XhAo5IQSwo6VSO2wD+8Hp6pY6V6Y:pE0gT3VGi6lSzrpQY6V6Y
TLSH
T113D312753D0D3E26EF23A6F1D1601E0B4FE0952B9B88E0BBAAD35F95C0975E21718432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d56b98e70f3f776adf724297f9da23328d2c20aa1ca849bfb60dbdeff42bc465
MD5 c23908528667401fdb3b1d718a871f74
SHA1 f3e32c1e0520cc43dbbeeafeeb6578c3f7185ee5
SHA512 b22655ffae6851e152c0a0b5eab6d7d470d39ecd729e60266584c7e2c0b5801568f6786d0a6daa27a6f19009db3efeeeb4409e75eee49847f9745f941c87dfdf
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5ulD3B60GyvnnXAlbKmb0v4a:xC0PtbKFKu00UUSb/iDUDexECXAlbK7
TLSH
T1D7A11B72A4698DB35979E549BD622A03CF75F12BAE229F54D9DD0F0C10F71E80342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9d0afe3b794514d20438687b765d239311fd1ad54dd35b7f8f4fcdb0b6c6b574
MD5 87b52bf231fa22848ef044da86ec6f6a
SHA1 828fc21b1feb990ca62803781949c2cf5d57094f
SHA512 8f3576bde7e6dac99399aa491d77f032e2774a8041d142705a33de2a4e395ef31b38581121a94f769a3a613f9066c93e1a46d95a4410b90e87b75c4b3dab23b0
SSDEEP 192:sxRURgCx/fFshoiZS+tzoA8pi/g6+WNIYZFLKGGnIgVqJ:sxRUdx/fFshokGi/5ISIc
TLSH
T1D332B8156D28AD3B4CC7E21DBB557F53D2F96132A1942E48AAFC961C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 da06f7d4130554effdc8c95fd77983488a91cb7fde892bb410fd76e89f7fc1ef
MD5 002d2e59732e89729ab2af8177488d6a
SHA1 d0ab87c47359cc66eb413aac3d2cc30a99e0b728
SHA512 24c10e68b723f5c5fcc92e084ade9ba79a3872a04d9ce7edeac4fd7c59f7802fc96cdc5d7a8a78bc17d328e9582b7b008fc3a385ff8747769fa785565dc9d821
SSDEEP 768:K80EP67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcoowLWnroLoHkb:K80EPSE7FwWgNhfVNu1ja/oogW0LoHkb
TLSH
T1DFD2D97B640DCB7E4F804ADDAC197E9A6DA802CB96D8C95047FE841C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ec7f586ff9dc08eb9448e10a9a562f9a6ca2d6f73616526c76f577294ab2039d
MD5 e42cafcd711017803973ff081a2460e9
SHA1 4e9e8b6b35247330c472ed79e2df053be12ce39f
SHA512 8cb2a6ed3b29ec9cd29a4c0ee1347ae70fcfa701b501b0c9d9bb19e997852cce90b4d851ed21a5d7c9873e5a519f2842e9f8ea1e9a4c686b09062d1416aa4038
SSDEEP 96:KRT8ZNbRRtWFKAg1tK4MgbtcjbylxWH+zC+4AwmWgFNg+mK4jg8mc2edsFnaKswV:CT8ZNbRRIFKR1nMgbCjbylxWH+zC+4Av
TLSH
T112911400357A06513C3EBA4C94A99D6ED3C174E33455E56BB7E901EA0F66E024EFCEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 df87540d63dc6a821587a2c7ea1e190da3a544fbce2149c60e58476c8f1d2916
MD5 2eaacc053dfbd381adf700d50fbe93d3
SHA1 9cc72dda946502f23924f9426292222cb8bb8ab8
SHA512 cc74e97fb256109da635f1464596470a246c88b35e376a8dcaf0dd4d960c0a919744faafe15d020cb5daba6dc4c9abca3ad92ce570e1743ee71f141851219c9f
SSDEEP 768:grv+4UNbdH3k1+LeSFOUWX4fouOToPvB2thtA9VAwieVH1SlX:gbsbh3Ysnnwthtt3EH1Y
TLSH
T14103CF32A8A88933EDE6D398720B75472FF4916396900BC49ADD1B4D079B9DD070BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 440533295ca0acf40ed4ffcea5d80dd1bcf544606c8daa7642e2e1d14d1b398e
MD5 4e074996707f24c8e2c9659f361fd574
SHA1 340dbb3e80ff6cb4e0cb687c974ec77da66e758a
SHA512 01f99a1cebeca7afa5472a7d859b4ca48959a32c6619c0bd11cd9453fa28a6ce8136b3176811ab4f6d3a09859ae7b05037e93eef8fbaf279061367dc0a56b895
SSDEEP 768:crv+4UNbdH33p+LeSFOUkd0X4fouOToPvB2thtA9VABXeVH1SlX:cbsbh3isnnwthttZEH1Y
TLSH
T10E03CE72A4AC8A23EEE6DB98720BB6472FF4516355D00F84DED91B4D06479DE070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8a6fee55ef5bb393e5b59c48819b64687addb29cb4a343e1307f65dbda7f9548
MD5 ff68d18fa548a4bde7ebd4619d2eb68a
SHA1 ac718bc74aebf87950058c79f9890d854374ff3a
SHA512 44faa64645567bd4e0e342b62da16ca9a371b12c61334cf078ff5b44ed407a480497c80a74eebd0df0b0434946015375b11b05f0123c5390757ff29ea997b197
SSDEEP 768:t3Izhf3WJ/+LeSFOUkd0X4fouOToPvB2thtA9VAgXTX9m6yMn:t3IN3WOsnnwthttuxm6Vn
TLSH
T1F1F2CFB1B8645D63EC96E798320B7297BFE0012394E02F98EEDD1B0E05475DE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

