8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b

Analysis

max time kernel
165s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
Size 694KB
Sample260825-ybbrhaybpc
SHA256 8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b
MD5 355d62a9acf70bd5e4cb19424154c452
SHA1 706bf073325fc9f28fb297d1aabef5ad66e95759
SHA512 cb5903d23b7f67743e9403f307d24c5ed044170b14960f25e164bcb6079ca25c841586a2a10e86f03f8522989adfd58a70a62798b0154da180ae1ff2d6133597
SSDEEP 12288:VVrl4B+DYVvjxWeCtgVPpkujOVDNoh2KA+VwX9FJ1lrm2xDMND/TzP6VZtranf5W:eB+UVv6tQEDw2f+VwXpjm6MNLSbhanfE
TLSH
T13CE40209F7E310EDE1778974C9A50662FB373D910390AB3F0261C676BF126A06E6CB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 4608 created 2744	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	100
PID 4608 created 3080	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	101
PID 4608 created 5660	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	103
PID 4608 created 5372	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	102
PID 4608 created 5536	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	104
PID 4608 created 1604	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	106
PID 4608 created 2948	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	107
PID 4608 created 2744	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	100
PID 4608 created 2744	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	100
PID 4608 created 5372	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	102
PID 4608 created 5372	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	102
PID 4608 created 5700	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	126
PID 4608 created 2932	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	127
PID 4608 created 1496	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	129
PID 4608 created 4184	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	128
PID 4608 created 4840	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	131
PID 4608 created 2352	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	133
PID 4608 created 3012	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	134
PID 4608 created 5024	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	135
PID 4608 created 5700	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	126
PID 4608 created 5700	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	126
PID 4608 created 1496	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	129
PID 4608 created 1496	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	129

