aae01b9fa9c0e9f8b8d5e9965b0c899f53caebbd9ea4b2fb38afb06cbaa85571

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fluorine bridge/start.bat
Size 3KB
Sample261011-2772csba44
SHA256 aae01b9fa9c0e9f8b8d5e9965b0c899f53caebbd9ea4b2fb38afb06cbaa85571
MD5 0392716baf435c421deb8fffcf256fcc
SHA1 9bf2a77103387696826056411ea8ffc5a8699ee1
SHA512 877ceb4a461af5f4c3fb42542e54d84a67542aab69d542580b850f837b55880e6ccee93edd7effbb140349111808e2b33734ea8ae209278438a69f221015477f
TLSH
T1E48173373E98522604D7CD469C9801F3F20B80FB4A0569AC755B8278AF1D3DC25BE7C5
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Executes dropped EXE 30 IoCs

pid	Process
3112	node.exe
4544	node.exe
2780	node.exe
2648	node.exe
4196	node.exe
6068	node.exe
2084	node.exe
4552	chrome.exe
5532	chrome.exe
5612	chrome.exe
760	chrome.exe
5960	chrome.exe
5572	chrome.exe
2072	chrome.exe
1216	chrome.exe
5424	chrome.exe
2812	chrome.exe
2988	chrome.exe
5876	chrome.exe
124	chrome.exe
256	chrome.exe
2576	chrome.exe
3180	chrome.exe
4800	chrome.exe
4884	chrome.exe
4384	chrome.exe
4872	chrome.exe
5284	chrome.exe
2968	chrome.exe
4844	chrome.exe

Loads dropped DLL 44 IoCs

pid	Process
4552	chrome.exe
5532	chrome.exe
4552	chrome.exe
5612	chrome.exe
760	chrome.exe
5612	chrome.exe
760	chrome.exe
5612	chrome.exe
5960	chrome.exe
5960	chrome.exe
5612	chrome.exe
5612	chrome.exe
5612	chrome.exe
5572	chrome.exe
5572	chrome.exe
5424	chrome.exe
5424	chrome.exe
2072	chrome.exe
2072	chrome.exe
1216	chrome.exe
2988	chrome.exe
2988	chrome.exe
5876	chrome.exe
5876	chrome.exe
5612	chrome.exe
124	chrome.exe
124	chrome.exe
2576	chrome.exe
2576	chrome.exe
3180	chrome.exe
4800	chrome.exe
4800	chrome.exe
4884	chrome.exe
4384	chrome.exe
4384	chrome.exe
4884	chrome.exe
4872	chrome.exe
4872	chrome.exe
2968	chrome.exe
2968	chrome.exe
4844	chrome.exe
5284	chrome.exe
4844	chrome.exe
5284	chrome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2920	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3176	cmd.exe
4324	cmd.exe
5964	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4552	chrome.exe
760	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
824	taskkill.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{CE5DA0BD-15B8-40CD-8F53-51D72D601A68}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2920	powershell.exe
2920	powershell.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe
Token: SeDebugPrivilege	824	taskkill.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 4324	3176	cmd.exe	91
PID 4324 wrote to memory of 2920	4324	cmd.exe	92
PID 3176 wrote to memory of 352	3176	cmd.exe	93
PID 352 wrote to memory of 3112	352	token-collector.exe	94
PID 3112 wrote to memory of 4544	3112	node.exe	95
PID 3112 wrote to memory of 2780	3112	node.exe	97
PID 3112 wrote to memory of 2648	3112	node.exe	98
PID 3112 wrote to memory of 4196	3112	node.exe	99
PID 352 wrote to memory of 6068	352	token-collector.exe	100
PID 352 wrote to memory of 2084	352	token-collector.exe	101
PID 2084 wrote to memory of 4552	2084	node.exe	102
PID 4552 wrote to memory of 5532	4552	chrome.exe	103
PID 4552 wrote to memory of 5612	4552	chrome.exe	104
PID 4552 wrote to memory of 760	4552	chrome.exe	105
PID 4552 wrote to memory of 5960	4552	chrome.exe	106
PID 4552 wrote to memory of 5572	4552	chrome.exe	109
PID 4552 wrote to memory of 2072	4552	chrome.exe	110
PID 4552 wrote to memory of 1216	4552	chrome.exe	111
PID 4552 wrote to memory of 5424	4552	chrome.exe	112
PID 4552 wrote to memory of 2812	4552	chrome.exe	113
PID 4552 wrote to memory of 2988	4552	chrome.exe	114
PID 4552 wrote to memory of 5876	4552	chrome.exe	115
PID 4552 wrote to memory of 256	4552	chrome.exe	116
PID 4552 wrote to memory of 124	4552	chrome.exe	117
PID 4552 wrote to memory of 2576	4552	chrome.exe	118
PID 4552 wrote to memory of 3180	4552	chrome.exe	119
PID 4552 wrote to memory of 4800	4552	chrome.exe	120
PID 4552 wrote to memory of 4872	4552	chrome.exe	121
PID 4552 wrote to memory of 4884	4552	chrome.exe	123
PID 4552 wrote to memory of 4384	4552	chrome.exe	124
PID 4552 wrote to memory of 5284	4552	chrome.exe	125
PID 4552 wrote to memory of 2968	4552	chrome.exe	126
PID 4552 wrote to memory of 4844	4552	chrome.exe	127
PID 2084 wrote to memory of 5964	2084	node.exe	128
PID 5964 wrote to memory of 824	5964	cmd.exe	129