028e5327-119e-478b-b26c-185763c8b9d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\028e5327-119e-478b-b26c-185763c8b9d4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f16f12f0-3d3d-4a8b-a38c-bad15728b64c.tmp

Path C:\Users\Admin\AppData\Local\Temp\f16f12f0-3d3d-4a8b-a38c-bad15728b64c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2956_1565620357\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4464_468781988\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Crashpad\settings.dat
Size 280B
SHA256 7868e314c365c422d480821f5849cafeb77ad657a85f02f2451359755ffd0535
MD5 c6ad0339a9d51b9587503181a3096256
SHA1 c84931aff3ab7eb5216d5cca15bab45a00e99640
SHA512 391c1f9517c2c5b22b6251e212c273ae8e140d7c1c99808c9e218a1586ba46ba0ff0b534517d67addaee9bc8d6da969de0f174ee26bd49495e6883193cddf309
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Crashpad\settings.dat
Size 280B
SHA256 86f355308b29b5ae46a38502e33901bfeb7ae57b5ab4e74583e3591463ff75ad
MD5 c7ec3dabc2da4e974669c8058a6ce389
SHA1 9e200c8b8e9c1bb35c3471f7397d7251b08f73d7
SHA512 4755ea6695746b45981eb378615789c895a1b4fd34683b686fd3c6460fa77efe7f6cb8272ceba996971cd1e644168f3ad347f58dc2d61816416a21ecf3f11a29
TLSH
T196D022F0B300A0BCC008A23200F2CF080F0FC2E328CE00A2C83000088E03208E80A3B2
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

ARBITR~1.JSO

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Default\ARBITR~1.JSO
Size 18KB
SHA256 4f80297878efc766ea56228d59d559df416d36f3911a2ee240ba81a4eb27ca0f
MD5 0a4dfb2ee74365913fccd8dd47c41600
SHA1 7b99062fdbc83cd072d84457ed071c549eb2dfa7
SHA512 778351717d71b5b21f9be013dc112f0596c1b667fa450e2913d413e56183d115379b04de51b6d6e456459ec0be7338db03924ad05c2e60192026a676e7ad0b8b
SSDEEP 192:vQeqfRR+nft0joCxc/i4utSfnwzjOq52ef8Hw54ecoaSbqG/I5zT85:vQeiKF0jojq4uGE18efsSraSbqG/H
TLSH
T1C392D251FD5B7D6F7BBAC0346A9468075CAA475EA870900AF2BCCD049FEDF240216D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