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe"	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe"	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe"	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe"	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5700_937422682\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5700_1916323918\_locales\si\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5984	msedge.exe
5372	chrome.exe
1496	msedge.exe
6044	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321602428525893"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{246D781B-8126-4A9C-9F80-CF9C17C0F437}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1496	schtasks.exe
5556	schtasks.exe
4228	schtasks.exe
5872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
6084	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
6084	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
6084	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
6084	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
6084	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
6084	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
6084	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
6084	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
2744	chrome.exe
2744	chrome.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
6084	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
6084	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
5700	msedge.exe
5700	msedge.exe
5700	msedge.exe
5700	msedge.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
2780	chrome.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2744	chrome.exe
Token: SeCreatePagefilePrivilege	2744	chrome.exe
Token: SeShutdownPrivilege	2780	chrome.exe
Token: SeCreatePagefilePrivilege	2780	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
2744	chrome.exe
5700	msedge.exe
2780	chrome.exe
3824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 5556	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	89
PID 4608 wrote to memory of 4228	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	91
PID 6084 wrote to memory of 5872	6084	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	95
PID 6084 wrote to memory of 1496	6084	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	97
PID 4608 wrote to memory of 2744	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	100
PID 2744 wrote to memory of 3080	2744	chrome.exe	101
PID 2744 wrote to memory of 5372	2744	chrome.exe	102
PID 2744 wrote to memory of 5536	2744	chrome.exe	104
PID 2744 wrote to memory of 5536	2744	chrome.exe	104
PID 2744 wrote to memory of 5660	2744	chrome.exe	103
PID 2744 wrote to memory of 5660	2744	chrome.exe	103
PID 2744 wrote to memory of 1604	2744	chrome.exe	106
PID 2744 wrote to memory of 2948	2744	chrome.exe	107
PID 2744 wrote to memory of 1604	2744	chrome.exe	106
PID 2744 wrote to memory of 2948	2744	chrome.exe	107
PID 2744 wrote to memory of 4156	2744	chrome.exe	108
PID 2744 wrote to memory of 688	2744	chrome.exe	109
PID 2744 wrote to memory of 688	2744	chrome.exe	109
PID 2744 wrote to memory of 4268	2744	chrome.exe	110
PID 2744 wrote to memory of 4268	2744	chrome.exe	110
PID 2744 wrote to memory of 4820	2744	chrome.exe	112
PID 2744 wrote to memory of 4820	2744	chrome.exe	112
PID 2744 wrote to memory of 4208	2744	chrome.exe	113
PID 2744 wrote to memory of 4208	2744	chrome.exe	113
PID 2744 wrote to memory of 3756	2744	chrome.exe	114
PID 2744 wrote to memory of 3756	2744	chrome.exe	114
PID 2744 wrote to memory of 1112	2744	chrome.exe	118
PID 2744 wrote to memory of 5700	2744	chrome.exe	126
PID 2744 wrote to memory of 1112	2744	chrome.exe	118
PID 2744 wrote to memory of 5700	2744	chrome.exe	126
PID 2744 wrote to memory of 5708	2744	chrome.exe	119
PID 2744 wrote to memory of 3736	2744	chrome.exe	120
PID 2744 wrote to memory of 5708	2744	chrome.exe	119
PID 2744 wrote to memory of 792	2744	chrome.exe	121
PID 2744 wrote to memory of 3736	2744	chrome.exe	120
PID 2744 wrote to memory of 792	2744	chrome.exe	121
PID 2744 wrote to memory of 1844	2744	chrome.exe	122
PID 2744 wrote to memory of 1844	2744	chrome.exe	122
PID 2744 wrote to memory of 5360	2744	chrome.exe	123
PID 2744 wrote to memory of 5360	2744	chrome.exe	123
PID 2744 wrote to memory of 5928	2744	chrome.exe	124
PID 2744 wrote to memory of 3828	2744	chrome.exe	125
PID 2744 wrote to memory of 5928	2744	chrome.exe	124
PID 2744 wrote to memory of 3828	2744	chrome.exe	125
PID 4608 wrote to memory of 5700	4608	8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe	126
PID 5700 wrote to memory of 2932	5700	msedge.exe	127
PID 5700 wrote to memory of 4184	5700	msedge.exe	128
PID 5700 wrote to memory of 1496	5700	msedge.exe	129
PID 5700 wrote to memory of 4184	5700	msedge.exe	128
PID 5700 wrote to memory of 4184	5700	msedge.exe	128
PID 5700 wrote to memory of 4840	5700	msedge.exe	131
PID 5700 wrote to memory of 4840	5700	msedge.exe	131
PID 5700 wrote to memory of 1744	5700	msedge.exe	132
PID 5700 wrote to memory of 1744	5700	msedge.exe	132
PID 5700 wrote to memory of 1744	5700	msedge.exe	132
PID 5700 wrote to memory of 2352	5700	msedge.exe	133
PID 5700 wrote to memory of 2352	5700	msedge.exe	133
PID 5700 wrote to memory of 2352	5700	msedge.exe	133
PID 5700 wrote to memory of 3012	5700	msedge.exe	134
PID 5700 wrote to memory of 5024	5700	msedge.exe	135
PID 5700 wrote to memory of 3012	5700	msedge.exe	134
PID 5700 wrote to memory of 3012	5700	msedge.exe	134
PID 5700 wrote to memory of 5024	5700	msedge.exe	135
PID 5700 wrote to memory of 5024	5700	msedge.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
"C:\Users\Admin\AppData\Local\Temp\8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E58EE6C.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5556
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E58EEBA.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8f3fcc728,0x7ff8f3fcc734,0x7ff8f3fcc740
    3⤵
    PID:3080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,2863751318511174606,709159612815318411,524288 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1648,i,6133353013345212972,1565296665116688027,262144 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
    3⤵
    PID:5660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,8782763785788553748,5562385273631521045,524288 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:13
    3⤵
    PID:5536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3052,i,14364670825606105691,8736069415609283865,2097152 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
    3⤵
    PID:1604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3084,i,4405073225537396265,5438370261991357528,2097152 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:1
    3⤵
    PID:2948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,6666534459791319267,2274966707680888778,524288 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:4156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5356,i,8449695176681239759,6598514110470654512,2097152 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5464,i,4670951842141062430,17520968922694394266,2097152 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:4268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5424,i,4169120803349477170,9739325831259737788,2097152 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
    3⤵
    PID:4820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5712,i,14063401761592901415,11833794305488631562,2097152 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
    3⤵