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fluorine bridge\start.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "try { $h = Invoke-RestMethod -Uri 'http://127.0.0.1:3001/health' -TimeoutSec 5; if ($h.healthy) { 'UP ' + $h.tokenCount } else { 'DOWN 0' } } catch { 'DOWN 0' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "try { $h = Invoke-RestMethod -Uri 'http://127.0.0.1:3001/health' -TimeoutSec 5; if ($h.healthy) { 'UP ' + $h.tokenCount } else { 'DOWN 0' } } catch { 'DOWN 0' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- C:\Users\Admin\AppData\Local\Temp\fluorine bridge\token-collector.exe
  token-collector.exe -no-tui -tokens 150 -batch 2 -parallel 2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:352
- - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
    C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\cli.js install chromium
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
      C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\entry\oopBrowserDownload.js
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:4544
  - - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
      C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\entry\oopBrowserDownload.js
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:2780
  - - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
      C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\entry\oopBrowserDownload.js
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:2648
  - - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
      C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\entry\oopBrowserDownload.js
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:4196
- - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
    C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\cli.js --version
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:6068
- - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
    C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\cli.js run-driver
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
      C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe --disable-field-trial-config --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-back-forward-cache --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-component-update --no-default-browser-check --disable-default-apps --disable-dev-shm-usage --disable-edgeupdater --disable-extensions --disable-features=AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,BlockOriginHeaderModificationOnRedirect,Translate,AutoDeElevate,OptimizationHints,msForceBrowserSignIn,msEdgeUpdateLaunchServicesPreferredVersion --enable-features=CDPScreenshotNewSurface --allow-pre-commit-input --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-updater-scheduler --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --no-service-autorun --export-tagged-pdf --disable-search-engine-choice-screen --unsafely-disable-devtools-self-xss-warnings --edge-skip-compat-layer-relaunch --disable-infobars --disable-search-engine-choice-screen --disable-sync --enable-unsafe-swiftshader --no-sandbox --disable-blink-features=AutomationControlled --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --disable-background-networking --disable-default-apps --disable-extensions --disable-sync --disable-translate --disable-component-update --disable-client-side-phishing-detection --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-domain-reliability --disable-features=Translate,MediaRouter,OptimizationHints --no-first-run --no-default-browser-check --metrics-recording-only --safebrowsing-disable-auto-update --password-store=basic --use-mock-keychain --lang=en-US --headless=new --window-size=1920,1080 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9 --remote-debugging-pipe --no-startup-window
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Time Discovery
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\Crashpad --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=151.0.7922.34 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff803aeb9c0,0x7ff803aeb9d0,0x7ff803aeb9e0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --headless=new --enable-unsafe-swiftshader --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1868 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1944 /prefetch:11
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Time Discovery
        
