13ca94f98461024b3cae92e02caf980c3a4a24eda9ace4fdcc0fdde9cf0593b2

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe
Size 192KB
Sample261022-vbc3saag64
SHA256 13ca94f98461024b3cae92e02caf980c3a4a24eda9ace4fdcc0fdde9cf0593b2
MD5 952e6b772c3db18b3011fc3c94492349
SHA1 7c963eeb02094154af8e701e8d3fee2ddc98e6a0
SHA512 03c217cb06eac414d5ab66c3aa7ab315ee52ba68400cfc27136f6c9f8566df105db36d227e53c806ad8f46fa8b52ab2cccf14926de72e7f8553d09e13eb29efc
SSDEEP 3072:JSzMT4Wc+SfSu5JKAcDstOX+r8XOy4hhVfG2S5zrhQFbKkER8c:JMvWccu5M66eyy02SRv5
TLSH
T19614BF47B3E131F8E077863484625A05D776B8361761AFEF03A5469A1F236E48D3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables using Telegram Chat Bot 2 IoCs

resource	yara_rule
behavioral1/memory/4876-1-0x0000020E1C500000-0x0000020E1C51A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
behavioral1/memory/4876-2-0x0000020E35150000-0x0000020E35160000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2896	powershell.exe
2896	powershell.exe

Uses browser remote debugging 2 TTPs 32 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1632	chrome.exe
780	chrome.exe
1068	msedge.exe
1200	msedge.exe
432	msedge.exe
2884	msedge.exe
448	chrome.exe
2092	chrome.exe
4236	chrome.exe
4676	chrome.exe
2460	chrome.exe
780	chrome.exe
1740	msedge.exe
2456	chrome.exe
1708	chrome.exe
4632	msedge.exe
2716	msedge.exe
4528	msedge.exe
1244	msedge.exe
2256	msedge.exe
4560	msedge.exe
4640	chrome.exe
536	msedge.exe
4932	msedge.exe
2564	msedge.exe
3928	msedge.exe
4560	msedge.exe
4704	msedge.exe
2496	msedge.exe
4160	chrome.exe
4336	msedge.exe
2032	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
10	ip-api.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1056	cmd.exe
1992	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2724	cmd.exe
1980	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2724	cmd.exe
2412	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4472	netsh.exe