    PID:4208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,2239252061287394049,12199085564143903066,524288 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
    3⤵
    PID:3756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6036,i,11952850614791069766,14066375630892967594,2097152 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:5700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5720,i,4053643223335288130,13712205066757235819,2097152 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
    3⤵
    PID:1112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,1920416818107295766,13339864950940363003,524288 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:5708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6136,i,7224738593474649706,3270432897475738335,2097152 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:3736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6072,i,7709631850881872883,5558157291547624822,2097152 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
    3⤵
    PID:792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,8587888694874937924,5309673231758970302,524288 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
    3⤵
    PID:1844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,11818822155379678438,6281985908275584538,524288 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    PID:5360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4932,i,11624495304735392400,8411721685561090400,2097152 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
    3⤵
    PID:5928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4928,i,12024461971633440848,6658145257394620597,2097152 --field-trial-handle=1908,i,12670763811647769659,7581387093670591358,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:9
    3⤵
    PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff8e55cc188,0x7ff8e55cc194,0x7ff8e55cc1a0
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1716,i,14687411479483037340,7131618226194115464,262144 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,8961703770914624656,1423871680547722603,524288 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,17092322898734999076,2787845410183930664,524288 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:13
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,5609906451255286245,2809970629733558567,2097152 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,10823245969649259997,5562873872780847509,2097152 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4040,i,11767278777550912828,6915573047847910174,2097152 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4112,i,17830029428780193583,14970156414687200564,2097152 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:9
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,16524091662690880423,4940245443554583240,524288 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
    3⤵
    PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,10319483577443485573,15425416174981129641,524288 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,9678194386601257826,2582804106555466765,524288 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,3414000994578100051,5347892937488488066,524288 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,3414000994578100051,5347892937488488066,524288 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,13822884619724688454,17012220415832685907,524288 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,16326181894015380077,10480497155021452210,524288 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,7719372313087777264,6500056832767492850,524288 --field-trial-handle=2608,i,80101387422722482,11010241883497727687,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:14
    3⤵
    PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\bd3f7553" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\polUpdat\bd3f7553 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\polUpdat\bd3f7553\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\polUpdat\bd3f7553 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x134,0xbc,0x138,0x7ff8eab3c728,0x7ff8eab3c734,0x7ff8eab3c740
    3⤵
    PID:5664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\bd3f7553" --force-high-res-timeticks=disabled --field-trial-handle=2216,i,11215150762683200089,5323208214633148193,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2244 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\bd3f7553" --force-high-res-timeticks=disabled --field-trial-handle=2216,i,11215150762683200089,5323208214633148193,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2256 /prefetch:13
    3⤵
    PID:1380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\bd3f7553" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2216,i,11215150762683200089,5323208214633148193,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:5792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\bd3f7553" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2216,i,11215150762683200089,5323208214633148193,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3116 /prefetch:1
    3⤵
    PID:5708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\bd3f7553" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2216,i,11215150762683200089,5323208214633148193,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:1032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\bd3f7553" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2216,i,11215150762683200089,5323208214633148193,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\bd3f7553" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2216,i,11215150762683200089,5323208214633148193,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3556 /prefetch:9
    3⤵
    PID:2484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\bd3f7553" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2216,i,11215150762683200089,5323208214633148193,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4552 /prefetch:9
    3⤵
    PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x2cc,0x7ff8eb18c188,0x7ff8eb18c194,0x7ff8eb18c1a0
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2068 /prefetch:2
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2116 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2836 /prefetch:13
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4296 /prefetch:9
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4292 /prefetch:1
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4388 /prefetch:1
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4424 /prefetch:9
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4472 /prefetch:9
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4492 /prefetch:1
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4484 /prefetch:1
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4572 /prefetch:9
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4836 /prefetch:1
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2076,i,10200539734296900079,5300360471102207429,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4172 /prefetch:9
    3⤵
    PID:5524
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\polUpdat\e73b22c6" about:blank
  2⤵
  PID:4408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir=C:\Users\Admin\AppData\Local\polUpdat\e73b22c6 about:blank
    3⤵
    - Checks processor information in registry
    PID:5948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\polUpdat\e73b22c6"
  2⤵
  PID:4228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\polUpdat\bd3f7553"
  2⤵
  PID:4360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0"
  2⤵
  PID:5600