        PID:760
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2336 /prefetch:13
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3560 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3608 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3704 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1216
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3724 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --start-stack-profiler --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3548 /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --start-stack-profiler --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3808 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3752 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3872 /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:256
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3936 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:124
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=3984 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4244 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5548 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5604 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5656 /prefetch:12
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5664 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=3952 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=4584 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9" --force-high-res-timeticks=disabled --field-trial-handle=1880,i,16425802678094690207,16436374600232694584,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1888,i,13902939015619971402,8978667860554369664,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=3976 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "taskkill /pid 4552 /T /F"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5964
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /pid 4552 /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

playwright-download-ffmpeg-win64-1011.zip

Path C:\Users\Admin\AppData\Local\Temp\playwright-download-WFbOrW\playwright-download-ffmpeg-win64-1011.zip
Size 1.3MB
SHA256 8d08827c019ad36e7b9d49d3648447d884534cb2acf200e71c715f6dd834cc50
MD5 64f21cf744e9a8d7e13213f2ab1c425c
SHA1 332cb05cfb673a52298c3d164f6b6c28fbd47a7f
SHA512 a16d0b28fc7a6330dd84aef7668a854ed6c9ac18be49be805f15a71ac3b925fb74ad0ddb429bec6c5f9d37e49a2696204a3ac928e100ef8a87342762977c0f55
SSDEEP 24576:3HsCK+zA2diQP3OeL/w4y2Gn8zMu1nCGFp24Qw1IqAuo4ehOgcCOwoBCmJ:3sTAOo/U2GRutHFwvaIqAP41woBHJ
TLSH
T1A86533681F57BF38442534BB4A8A843F4BC879CFAE6D68417137E984C95BA3705F360A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

playwright-download-winldd-win64-1007.zip

Path C:\Users\Admin\AppData\Local\Temp\playwright-download-ap0ToB\playwright-download-winldd-win64-1007.zip
Size 125KB
SHA256 0069f0d11d4ad6df068a068c003d22fe7dbec192a47bba64b2e115e9c8ce41d8
MD5 644294505aa684d112592a07290ca73f
SHA1 4fd8e830765e89cfb0e66d68300a5582b81fb7b8
SHA512 ba8b8d0251685d99de8db79815d527a0e1613d42baa58e68e889a584763a91c16c8203ea51a9d395a20e0d822d71d980e34b09b6ce9307335df0883da346aa1e
SSDEEP 3072:Of10ezo2YmUfuDOSZee49O/A1ZFydc6lV2hqEb:OO/2YmUfuy2B81ZFyi6lI3
TLSH
T1E4C313B135B97EC8C557433925CA5573D50FB1C28C58398EB830CCBEEA9B682B894D93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68ba57f9-a0f3-42cd-9c46-c5bdef605f09.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\68ba57f9-a0f3-42cd-9c46-c5bdef605f09.tmp
Size 3KB
SHA256 0eb5fb6529527e78dc219b57dace1f342c65754708c052a5a6ba18e299a930e3
MD5 e69e0a0097ec2ead8e6278b5d2442b45
SHA1 9373985b6919c306b75ccd407b783e272ed2645e
SHA512 3975fa56aef8cdce6fa884aa9095a2ff8967b611935075a3e43da07699c587e4972e271016a8798383d0244a35f2d93abdaa817679897fb8ac643edaa29304cb
TLSH
T1E281092174A4AEB35EB3E94871813D87EB75126BF0927FD9D9E80A2C01EB6DC1346423
MD5 SHA1 SHA512 TLSH

Submit Download

7c7667bc-c0f7-4d1b-b512-4d3a76760f38.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\7c7667bc-c0f7-4d1b-b512-4d3a76760f38.tmp
Size 4KB
SHA256 07112a4f35708a16bb70f0eebad469eaff06ea6cfab3b49b68f3ce7dff9ef87b
MD5 df566abf0f6bf870a26df23c3949161e
SHA1 988a2cfcfa95c531eba05ae0cc964329d14cf81f
SHA512 fa1c818443302938b62e3e56d22ef226b5e0b79f0deb4c8cf1ebb26d9496424be2add40197e747314b667afa8c49b58ef5d09fa60b56c89e87175138ae34c37d
SSDEEP 96:UVbJvEhUfl3/R4i0ove2otos58DxB6iGwvK1/tUq/0j9QytMphL2H4a:at/uipW2UFqHuBVUmUKhLC
TLSH
T15B81F92174A4AEB35AF3E548B1813D87DB75126BE4927ED9D9E80A1C01E76DC1346423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d2f8dfc-7f92-4320-8eab-0f3bd247e7cf.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\7d2f8dfc-7f92-4320-8eab-0f3bd247e7cf.tmp
Size 3KB
SHA256 2853c802e30de2dcc6b69d8de48c42d10ef577fc5e110775fc118ec16b0d1a43
MD5 69cfe2c33c200339754fcf250ac1849f
SHA1 85a883d1598f05acdfd86c6b6bce58636c9699e0
SHA512 459e0b1529e6b54dfe458365274d56ef3696408464ae241acefa7051ac0540e0c01ed35c385d5fd4e45c1a530be6b53fecafda1e971f1c2f892cb75d719f5ca7
TLSH
T1D181F73274A4AEB35AF3E948B1813D879B752267F4A27AD9D9F80A1C01EB6DC1346413
MD5 SHA1 SHA512 TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