System Time Discovery 1 TTPs 7 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
884	chrome.exe
2264	chrome.exe
3784	chrome.exe
3784	msedge.exe
4384	msedge.exe
5088	msedge.exe
3520	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
3472	taskkill.exe
1156	taskkill.exe
4344	taskkill.exe
688	taskkill.exe
1772	taskkill.exe
548	taskkill.exe
1564	taskkill.exe
4908	taskkill.exe
4212	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2412	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2896	powershell.exe
2896	powershell.exe
2456	chrome.exe
2456	chrome.exe
4676	chrome.exe
4676	chrome.exe
1708	chrome.exe
1708	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
1708	chrome.exe
1708	chrome.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe
Token: SeBackupPrivilege	2312	robocopy.exe
Token: SeRestorePrivilege	2312	robocopy.exe
Token: SeSecurityPrivilege	2312	robocopy.exe
Token: SeTakeOwnershipPrivilege	2312	robocopy.exe
Token: SeDebugPrivilege	4344	taskkill.exe
Token: SeDebugPrivilege	688	taskkill.exe
Token: SeDebugPrivilege	4908	taskkill.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeShutdownPrivilege	1708	chrome.exe
Token: SeCreatePagefilePrivilege	1708	chrome.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeBackupPrivilege	4140	robocopy.exe
Token: SeRestorePrivilege	4140	robocopy.exe
Token: SeSecurityPrivilege	4140	robocopy.exe
Token: SeTakeOwnershipPrivilege	4140	robocopy.exe
Token: SeDebugPrivilege	4212	taskkill.exe
Token: SeDebugPrivilege	3472	taskkill.exe
Token: SeDebugPrivilege	548	taskkill.exe
Token: SeDebugPrivilege	1564	taskkill.exe
Token: SeDebugPrivilege	1156	taskkill.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2456	chrome.exe
4676	chrome.exe
1708	chrome.exe
2564	msedge.exe
2256	msedge.exe
1740	msedge.exe
1740	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 1980	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	84
PID 1980 wrote to memory of 2896	1980	cmd.exe	86
PID 4876 wrote to memory of 1056	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	87
PID 1056 wrote to memory of 1992	1056	cmd.exe	89
PID 1992 wrote to memory of 3732	1992	cmd.exe	90
PID 4876 wrote to memory of 2312	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	95
PID 4876 wrote to memory of 2456	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	97
PID 2456 wrote to memory of 3460	2456	chrome.exe	98
PID 2456 wrote to memory of 3540	2456	chrome.exe	99
PID 2456 wrote to memory of 884	2456	chrome.exe	100
PID 2456 wrote to memory of 3540	2456	chrome.exe	99
PID 2456 wrote to memory of 2268	2456	chrome.exe	101
PID 2456 wrote to memory of 2268	2456	chrome.exe	101
PID 2456 wrote to memory of 4160	2456	chrome.exe	102
PID 2456 wrote to memory of 4160	2456	chrome.exe	102
PID 2456 wrote to memory of 2092	2456	chrome.exe	103
PID 2456 wrote to memory of 2092	2456	chrome.exe	103
PID 2456 wrote to memory of 4236	2456	chrome.exe	104
PID 2456 wrote to memory of 4236	2456	chrome.exe	104
PID 4876 wrote to memory of 4344	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	105
PID 4876 wrote to memory of 4676	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	107
PID 4676 wrote to memory of 4388	4676	chrome.exe	108
PID 4676 wrote to memory of 456	4676	chrome.exe	110
PID 4676 wrote to memory of 456	4676	chrome.exe	110
PID 4676 wrote to memory of 2264	4676	chrome.exe	111
PID 4676 wrote to memory of 2916	4676	chrome.exe	112
PID 4676 wrote to memory of 2916	4676	chrome.exe	112
PID 4676 wrote to memory of 780	4676	chrome.exe	113
PID 4676 wrote to memory of 780	4676	chrome.exe	113
PID 4676 wrote to memory of 1632	4676	chrome.exe	114
PID 4676 wrote to memory of 1632	4676	chrome.exe	114
PID 4676 wrote to memory of 448	4676	chrome.exe	115
PID 4676 wrote to memory of 448	4676	chrome.exe	115
PID 4876 wrote to memory of 688	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	116
PID 4876 wrote to memory of 4908	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	118
PID 4876 wrote to memory of 1708	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	120
PID 1708 wrote to memory of 4260	1708	chrome.exe	121
PID 1708 wrote to memory of 3784	1708	chrome.exe	122
PID 1708 wrote to memory of 4292	1708	chrome.exe	123
PID 1708 wrote to memory of 4292	1708	chrome.exe	123
PID 1708 wrote to memory of 4812	1708	chrome.exe	124
PID 1708 wrote to memory of 4812	1708	chrome.exe	124
PID 1708 wrote to memory of 2460	1708	chrome.exe	127
PID 1708 wrote to memory of 2460	1708	chrome.exe	127
PID 1708 wrote to memory of 4640	1708	chrome.exe	128
PID 1708 wrote to memory of 4640	1708	chrome.exe	128
PID 1708 wrote to memory of 2000	1708	chrome.exe	130
PID 4876 wrote to memory of 1772	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	133
PID 4876 wrote to memory of 780	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	136
PID 780 wrote to memory of 1412	780	chrome.exe	137
PID 4876 wrote to memory of 4140	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	138
PID 4876 wrote to memory of 2564	4876	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	140
PID 2564 wrote to memory of 2248	2564	msedge.exe	141
PID 2564 wrote to memory of 3784	2564	msedge.exe	142
PID 2564 wrote to memory of 4292	2564	msedge.exe	143
PID 2564 wrote to memory of 4292	2564	msedge.exe	143
PID 2564 wrote to memory of 4292	2564	msedge.exe	143
PID 2564 wrote to memory of 1484	2564	msedge.exe	144
PID 2564 wrote to memory of 1484	2564	msedge.exe	144
PID 2564 wrote to memory of 4560	2564	msedge.exe	145
PID 2564 wrote to memory of 3928	2564	msedge.exe	146
PID 2564 wrote to memory of 4560	2564	msedge.exe	145
PID 2564 wrote to memory of 4560	2564	msedge.exe	145
PID 2564 wrote to memory of 3928	2564	msedge.exe	146