C:\Users\Admin\AppData\Local\Temp\8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
C:\Users\Admin\AppData\Local\Temp\8b1e10c2b2534760b3b800b7b0830adc4bf8994a75730d4e5e72948984e24b8b.exe
1⤵
- Creates a file in the Startup directory
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E591D41.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5872
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E591D00.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 948634c9b54038285e15bee70ff6f058d6155018f0764ac5cc4222edd412a412
MD5 ea53674c3bde6be21b02195f6361e4b5
SHA1 6e51f9f6365c2fcec28324867654db00173b7cf2
SHA512 82a4496fbd9a8a31795410491ab04591d9adeb36f98b5d6700550e0502cb6bb6320bb6db4e40542b12b46219fa5f09a83d462e65090525c7cde5c401b0357ec8
SSDEEP 192:dReHb4RDv7DvAPRp2X964Hsb+WNnWNPJs2eseiHBVyIsnAUgR:dRe7e7H6XUbwwPC2es9nR
TLSH
T19A32A63EB965297BADCBD219F9217B93D7F6102221943E84E6FC892C14E7ACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 6d20d1b037addb046a9097371f96c96a3d8dacfe35413d25073a1e14ab5877c9
MD5 98134d56da30187eabd312842be25c9d
SHA1 6539f4412479efa5beab0396c7e8af4d1b028f42
SHA512 770fc692272a0840a8dfb79238cd07bd2da1d3d0d72362e3428994fe408e079690d7caa59f9d10ddf173218ee34f1ff07a17d7ae92dc487433764158c0244111
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OGdYVumLnUS:1nbZeMrv/hGtGdMnUS
TLSH
T10FD3764B3A743102EDE59A722CE050BB5D3CB16D4F55A5D428B620688EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 853ae86260f8c0660cf930c699c905a1cdd1d320ff237b2074cc48f4a89429a4
MD5 b9456d1d4696ccfb2993c7360e8ea18b
SHA1 494dfcd64cbbe7128b67d999ede692eebe738ce0
SHA512 a61b6d0e08284bedc082102386f14df022a7ac98958aed7727d165e779fc6aa7a10c2c56993d7056222eda18e01a719fc3cf3c4be00ecd52cfda2045cc48d05f
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5QCDRB6/dGyv95Szhbb2Jv4a:gC0LA/TE57cDUDznUweSzhbKl
TLSH
T199A1F871B4A95EB75D76C584F5827E83CF68A117A9226E80D8DC1F0C10E75EC2382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1b33edd72314591aea88567dfe2c9762f1fb7e43b5e69277eff25dda585a3340
MD5 7e38dbe61af885f35973f7973e9baa40
SHA1 5b9d9f66e29f22d72b01b80f748c9bbcd135c76a
SHA512 807a72aa504b107a17c2c61ab12753baa0e76dc560b28c75d279e1054a278be08f3384a21059eafdf14f3a78f76d58fe8fd77c739fcb4559c4c5a7b1b4ac90bb
SSDEEP 96:bC6xd+cAOIt5aDVmufj7VcZSl8h4otop5QpDRB6+Gyv9JtFiO0AuSwQSDzo0j9IH:bCqLA/TE57aiU2Cni+tFGSwQSDzoUZvA
TLSH
T1D4C11870B8AD7DB32EF68550F646BE83CEB4A067AA516E94C9ED4F0C11C75DC2342A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a2186e712b81f7fd4f961394bd99dd21436e7bdf06442adf1b830bd7329f290a
MD5 810ca700c70eae1a8c5863a27d642edf
SHA1 3750a96f23f8ea461ef36b08c9b384b668b3e391
SHA512 00377dd7e73addf380fdc6a6ad08c3015ad4f2e483ca3c8d8b3f2f8c8ebf3ef8e897bebcbfb5fc36b21cb0ce7b67626e2ee3dae163d05911736308b82bb6584b
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHm7KmgIIOW4tVgGOK47g0OcOGlkdLCKcEp:CdqjXNn7Oj4XfV+gBkldQzLkHm7KmgIT
TLSH
T1EA91320570B70244387EB61C86E8985AD6C17473315AE96B7BA801970FEBE029DFDBC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 4bea84932f0a0425488138541a35db1979ac44426ad599cf0fc4d3c830a66d68
MD5 f2889d4dc5bebefa5b06ab9811d28c4c
SHA1 38969d8ce1555f53e392dad1816dc2277500606b
SHA512 5540cc0c8e4ec829c5488ed49cca8c80849e3a8a682f03d267db66d6bc21900330018cb2fde44a4fd06c85dda248c6b8f217069d4fc3ea2b17759c23956a79ca
SSDEEP 384:DNrRZyCSDnxTIC8MEhIKyll7svbFKfk7:xFZJSDniAyI1l7svbF9
TLSH
T1D544630A7B747001EDE6D9725CB080771E3CB16E8F22A6925DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7c56ff98a577507e6621f8ff35396fb613c4a9bd58dbe56322e1b99cbef6217e
MD5 aa40e70947971a07083eee6803bc56cb
SHA1 36c9159bcb7fd7a3135b6c82045c4b20ef8e0cbd
SHA512 14c8d34c1f68ee9e4bb8310531eda841f54ac860cb44f5586193fb472e134215cd8576de567dba9be9cfb3b1e91b6f2625879b43ef6e7b03932a48b6ae8336b1
SSDEEP 768:Erv+4UNbds3oeDZIO00heLNzc4ReyIs2leVH1S5D:EbsbS3Lotc44bsuEH1Y
TLSH
T1F203CF32A878A973ECF69F86F00776537FF8612B81940E94C8EA5F4C4A4759D131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f7a96762ba88d4d13940a2ae9d637e171c0f11ea10b400fbb71dc7be927efab0
MD5 e2121ddd3cac25fde64763df01783a25
SHA1 a36ad81c33b3df0ec1731a358b7e079601599358
SHA512 318f51e1e2b0060828b28f8918c1518c897f1b4e52d00027b129e08222f8f1a2375202547b9d7a3b65d9f9079865d4cc9bc754b00d4a67cc26c0a479232d29ac
SSDEEP 768:6rv+4UNbds3MwDZIO0tNzc4ReyIsXneVH1S5D:6bsbS3Qtc44bs3EH1Y
TLSH
T1A503CF32AC789977ACF69685B50B36533EF8911B82D81E94C5EE2F0C464B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0530e97-798d-4b3c-810f-43b79969fd84.tmp