72620713-6206-454b-b6ec-86ebae0b82c0.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\Default\Network\72620713-6206-454b-b6ec-86ebae0b82c0.tmp
Size 1KB
SHA256 b269bc629cc6adb2eec2025197f9e131eb23ef6f84de95a01fbdc1deb19f5200
MD5 51f4dd380178d2b76d34dd53d798757b
SHA1 16710db9b356c3806dac2758d2c3838000778b68
SHA512 9446a8bdc282026f72f522c847ab704f48521a7ede416ff91aced5144beaca48008e078dedddf555dcb1fac8b348bd54b542e1566fcaa0801312c9e62811fd75
TLSH
T19C31D0E7C7DC866ED45546F4A7157A1BCE2E091C432C3C1688D8AF1BA3E2430D21168F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

efd3f8c2-d8a6-45b4-b1ad-dc43b266c43d.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\Default\efd3f8c2-d8a6-45b4-b1ad-dc43b266c43d.tmp
Size 6KB
SHA256 e1cf0f3e61e008553a082678384eff81d551dcbc256af00ecb3b2f5cd4f1228e
MD5 d1aeddcdf0e07a25d8aa87bb18a3eb11
SHA1 015e4a5d976d3e7896d99a2cba6fa6d9f31a67bb
SHA512 33432980e54b2f2d3ccf19e7cc9abe8d52adaf5433b9a748dd2aa903082e6d0ad9f63685368985b87a800d213c0e741d7168bbc9288cb567e5ce4e912c8450c5
SSDEEP 96:zRQimHTvouFSS0dnaSUETHv7cKQAeu9/H79636+WVoMPktNm+Te09jaBTZh:zRQiYnF6ddv7cw9/Hc36+WNOyZh
TLSH
T11DD19616BE24EB374CC7D91DBA747791E6F61021698A1D4D1BF88A3C0ADEBCC120742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\Local State
Size 917B
SHA256 0fdc996b7694364b4861e6a89ceb665cb7617f58402f89581fc042f0582fc88d
MD5 72049fe40fcc8022450bd5b956b3bbe5
SHA1 0cb4c096f1f0080c424935a2c6529563c235e931
SHA512 f5fa1c9d5ec5c52f08c7359e33ff330a6199e755e650c56bf2f387855f3d21a568835006930dbcef98f35e9e418e5bb58bbbb1661fa42460d67bbc2555a4a075
TLSH
T1B41167716460B3E15F61595DB2942FF31D250323809129CE2DED116413FB7B41B16935
MD5 SHA1 SHA512 TLSH

Submit Download

dd863e5a-f7c1-4147-9f89-f6e5197f9326.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\dd863e5a-f7c1-4147-9f89-f6e5197f9326.tmp
Size 3KB
SHA256 34b2ba94f21aaae52bc67920911c33471af74866f4f1151f1a2270b849923e48
MD5 2283dab0b603e55819f38eaae942bcd5
SHA1 2a1e3b375b863c002a3ef340674da3439ef76bdd
SHA512 01fe0d595852c703beae7e41578275767e03cacd2aa1d5430a085bb42c9d11f1e913fa54394302947d91f440bf9fdc70de8ea163e344059dc93dee149bf8bf44
TLSH
T16581083174A4AEB35AF3E94871813D87EB75126BF4927FD9D9E80A2C01EB6DC1346423
MD5 SHA1 SHA512 TLSH