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3732	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\w55adaab6' -ErrorAction SilentlyContinue}catch{};try{Add-MpPreference -ExclusionProcess '' -ErrorAction SilentlyContinue}catch{}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\w55adaab6' -ErrorAction SilentlyContinue}catch{};try{Add-MpPreference -ExclusionProcess '' -ErrorAction SilentlyContinue}catch{}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Local\Temp\w55adaab6"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\system32\cmd.exe
    cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Local\Temp\w55adaab6"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\w55adaab6"
      4⤵
      Views/modifies file attributes
      PID:3732
- C:\Windows\SYSTEM32\robocopy.exe
  "robocopy.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default" "C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default" /E /NFL /NDL /NJH /NJS /NP /R:0 /W:0 /XD "Cache" "Code Cache" "GPUCache" "DawnCache" "DawnGraphiteCache" "DawnWebGPUCache" "GrShaderCache" "GraphiteDawnCache" "ShaderCache" "Service Worker" "Extensions" "File System" "IndexedDB" "Media Cache" "Application Cache"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --profile-directory="Default" --remote-debugging-port=50209 --remote-allow-origins=* --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7fff5e17c728,0x7fff5e17c734,0x7fff5e17c740
    3⤵
    PID:3460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1892,i,11812263297009314838,3221463347948090078,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1888 /prefetch:2
    3⤵
    PID:3540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --force-high-res-timeticks=disabled --field-trial-handle=1892,i,11812263297009314838,3221463347948090078,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1984 /prefetch:3
    3⤵
    - System Time Discovery
    PID:884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --force-high-res-timeticks=disabled --field-trial-handle=1892,i,11812263297009314838,3221463347948090078,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2344 /prefetch:8
    3⤵
    PID:2268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50209 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1892,i,11812263297009314838,3221463347948090078,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3124 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50209 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1892,i,11812263297009314838,3221463347948090078,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50209 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1892,i,11812263297009314838,3221463347948090078,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4212 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:4236
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 2456 /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --profile-directory="Default" --remote-debugging-port=50368 --remote-allow-origins=* --headless --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7fff5e17c728,0x7fff5e17c734,0x7fff5e17c740
    3⤵
    PID:4388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1976,i,14322299440649913098,11989731879261596776,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    PID:456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --force-high-res-timeticks=disabled --field-trial-handle=1976,i,14322299440649913098,11989731879261596776,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2028 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --force-high-res-timeticks=disabled --field-trial-handle=1976,i,14322299440649913098,11989731879261596776,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2492 /prefetch:8
    3⤵
    PID:2916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50368 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1976,i,14322299440649913098,11989731879261596776,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50368 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1976,i,14322299440649913098,11989731879261596776,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50368 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1976,i,14322299440649913098,11989731879261596776,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4236 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:448
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 4676 /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /F /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --remote-debugging-port=50407 --remote-allow-origins=* --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7fff5e17c728,0x7fff5e17c734,0x7fff5e17c740
    3⤵
    PID:4260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2052,i,15803506632872000252,907662830829372702,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2104 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2052,i,15803506632872000252,907662830829372702,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:4292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2052,i,15803506632872000252,907662830829372702,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2464 /prefetch:8
    3⤵
    PID:4812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50407 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2052,i,15803506632872000252,907662830829372702,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=50407 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2052,i,15803506632872000252,907662830829372702,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2052,i,15803506632872000252,907662830829372702,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4900 /prefetch:8
    3⤵
    PID:2000
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 1708 /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --remote-debugging-port=50524 --remote-allow-origins=* --headless --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff5e17c728,0x7fff5e17c734,0x7fff5e17c740
    3⤵
    PID:1412
- C:\Windows\SYSTEM32\robocopy.exe
  "robocopy.exe" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default" "C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default" /E /NFL /NDL /NJH /NJS /NP /R:0 /W:0 /XD "Cache" "Code Cache" "GPUCache" "DawnCache" "DawnGraphiteCache" "DawnWebGPUCache" "GrShaderCache" "GraphiteDawnCache" "ShaderCache" "Service Worker" "Extensions" "File System" "IndexedDB" "Media Cache" "Application Cache"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --profile-directory="Default" --remote-debugging-port=50755 --remote-allow-origins=* --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x27c,0x7fff5d3ec188,0x7fff5d3ec194,0x7fff5d3ec1a0
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2144,i,17321227516476943465,6755889878882218313,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2144,i,17321227516476943465,6755889878882218313,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2144,i,17321227516476943465,6755889878882218313,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:8
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50755 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2144,i,17321227516476943465,6755889878882218313,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50755 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2144,i,17321227516476943465,6755889878882218313,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50755 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2144,i,17321227516476943465,6755889878882218313,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50755 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2144,i,17321227516476943465,6755889878882218313,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:4704
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 2564 /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --profile-directory="Default" --remote-debugging-port=50838 --remote-allow-origins=* --headless --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff5d3ec188,0x7fff5d3ec194,0x7fff5d3ec1a0
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2928,i,2180248298339892563,4093382447472314678,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2928,i,2180248298339892563,4093382447472314678,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:2
    3⤵
    PID:684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2928,i,2180248298339892563,4093382447472314678,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:8
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50838 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2928,i,2180248298339892563,4093382447472314678,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50838 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2928,i,2180248298339892563,4093382447472314678,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50838 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2928,i,2180248298339892563,4093382447472314678,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50838 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2928,i,2180248298339892563,4093382447472314678,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:2716
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 2256 /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3472
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --remote-debugging-port=50873 --remote-allow-origins=* --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff5d3ec188,0x7fff5d3ec194,0x7fff5d3ec1a0
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2232,i,4534600677937921733,14551382897780290832,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2232,i,4534600677937921733,14551382897780290832,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2232,i,4534600677937921733,14551382897780290832,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50873 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2232,i,4534600677937921733,14551382897780290832,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50873 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2232,i,4534600677937921733,14551382897780290832,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50873 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2232,i,4534600677937921733,14551382897780290832,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50873 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2232,i,4534600677937921733,14551382897780290832,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:4528
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 1740 /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --remote-debugging-port=50936 --remote-allow-origins=* --headless --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff5d3ec188,0x7fff5d3ec194,0x7fff5d3ec1a0
    3⤵
    PID:684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1888,i,5948680246402026737,11215031950220478534,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=1888,i,5948680246402026737,11215031950220478534,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1888,i,5948680246402026737,11215031950220478534,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50936 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=1888,i,5948680246402026737,11215031950220478534,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50936 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=1888,i,5948680246402026737,11215031950220478534,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50936 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=1888,i,5948680246402026737,11215031950220478534,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50936 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=1888,i,5948680246402026737,11215031950220478534,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:1244
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 1068 /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1156
- C:\Windows\SYSTEM32\cmdkey.exe
  "cmdkey.exe" /list
  2⤵
  PID:5092
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4472
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping -n 4 127.0.0.1 >nul & rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\w55adaab6"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2724
- - C:\Windows\system32\PING.EXE
    ping -n 4 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