Path C:\Users\Admin\AppData\Local\Temp\a0530e97-798d-4b3c-810f-43b79969fd84.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2744_867827820\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

~st0E58EE6C.xml

Path C:\Users\Admin\AppData\Local\Temp\~st0E58EE6C.xml
Size 1KB
SHA256 d008c0bc6ccf99211cab286229eeb5dc0d2628be32908b46f0c33bc8de146142
MD5 863f94aad3bdf50ea365cd6fdcdcdab8
SHA1 7591763fb893f4f139aaa8e27a0937ce0a62f91f
SHA512 eceb978f075ad50e1ad63d51ee17a441e542ca948ef665787dd6921e39eb50cf5f7fde4a0311b7847da6071efa2add1c50aa8fc883b062875844d66fd062087d
TLSH
T1A3217C53ABFD121EF1F3AF5CAAF9645299B6FC615D25D42D00B0090D0532932C9B1B3B
MD5 SHA1 SHA512 TLSH

Submit Download

~st0E58EEBA.xml

Path C:\Users\Admin\AppData\Local\Temp\~st0E58EEBA.xml
Size 1KB
SHA256 2a4551c7b5d4f3175d0b84eb25d33f664591d561c25f2d5e91e76b4fe282b5b6
MD5 9fef24c5e738f52e845ba105e326ec25
SHA1 beae6a12eadbace058e5acdf975f7510cb1046e1
SHA512 38f057da5d30745d109cfe780763bd1a75776ba49c4d35473d05ba8db42f30fbd2d52f15386c9bce39d36b9f00e5d52559f768c5d724544bb2550cbcd210f689
TLSH
T1FD31C247ABFD161AF1F3AB5CEEFA645299BAFC556D10D82D00B0090C0532931D9B0B37
MD5 SHA1 SHA512 TLSH