Submit Download

e0f9a698-a296-4b3e-860e-7e157489c8e4.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-T654t9\extensions_crx_cache\e0f9a698-a296-4b3e-860e-7e157489c8e4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

browsers.json

Path C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\browsers.json
Size 1KB
SHA256 f306eed529599b1eaf2f8a85db9de2b23e1a3fe36c2b66434b7c9434fb627a99
MD5 560015a1d50411c3086cee089ee30e47
SHA1 6bd997095230ff9950c7847830adefe3292c24ab
SHA512 23089ef97a256e44e1773ae48ea4b30406a453b617f6e2ff4509616f648712b8eb5804cba92bdf7165223d52810456237a74b78336dab4aadd35e507d673b51d
TLSH
T1D1312285D864CCBB284A1BA485890085BDB4069F2DA83C18BB1D254D1F4FB3F55FAFAD
MD5 SHA1 SHA512 TLSH

Submit Download

cli.js

Path C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\cli.js
Size 839B
SHA256 f1c4075aef116c766092250d7f37b3249a7cee6465d953207fc38c8f6145becd
MD5 03cfe1b9635ce4c9a37209dd32c079ec
SHA1 90ac6978b40532df55bf7f1ff71e7fdfd343a611
SHA512 d6fdbed3c6eba579accdf9186e84f6bcd97119aaf16f8a010fb2fdada6972b39093150b51a612f9c962029ff66b5bc9bf42ad7c66afbcd76c70215410cf4e888
TLSH
T1C101EB7CBA8816F737904AF67D0AC4CB670AD85D350F9351580A80EA9C2D7A642ECEB0
MD5 SHA1 SHA512 TLSH

Submit Download

coreBundle.js

Path C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\coreBundle.js
Size 3.3MB
SHA256 710a92b65e9b31ee0081e3a3235b37178fe1ad55fb27818fb8cf0d8cab4c4469
MD5 e9580e4e46a530bb3b9b6b0825cc2c40
SHA1 69f2c5927f5c1fd7f497698c3289f0d78c8e0123
SHA512 eba6b113f9737b32ec9ca20f466c13886c107af7ac47762d5a9f5ddaa06745e6dde3aa42d7ae61c0cb0148c9c0ca5f6335cc64accdfe2b543f0787a3dfe79fde
SSDEEP 49152:senh/iKr6iTioC7qOgl5WJtyH/jD7GeW4qxR71ZcLGKMS:rDV
TLSH
T12FF5C75A69BB153242A371AA5F7790067334A0073409E9A87E4C83D81F8D568DAF3FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oopBrowserDownload.js

Path C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\entry\oopBrowserDownload.js
Size 120B
SHA256 87567cdbd67dd2f50bb232d47d3784701ece7c81e39c0287bb7d1b466b68cf06
MD5 1e3ae44a8d82d5c038c7ea40f39df0ca
SHA1 677c9304e9bca503e09867815e99b4285c9b1007
SHA512 6b27841fa560f7ca0f7e83b188c4e50aed3c46cdddd425787e5f515e87535184eefbbe359983de06883e4d65efd3a16eef3449cf37f0f7697ca84591ca396258
TLSH
T1D4B022CBC8B8FA808230C0EC802A80000802802A80002022ECA0C3F0828C888A23A2A8
MD5 SHA1 SHA512 TLSH