015c1e8a-a77d-4275-8eac-4b2ee186bbcb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\015c1e8a-a77d-4275-8eac-4b2ee186bbcb.tmp
Size 130KB
SHA256 3abeb2e7610359187f5123555e0721d147e2774de284bf3d780b2387796cd184
MD5 2b455201f8c21348d0c0eadd1935754b
SHA1 d566976adeeba2af3c5d81ccad125bcc65436234
SHA512 e75721b9df85c5ad0ec918056f02ab8816a756b5d80afd7b9b0f850b3b820decd55112b56447017f0144b866322ea6d674125c93f6beb71393e3f1361201c51f
SSDEEP 3072:H+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:H+hFD+7t56OD9ZfSApprU
TLSH
T1DBD31232AA91D8BBC9FD6541B197A300DD666CED51EE2A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 6c819db0734bfc935c63a42a6712058d6e87eb2d95f26b8e6caba4343fef250d
MD5 5d4465f007be84d401efd8ce339bdaae
SHA1 69994fdcc3188edee330493acac43550aad590f4
SHA512 172ce455e13ca65ea3a0dfaf4bd1df651e2423b5386930107c85e61e0374e6eac041602f6df06c15f953d9c1eec6c37938cc1096979f6ee7f2797695bb65197d
MD5 SHA1 SHA512