THE-RE~1

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Default\CODECA~1\js\INDEX-~1\THE-RE~1
Size 48B
SHA256 b3399b409e797f477befbf1b55c45504424aa8726fed7ea7b889aa91165c9c14
MD5 24d97745857f2662f1f2a6dd901b7ee5
SHA1 aabd603a017c8da31711d69e6118a74fc3fc4f17
SHA512 7f2aea9d7a0a075361eec2175b587e1919a66f3edc64fc16bd8f77e446a4dbc9bb00dacd1757bba9880e160434d270a2c54287df5533213b9d8390630b13b037
MD5 SHA1 SHA512

Submit Download

THE-RE~1

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Default\CODECA~1\wasm\INDEX-~1\THE-RE~1
Size 48B
SHA256 a7c81c1515baed509e2bc4bb9547a67f8821b7fef42238fcabb470715c2e2fb8
MD5 3579380002ca4b6e53e15d666ec93cad
SHA1 04fe9a5e05116635771fd7d072c2eea97ac86fa9
SHA512 3b15f1677487e57b7cae6d005c68a72a3614051cd114e52076744a144607e7584edfbdaf50787077f499d4e9ce31714a29da19742fb0c5d301a6f7ca3c04b9f3
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Default\DAWNGR~1\index
Size 256KB
SHA256 863835ae3de551b44a37c039074c819452453ca7ced97f09543d0bf2efe47163
MD5 666b6dfa6740d392f62d6ba0245f7f56
SHA1 942c41e7ae21c5056206bd3f4529054eef5b5b98
SHA512 81bbec4ad30b98fc21a11a1ca2e364e5bbf601ed5c8384551527235e121f19254307b7ce79a5fc1c51242361697a611fe6ac0b1ee3cdbdd6b6fd29c570374074
SSDEEP 3:LstlNllklkXlCu/:LsX3lPj/
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Default\DAWNWE~1\index
Size 256KB
SHA256 b7e573afd7436d04cc7ac74419361b9224d6678779284b79e5abe68e2ba88255
MD5 08085e354c7451a82e60e05e4dcaa630
SHA1 a89c3bf3a2f042d5f0fa926bec8b233e5512f512
SHA512 63377c2fab21f0aa4379edad96d1078abdd630ada3e058394237caac3032c6cf22b890bb25ed5920986191f5e021202fce286a4719ae82b654847ef1467822c7
SSDEEP 3:LstlNllklkXlUXt/:LsX3lPS/
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEFAUL~1.JSO