Submit Download

utilsBundle.js

Path C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\utilsBundle.js
Size 3.1MB
SHA256 580f571bf063e2256b51b3946a035bc452fc0e22808d5547b198baea39923a32
MD5 c8ecdbc4129f3ca97df52c5e5e79cb4e
SHA1 45f9472e70e37729cd79205c0471413ef74ec77e
SHA512 6074e485fca3c6634cdff8fa7978717799e2955f280994cd6513526922aba355ab381c36dc8f4e32cc75dd20f4d23731e31ef51263e333ed8b85db65b48fb20d
SSDEEP 49152:ZdGL4IQUHxMtmVtvM2qnBf5bLiwaYD6ZXoJEV5yslrRlLnlL1WL3Jh0MovQ/hizs:dnwv2
TLSH
T176E5D8496AF71052466370B85F6F9006B6749407250CEDA8BE9C93E06F8993887F7FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\package.json
Size 876B
SHA256 07c47543631fef9508760365dee9fbe958c562093ec8d122543949ed231f233f
MD5 0ec0d1f956fbfa027c70ae0820d82a88
SHA1 9481e713c53d5f0ba44c6597e0cc3f1a1a19ba31
SHA512 77364bd1d2724c2923e635040f506653e05ebd900f3bdb402763ef4548263c087c7c5ca40ab8348a0eecb62ac4523709493b08c944b138ecf996b0199e6c36be
TLSH
T18B114812C5EC5D9326C8366DEA2A965070748C5F845A7E103BC6175C9F8C67F13BE319
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\D3DCompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
Size 3.8MB
SHA256 409805a16d6416087e6b2f778df1cf8f7bbb267d6b99f6b5bb0a618eace234f2
MD5 e4147570dba618b7b3be11259066e93e
SHA1 418c8d063e0703e8a35a6e4beb306c160b692894
SHA512 3633ac928ef8b8f6e2b8cbeca6379c070635966a421b0b718703cd67093e7bd230d850fc5452ce3567430ce8780a9bda41d5072eff641fe115efb0998c8ebabd
SSDEEP 49152:f9FCIwMA07VoZrUgzMeyWd+iSjcCE7Yg8WsDI9usDUkANZ8C8GHzSXJyKnp9odjw:f/CIwZygzxX7FTr2XcMj
TLSH
T11A168C13F2DA50D8C019D179875A9233EA61BC454B31B6DF0A90B7562FB6FE06B3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome_100_percent.pak
Size 692KB
SHA256 2ad4942582a53f411bd505b8e46fe48d029277de38b16abb28210868fd9ba42d
MD5 80003de1aaac1749f71c7b907c06f5da
SHA1 fc716752ad845d797a8b86ef8702c7273f5b135f
SHA512 a3384b0e1a24e148cf803894584bb7560e9bfddfa170125938a254d4eb28041e5b9deab2d34b004899ad16837cdd069cdbbb65c3779e80594a39db5162e3d99a
SSDEEP 12288:HI3H1fJwjjzgsz5B0GDJQrnKs8SNP+QSsEHeilSTe+gnPzmxKYJblI3csAjKQCrC:o3VBQ7zEEmPLVbTe+gnPzmxtbOAGQt
TLSH
T1BEE412E37370AC7DEE9B1777826615B0FC371A280A92160917DAF8796913B48D8D93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome_200_percent.pak
Size 1.2MB
SHA256 936d7fd943eacf4c22fd11563a65a3fa168cdf23f05597ba3e1ec15713b2525a
MD5 7e61f5c6ca76d675087bd13281357b62
SHA1 0a8477440d5abb78314f1081a395b36898298184
SHA512 ed7160a522a8f989fa7145f83a41606dd3b27a7e6ab84b53226d05e482b1afd2fdfc77a70dc351c9c308cdc91b58107628ac1ad6dc64080bbad15539d8ac8971
SSDEEP 24576:Z3zB09pLzLmmibkFR8+mZiqr8BWhQume1RvQt9wbcIQwuSXAeUGQ74:Z3yL3mNbkFRJmQ+8khQRa1QPv8uSXAh8
TLSH
T1EB4522D3D3B0EC7EDD520B77939B20E4FD7500271A72190F0B26AD7A39166C8DA95A83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome_elf.dll
Size 2.6MB
SHA256 1afacfeca8fbbd9d32c22bb2d9c2482c76611d141dca0d53f11b6e082a097ac4
MD5 5d9fe46dcfe72069d74b3319608f126c
SHA1 e99c3e6172b47751fd56295a594cbdfdfa49cb40
SHA512 d774592ae32bea19ae24720da8e18106cc0476f398c70e650420f11dfcf486db6784136a7d831cf7aea7a20f7ece77c7e0550bca5ffe0628b895e2673a515f0b
SSDEEP 49152:hQNZbbsqhzq7ethFJ+BHnnbhRaJHTsy/PvG7yz7zsV:AZb982h2xQPvfM
TLSH
T19EC57B13F2DA01E8C05DD1788B5B9232EAA1BC454B35B6DF0A9076562F7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\dxcompiler.dll
Size 24.6MB
SHA256 6e4da9e1d498414bc33e051262f333a6f4c4ac51e756c1238284fcebc8b6bc2d
MD5 e1640116b155fe029af932bbe3e5104e
SHA1 316c74ff25c09e6eaf26ecfdf17e890954f366e1
SHA512 71dd16f7fbae5896dab7367a5d7d0ea151833b505eb31acd23413dde281b82161eb063291ed46ea88027026c1c00d952915e539365817c6c1b0ec7118b46b980
SSDEEP 196608:dZOZpehvut9C1brA6osHu+Jrc28Huy0dty2EbVS7HGVYJObo2xecey2zAmZ4kD:dZOHeZu+NxHR8OZy5Vijuo2bjWAwD
TLSH
T16D4729122686D49DC059C879C3678B268A6C30E73FA7B8EFC0F451252B79DEC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\icudtl.dat
Size 10.4MB
SHA256 9f48c7f9c7c94d516a14870707e910ab94d75ae640ff6842c4af53276cd26ebe
MD5 c9d17441b2314fe514cd8cb951577c1c
SHA1 15cae4dee805f3e04171e00781da13fe40036439
SHA512 836d4f4fa591ee059dbfb943c2f13ded58a0f5048b5505214ec7105d0963106e0078aa262090d0dac9cca80995c7961a900ffa7a2af8ff315aabad1313bd37a4
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89j:1/cBhORok2HiXUxO/RJk3IWhlYntjdOj
TLSH
T1A9B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_FEMININE.pak