Submit Download

3d0afc53-b484-4998-bb67-8146d0b1380a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3d0afc53-b484-4998-bb67-8146d0b1380a.tmp
Size 11KB
SHA256 cae9066bdd1e47da4ad45967c1cb34ece0b63e45dbc520ebfe634f4bec679460
MD5 44f447634d56755331065065c93aaf53
SHA1 7638501e80458f64a390250cd21aacbded27656e
SHA512 dc84a8174ee2d6288dfb588fc449f0fcb366a664a43306d036a9a2e5c92123e4c76ec158988af911f6e15dbcc95991c1b4dfa756ada04beee0cad95c119f807a
SSDEEP 192:yR5k/kAv7TpAPRp2V9WHsb+WNnEComPVoICoZ2eG9kw1VyIsnAUge:yR5kscvUX6UwFomPVoToZ2eG9De
TLSH
T1E942632AEE10753B5CDBD21AF9667B53E7F9102131A42E84E6FC893C15E79CC611B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48ef8c96-7f68-49e6-a540-fabb282fd22d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\48ef8c96-7f68-49e6-a540-fabb282fd22d.tmp
Size 14KB
SHA256 070dd731ce036711426b3d49f5f5eaacf501a5e738207d32876e7c29eba3cd0f
MD5 c0b64b70b4d8de28fd1b805a97e63ee9
SHA1 956fbab931786bfd6c6348fa4351c3b287a72c15
SHA512 c1ad465997bee156cfe2daf92d1d7bbd0043c71a133bdafc305b3eb03e9651466b32d417bc668effbaf0adac3e026e1b07d6eae9629f7334fb9b57bda67f9f78
SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5p7pLuLceSZkXOD/q+ErU3bSDrQa:TN/O7KxkXqKf/pUZNCgVLH2Hfgsvp7pS
TLSH
T18262E967BC489E3B0F94C588CC167B4FADF8028B61E9886496FB982503D5BCE11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e8486e0-aa4c-4883-9b9d-5314cdd0895a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8e8486e0-aa4c-4883-9b9d-5314cdd0895a.tmp
Size 414B
SHA256 5d4b2f8003749e4b917a75ab7b2416053e216d890b83c61679ad685b672b7884
MD5 17c4d305390c4cd04188f693cb4f52a6
SHA1 3397c90f2750003bb2cb4549a0c3e71085877d34
SHA512 f7531bd352474c451c3f9f3057e95dcf4d02b50009aa5fdfc1a568a57a58f983ee6a4d3aa4b916461203e32926300603cdab8640943b3746d5281b39ed34864c
TLSH
T187E02BAAC961FC2719FD9B2D54945742EBA023173B90944F373CC1088FB173A4A8681C
MD5 SHA1 SHA512 TLSH

Submit Download

df7c2ee4-0176-4688-b42b-c4bbf8be5c4f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\df7c2ee4-0176-4688-b42b-c4bbf8be5c4f.tmp
Size 131KB
SHA256 0e20886a151f74ff1257127e25fae893e5d8e2e64aaa590e7af3482460f73cd0
MD5 59f3f8dcbe4de84d275308012a7489f5
SHA1 9c09760419207e66223e14b36912b42d092898fb
SHA512 45f4c9bdbfe8a233a7263bd02aabe3f857f4eb2c9c693c3973fc87a417bb0f7531beacd3add962e28f0760be471260e13d669a27b35c51d6e6349a0852608c0b
SSDEEP 3072:0+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:0+hFD+7t56OD9ZfSApprU
TLSH
T141D31232AA94D87BCDFD6541B187A300DE6668ED41DE3A09444A5F8EE09FD4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

470beba0-b357-43c9-a709-58351d717244.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\470beba0-b357-43c9-a709-58351d717244.tmp
Size 9KB
SHA256 e66ede61a79d4620e4fcbb9b3f22d4a2dc7dfe926ab93d0d504c12a844ed1977
MD5 6c56b069ceeff909758518c922ad700e
SHA1 422d65c3bc7ad72523ffb165c54cf30bde1f496d
SHA512 44c1479761d2a1d4316b8a7f01950c9c5ff928fdbc52357a9303a33ff7423784f2467d3fc6a376bb23c11e04e5ba5b4dc1cd7d852df5ca9124501461088e026f
SSDEEP 192:kONY6iDAQmiUz9eOq5u88PcnZmHGanuZZ1T9U6:kONY6pYOq5u8icIHGaSlU6
TLSH
T1AC122A356878FC676DE3A921F0C737639EA8107BEA845F84D5DC571C05DB2882B0B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b68c9c7-3ce4-42e2-88fb-749be8f6683a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7b68c9c7-3ce4-42e2-88fb-749be8f6683a.tmp
Size 8KB
SHA256 a7f9c3a6b030111cf8c6c670b31c87e56de163ea8c05101a4dcc5b0c224e5ffa
MD5 bad9562998ba56842edd6fbb12c7de18
SHA1 b8827f6e26b538295baa3fa935abe0d52ae5a931
SHA512 6acbe19f401f8cf53751f7f3de36bc622fbf51004de1fd9ea3835ed4dfc5b161ef1206f70ecf94d5df8ff929a74d5b90ab2c26057817fd42b3098835386ef2f9
SSDEEP 192:SONO6iDCQmiUyceHq5u88PcnZcSqKYCU6:SONO6/kHq5u8ic2wU6
TLSH
T14D02E9396C787CABADF3AD15B5873B179FA4112FE6952F84D9E8162C01DB29C1303923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 496477d34a0b4ed0abfe792da475ad519e4500215035e0e6881e4f702d702177
MD5 426c15bfb0079f847e1a32c48f779e4a
SHA1 0bee3c4a01d5d86aad39bceac99563f257661295
SHA512 682125e703de96474b2f48fbe651049d115a7fa0509df55be00f57adb913eaa3185e86bdb060a42bcd8e9f1d684d90fe9bbdb57f2f5b568477ae2fa0f6b81f89
TLSH
T111D02BC8D4D47558E01630355036850233CCDD98F003224680490591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