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Default\DEFAUL~1.JSO
Size 8KB
SHA256 2e7a7f0b9bc75d0c3b20042b5027d5c2fa5d51565ddfa38ae863242b5d231550
MD5 1f2ae372fc4cbb3ea21331f7fdb3992f
SHA1 ce8823aff176eee15937b362606b033fbb353c0e
SHA512 031ed30270536d7b7396ad25a739e3c3dda311a4cc4d175a03848540e1cf90feb52e542364ebaed33fdbe994e3420533e748f9ad2a5e94ac263c6287fe0bacde
SSDEEP 96:RR2F2jKrEFYNSdJeRgPAn8XckvgGVFqAQ2ghEFq9Q2gERflbPER4q0IqoY0dwWtT:weggaRIskvFa9k87En4GpU7REH9z0YN
TLSH
T1F002AB7AD2215C7729B452AC9CBC4793F210137F5281880FB8BC656C4F7BA76A488F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Default\EXTENS~1\000003.log
Size 171B
SHA256 14f92b911f9fe774720461eec5bb4761ae6bfc9445c67e30bf624a8694b4b1da
MD5 e952942b492db39a75dd2669b98ebe74
SHA1 f6c4def325dca0dfec01759d7d8610837a370176
SHA512 9193e7bbe7eb633367b39513b48efed11fd457dced070a8708f8572d0ab248cbff37254599a6bfb469637e0dccbcd986347c6b6075c06fae2af08387b560dea0
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Default\EXTENS~1\LOG
Size 263B
SHA256 a7fc3d5331e9e4f76f69d7b1288ebaca62ef9e82fa5e265ba074dbe224b6af70
MD5 37b2a43d943577d8535a17454fd7c81b
SHA1 03e699030290703ae77ca5509ebe31fab30b62bd
SHA512 d47755a711da59e28c83d3982300327c3044ba7cd638f0094326dbeacaa864419194a2d4ae5c5f4e72793b997e76ad527097666316c5381802ad19b07ca562e5
TLSH
T13ED02B4744C6CA7D1D4884B3FAB05315C6A2744DBF9C36064B4DC88C318260CD4C2387
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Local State
Size 3KB
SHA256 60fc45e9ad6dabb26507ca6cd6480a8d11330b1eb8d78ca2e8249ed36f3eca3c
MD5 01c56dd374fcf9e2fadea6f3665ab8c4
SHA1 287f9adde5276a7b6b4dae06bffcae0195e83ec2
SHA512 22854563ec00efbf09930d25746c83cee21adfc190e618405cab94784d998bccd47a3521e88de7bab2a6fdf92c7f4de6d4dc42f49c58e6fc5617d611991023d6
TLSH
T15D81C673A924ED3749E1AA84B54635038F35E323E7A57B8856CC232C05FF56CA306866
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Local State
Size 4KB
SHA256 516fee87220ba5326fc983714784a8595eec95fe980ef2eebcb8e3d005f1dd88
MD5 b7e024bac179cb7f13bb175d536e0850
SHA1 86bdfbace574fabfe44e015bef420162ed9c0b4b
SHA512 83b684520f080d88386117a149ecf5943a92d7dbcee8caebfe1ed769c726bab4d6d5d236d7aca1c91480a27e8fab928dd780683caca6f81895cc0089f3526366
SSDEEP 96:kqGNkgQsFfanv4Xn58Frh/cInURoDotovIbcDGBIGtv3jNjw0eUcmSDS4SYSuSDJ:PGNMTA6ooDUwfWVjw1u
TLSH
T1A7A1B7736574EC2B4DE1EA44B48636035FB5E233E6987F88D6DC262C05EF2985306C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59f7d3.TMP

Path C:\Users\Admin\AppData\Local\tasSnc\18680d00\Local State~RFe59f7d3.TMP
Size 1KB
SHA256 b27e4fbaf49cb80c0bcb947a8aa80549b39cdf7757cfc1fffaaaec47d0c34a3d
MD5 b3b9bdd8c4eec089115d166afe2ee03c
SHA1 c3dac3f725f3a1dcc29d8febe581aa338b9249c1
SHA512 392eb67a75f3194b62d66ed2c01491c8f680860198658a094b6e91d5a1a4eda8fde6affffe1a1c753f060a88c6b131f80125cd8cf1fc350f316d342805436c6e
TLSH
T19C31B7F1A9687CB7E860970AA38A77A31F34B272D0A11F4C57ED012D15E718C631AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\tasSnc\2af013c4\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\tasSnc\2af013c4\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2644-617-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-673-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-246-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-247-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-245-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-241-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-611-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-613-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-614-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-615-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-0-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-619-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-616-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-621-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-623-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-625-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-630-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-632-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-637-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-633-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-641-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-645-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-643-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-644-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-646-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-652-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-656-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-660-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-661-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-663-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-669-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-668-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-676-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-242-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-240-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-667-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-662-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-658-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-653-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-651-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-642-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-631-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-238-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-232-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-230-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-229-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-221-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-21-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-19-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-20-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-18-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-17-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-16-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-14-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-15-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-13-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-12-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-11-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-10-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-9-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-8-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-7-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-6-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-5-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-4-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-1-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download

memory/2644-1200-0x00000001B0000000-0x00000001B0260000-memory.dmp

Download