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\locales\am_FEMININE.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\locales\en-US.pak
Size 504KB
SHA256 3915a43dab5c12f08562d1bb6d4e493b35cb88e87c04c532ee660fd9b9f432b7
MD5 10d006fad7d84057e3c4a524074da365
SHA1 b43a31f806087014a3e3113d690b54e0f1124aaa
SHA512 61ed6a4f96a02278b35de2b91640f4e69be9c445b6a390938ced45c68dc793ebffbe1231c37b3d48c311abe477fbf4ba05f480e2bf15588fd6bca376804c4b27
SSDEEP 6144:/ptV/LEpt+bViNJHfv7Oqk3waOprMf9BWFqcfaYNGf0uN/G7w/:/VzEUViPHfvjMnWFqaw/
TLSH
T1B2B43B1FF744122A059352A27F09A5A2FF36D06CA35112563CBD812C33B7B66C27B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\resources.pak
Size 20.3MB
SHA256 4711063046c16734c681448daa7e06433d9860a9b039fb72b97128680b7614db
MD5 4035a1ba797c63a6bdd0429104cee738
SHA1 f78e6f7fd81af98368da865b458e462fc23c96bd
SHA512 f5946419c47e12e49728f08cf0aed77097a2a55db74c1a55c97481cdfb1877a611dc31470fe934a4f65a0dbb1768ab3b28b7f804c6d693da5bc9f0338196e64c
SSDEEP 393216:DaZLZelLgg9mno8sbq+dNAcrIgsTCvbQ8qbCxa942xvkrBnlumqdl3:WIggJ5IJCnqb8a94gkBnlumqn3
TLSH
T19227126AB300523BCFA34376545BA23A7336804E3F4793672059E36D0C5BBE99F6894D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\v8_context_snapshot.bin
Size 723KB
SHA256 f4ca0c7dc3fa0329d15128cf217f279650d7dad93b6a1629bb3a303a8a04671b
MD5 2de8df916c64df3ee97e72a6f8ceea57
SHA1 afcba754d396c80c62d204c578887d5f19412a15
SHA512 4ad203cea529fb6c6be1235a0e36620409512eaf06766001213c420ece67c42c25503901e6b6ab2a6f2b0a84c94f4cbf7a658510437aa653635b63fe9b72aecf
SSDEEP 12288:7ER3hjl246rucdLsWqqUNpkG+VOqJh2ww:7ER3n+pdWqQpkKqJU
TLSH
T1ACF494B6F56A8A26CE5127BDCDB6CA063634F19DCF86C65B704217BC78A8FB44E1140C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\vk_swiftshader.dll
Size 5.2MB
SHA256 492c2b5cb17fd2e1cef419612cc389716d2bd2c33da617ae695d40a68b372333
MD5 8f86ed44f3a717ee78295adf264ccc94
SHA1 8747dcdab0cc3c92bda1e4e05f1321217af00e9e
SHA512 ff372c56d2f128c1c7c976f758eaa7864b2fafc407e7e21d74ae52f9f719281497f171b9e15cda30fec7556ac81d0be5ad344399a88a46acb8e4e6297ae50ef5
SSDEEP 49152://F78sN2WtWnDBQxGpgN7Q00pDyS/277Cu70uvMDHB7ZL1r78deye7haOBFEaaLT://F78sU2U1CdDXzWUL
TLSH
T122463803F28680E9C06DD579875EA623B231F8840B7276DF66A05F1A2E79FE0673D705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\vulkan-1.dll
Size 943KB
SHA256 b6b2cf8b1e49e8a6e7b2a3415498931dc58fa384ce42aa39aac8b71619f4317a
MD5 c910884674feb4cc911dd57f54268ce1
SHA1 fd9781036f320288fa2ff90db3c6e349f42123ff
SHA512 b8e7a29d2d06ab5fb2a6ccbf639051fadc3d97d934cbe8e8e626233265f7fc083a833e0b1bb8b1bd03243485944e61c9a4ac0f04babf9e36f89e2e3bc15f04bb
SSDEEP 24576:XeqBgeQrf+Qv2c81wPacwsh0Pm+KNlC1EoDkw7+DV6g3v0TAE7yoeHe97:uq1QrxecaZsh0Pm+KNlC1EoDkw7+DV6X
TLSH
T1EE258D63DA548AA9D6768074D8D18A0399F0B4811332B6CF03B417186F6FEF47B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium_headless_shell-1234\chrome-headless-shell-win64\hyphen-data\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium_headless_shell-1234\chrome-headless-shell-win64\hyphen-data\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium_headless_shell-1234\chrome-headless-shell-win64\hyphen-data\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium_headless_shell-1234\chrome-headless-shell-win64\libGLESv2.dll
Size 449KB
SHA256 32d811521ab6d2249aee6c2cb51c0082e78c44ab4a32b0222c104b38a64c0389
MD5 525f13b82784dfac6c42a9ce8d056e68
SHA1 ea615448d561878681aada6e747ebfc83957d481
SHA512 f64f91e640b14a4e78233c79cf35e805ef175c50e7db4f57e769b9dbd867e818978a2af6e73790dca2281aafa2ef9649052125893fa88dd7f994c04970c6cccd
SSDEEP 6144:Z+cJPab9TfpocD588jeei3Cap5651zs4bcFtifJ2X+O:KicD5/eeap5651zs8cFtia+
TLSH
T179A47D05B7D548BCD077C1388A538647EBB178560B61EAEF03A0E2792F77BE41A7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2920-12-0x00007FF801AA0000-0x00007FF802444000-memory.dmp