Submit Download

~st0E591D00.xml

Path C:\Users\Admin\AppData\Local\Temp\~st0E591D00.xml
Size 1KB
SHA256 bed5a58d22b2d1957a49b8623f4f12c20dc08940427c801ae93dd685a747eea8
MD5 45664d5fba8bf040ce56237f6c8a3c33
SHA1 e60a7e2b367e325ea8d35d29fe3c542661926963
SHA512 48f744fa8d1e1dd28a8a772befbdf812a7ebccfeaa9df8b89d83a7ea3f66853f8462f5cbe3bd41c72f227dbf3828bca7cbc17d819b81b10ac0f8728a0bf6a86f
TLSH
T12D31B147ABFD161AF1F3AB5CEEFA645299BAFC556D10D82D00B0090C0532931D9B0B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\polUpdat\bd3f7553\Crashpad\settings.dat
Size 40B
SHA256 10d2667688a4045e744b183fef0f98133cccc946571bedab2d730607cd9c5b56
MD5 f3d4964d3cf45759d61bd0d879224c68
SHA1 a638afe9a59eed6613af6d9f1bb99c95a46c69f4
SHA512 f11411f5b9d3b31f0cb37081b0641d40d48130b352b8344e8cdfe4b08e777c786f8339b3ec66d2ff13333fe06b3cc33d4542be2416d2c7ae8b9794015279e552
MD5 SHA1 SHA512

Submit Download

ACCOUN~1

Path C:\Users\Admin\AppData\Local\polUpdat\bd3f7553\Default\ACCOUN~1
Size 76KB
SHA256 4f3e18eea355690c25b4de99b18e90f0c81cbb088228ffca12c84a53c6dff98f
MD5 b89fd902b32528a846212c73a9bfbe73
SHA1 b2bc3a06c5bf56df8b8245e2947e7f78fb6a416d
SHA512 ae387b21b2d3801abe3543f23d1705b51982e4f076c923cfee764f3ea525ce276d8360623be00d402ed7c804f801e36ba42b68d32a5f6e856e153d6b96ea750b
SSDEEP 96:pv+kOyOFXmT7i04MDDPtg3IM8n0ys5bSAoFLoeqclNz58rx2n:pln06Ca
TLSH
T15A73224A7A342505EDE28A362CF090F75D7C722D8F01A9412DA73028CDA5897F23A4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AFFILI~1