Download

memory/2920-14-0x00007FF801AA0000-0x00007FF802444000-memory.dmp

Download

memory/2920-3-0x000002751BAA0000-0x000002751BAC2000-memory.dmp

Download

memory/2920-4-0x00007FF801AA0000-0x00007FF802444000-memory.dmp

Download

memory/2920-5-0x00007FF801AA0000-0x00007FF802444000-memory.dmp

Download

memory/2920-6-0x00007FF801AA0000-0x00007FF802444000-memory.dmp

Download

memory/2920-7-0x00007FF801AA0000-0x00007FF802444000-memory.dmp

Download

memory/2920-8-0x00007FF801AA0000-0x00007FF802444000-memory.dmp

Download

memory/2920-9-0x00007FF801AA0000-0x00007FF802444000-memory.dmp

Download

memory/2920-10-0x00007FF801AA0000-0x00007FF802444000-memory.dmp

Download

memory/2920-11-0x00007FF801AA0000-0x00007FF802444000-memory.dmp

Download

memory/2920-0-0x00007FF801C2F000-0x00007FF801C30000-memory.dmp

Download

memory/5612-955-0x00000292F8E50000-0x00000292F8E51000-memory.dmp

Download

memory/5612-972-0x00000292F8A70000-0x00000292F8A72000-memory.dmp

Download

memory/5612-971-0x00000292F8A60000-0x00000292F8A61000-memory.dmp

Download

memory/5612-974-0x00000292F8A80000-0x00000292F8A82000-memory.dmp

Download

memory/5612-975-0x00000292F8A60000-0x00000292F8A64000-memory.dmp

Download

memory/5612-954-0x00000292F9700000-0x00000292F9702000-memory.dmp

Download

memory/5612-953-0x00000292F8E50000-0x00000292F8E51000-memory.dmp

Download

memory/5612-956-0x00000292F97C0000-0x00000292F97C2000-memory.dmp

Download

memory/5612-957-0x00000292F8E50000-0x00000292F8E51000-memory.dmp

Download

memory/5612-958-0x00000292F9860000-0x00000292F9862000-memory.dmp

Download

memory/5612-959-0x00000292F8E50000-0x00000292F8E54000-memory.dmp

Download