Path C:\Users\Admin\AppData\Local\polUpdat\bd3f7553\Default\AFFILI~1
Size 52KB
SHA256 4cb381b1a653296a38381f16bfd94dd09b9c900c0ed24eb532d372d647bcb96e
MD5 142456354ac4a1d7e89f037c2ebda0a2
SHA1 60b5e6036da7c3c1e4e10dc04c319e55cd125152
SHA512 cad919e47513bfbc050db3a996811643f5381ecbe3224c5ed34bf7dcfdec993d7a5e0af674f36625648866b4fad55578ab7427be38c17f6d9eb74403da02960d
SSDEEP 24:TL9VAlZGUWEKdPq9XUeS0z8jNvN2HhKroyr0d8D4BmhltoVOq6Uwccm5fBGQww:TbBzdPqJZSm86Uu8baVOlU1cWB
TLSH
T18F33DF061B685434C9ADD23498D90EE279B4126FD9D1E9A42DFC1D190FE04546CFD46B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\polUpdat\bd3f7553\Default\Cache\CACHE_~1\data_0
Size 44KB
SHA256 468456974fd86b33647942820dce7284879acfab9e9e6eca008e1fdcf9006fb5
MD5 d1f604157b0745a40453afb93a6caa42
SHA1 3d5d77429b03674ebb0ba34d925ba1b09310df5e
SHA512 0644ce93724a57dedd8aec208e5a038e323a1b9871d5046d58a87c60479626693e6c8f25b7c7f7b60fd35aac133d2e660ecbd8f8d579ad1fc6703ae117a485a0
SSDEEP 3:MsFl/ll+l:/FE
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\polUpdat\bd3f7553\Default\Cache\CACHE_~1\data_1
Size 264KB
SHA256 0ff81bfe8be0518d8f0d6ac60e1782d0c04745701c9ec549404fddf3e0604f8f
MD5 42f45fe60d4fc7b74fca481a35dfb6dc
SHA1 cc94dbd2fc84990d3ca849deedbe78d37331c735
SHA512 c8855091db9b73ca924a8d3c8c84edba9bc5cc4766816872561d7f2b0d09874636247db6f82815f3d8dfd7a2202e8d664f7b8668925af166cb3e4b01163a2bf9
SSDEEP 3:MsEllllkEthXllkl2zEklslMlZll:/M/xT02znEk
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\polUpdat\bd3f7553\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\polUpdat\bd3f7553\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0\Crashpad\settings.dat
Size 280B
SHA256 b10f33cbc2ac2a7dc480b7da35447b000b6e77445729b1f17b49cd201c4143a3
MD5 c293c246f9f4d7b2c8fba3ced37f376c
SHA1 e726fa40576b0abe1a8d469aa0054e572fdb75e6
SHA512 9a088acd8c8a5f745f40dc9d060941a026e3cc7acbd88d942dacf607cea33a42881fc7d7931ac9104fb179400171df2005f5363fa3486263c28ec9bcdb4ad4d6
TLSH
T161D02202E3B02020E02332F3200BC320E2BFCA0A83332AC208280C0C8CE008A00C2C0C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0\Crashpad\settings.dat
Size 280B
SHA256 212009e70660890714436e03c9b918db7471c5f86c961dab66cc1ebe44f28db8
MD5 db9a1214fc584daa20f3c62472a88582
SHA1 a7cf9fe56cfcedb001f5fd15ded75256f648eadb
SHA512 a17211a1ec42725f4135959cc51776528baf608cdf2af2e2b702956d037aa7f4d05f5c485398342e939595bbf6c6917e005f66445bea0832083a000216e278a6
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0\Local State
Size 4KB
SHA256 79283feac79bb91d9155876b1e0ebdde06da7602bbbc40a188cfcf018a476aa7
MD5 7087b1a1b4cde403dae25ff2a684398b
SHA1 d9da54d850c356000440ccff025a0f798c0bd9e1
SHA512 05ad5bd8929ded82b327e00d22c28424a3ee621656c8eafdcf179fec2588a68e2e16c12846956aca020012af9a4e7637df22cd391fdb60fa9bfcd4f3df18a5eb
SSDEEP 96:YqGNkcQsFff9SFSOTGh58Frh/cInURoDotov2qDoB/RvQIZpUN0eUcCL2q4a:DGNEG9SLooDUwtc7pe1M
TLSH
T160A1A572A438EC275DE6A904B5CA2763BFE46173D8917F98D6D81A0C01AB388370AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0\Local State
Size 3KB
SHA256 f77b35445b1e6823e1fc65ca67cc7800b53ed55b8e8097a37e15bb29735b9a19
MD5 36d43628c7e593feccd51f2ce9612ab9
SHA1 2b99003603aaf1440ac96feeff36062ffe5de113
SHA512 83dd0a6c9c66f5b0aa2c1b9cb47b4de5ebb5de56919081c69fbc4adbee025f6981b0736eab56373469a213baa9830dace71996376bcf79423aead83d7b5844bf
TLSH
T12C81B771A828FD2359E56604B59A37A3AEB471B3CC516F44E6D8131C00EB74C3B0E827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a370f.TMP

Path C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0\Local State~RFe5a370f.TMP
Size 1KB
SHA256 fc4aae03e9bc8d6db97cbb44e95be0f07e90cd6545fe9c9db15f416a97052e13
MD5 01a369bcda58ee2f268afedadce9c76a
SHA1 6bdb40bda5938339b79a8d7ff84fcc7a998c420c
SHA512 2f72c7b77a520ab66e8525a0e0d25eec342f2f9e7b2d452f1457a87863cb9449b4f3ffb1bbbf5f2e21f58b2e4d7331bb71698b7de37fd1da48695bc807e58f3b
TLSH
T15631B571E9683E77BCE15605B38EB7633EB0617180E11A4851DC150C02EBA8C760EC3B
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\polUpdat\dda7e4b0\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4608-69-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-87-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-105-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-104-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-107-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-106-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-99-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-97-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-96-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-128-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-134-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-131-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-135-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-141-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-140-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-143-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-133-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-132-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-142-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-144-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-150-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-149-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-148-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-151-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-158-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-159-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-157-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-156-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-160-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-92-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-93-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-98-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-90-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-91-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-88-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-80-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-79-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-83-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-82-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-81-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-76-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-75-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-74-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-70-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-72-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-67-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-66-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-63-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-65-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-60-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-34-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-33-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-32-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-31-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-29-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-27-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-25-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-23-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-22-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-21-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-20-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-19-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-18-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download

memory/4608-4-0x00000001D0000000-0x00000001D0400000-memory.dmp

Download