62ec67dc-4fbf-44a2-9a6a-57f5d280315b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\62ec67dc-4fbf-44a2-9a6a-57f5d280315b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

da750adb-bd68-4a24-87a0-9190e571763e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da750adb-bd68-4a24-87a0-9190e571763e.tmp
Size 10KB
SHA256 1056cb0ca40411c5faa5b5849759ac935320e64c2ce7fd72e22aed7775cf38f6
MD5 316315dc7b7b7a7fc62889d35397ef1f
SHA1 2e5bb9c4f8220edaeab3af271afe971fa0984be9
SHA512 ef2c67713f55d1d5afb73500a21587d9238d088708ce53718ba38516f206c5e07e8c2ac1a1abebe9fa1cf0877d156a7563bc443540f5ca7b0fa4c4f0ebcbcd39
SSDEEP 192:kONZ6iDAQmiUzreOq5u88PcnZmHGaxlWdvocRod1/UI:kONZ6pmOq5u8icIHGaxlWdKUI
TLSH
T198223B3568B9FC2B6CE3A421F0C737639DA81037DA849F45D5DC5A1D05EB29C2B07523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3bay4tdn.ftz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3bay4tdn.ftz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3bafc9605ea44d8081ab9aa41bc3589b.db

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\3bafc9605ea44d8081ab9aa41bc3589b.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9601da3682e54b4b956e6f005f391714.db

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\9601da3682e54b4b956e6f005f391714.db
Size 138KB
SHA256 3df3794f480f68182b0476d389be232a5d3643b8d01e6d3879e4f7a4864668fa
MD5 471e0ab4efaa5a841b6708991b556230
SHA1 488772146596bef1a7d5a93b8b634c5a03238034
SHA512 f7b3b4a9505c6e58280dfcc1674b20fc785c55829fa68aead69b77e95ecd6801434d67b83a24cbed93f726c0c4ad2ae5f32ac24b1f1bc63c18c36e7081cbf05f
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OvpX6kNqgVumpGwkQV:zeuvBnhJsueMEGvIW1DcP2OZzVumpGnc
TLSH
T16CD3874B3A747002EDE59A721CE050BB5E3CB16D8F55A5D4387620688EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c00b3700a6f644b5a66f2276619156c3.db

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\c00b3700a6f644b5a66f2276619156c3.db
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20b8011b-3e25-438d-ae3a-68680b48bdc8.tmp

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\20b8011b-3e25-438d-ae3a-68680b48bdc8.tmp
Size 8KB
SHA256 2710947d70c4744b644f1edc78e637ce9524fd3da37a0d190916738b7dddcec1
MD5 b6c4c0fd973960c98a364df4bd0d651e
SHA1 07273c6335cc362eae3e0a4c5b46b72371b47e73
SHA512 412192e9e73bbe23eb31547a2b66ed1a6736f41c20dadaaad30d2b3030433fb39b5b37ee978ffeebe5323ddb935bcef1843dc3f20323f9729ed4f0a6bb090fe4
SSDEEP 192:OONO6iDOQmiUzDlEq5u88PcnZcSZ01Jze:OONO6vtEq5u8ic9qe
TLSH
T198021A352878FC676DE3A814B5C737539EA4107BEA88AF84D5EC5A1C04E739C270B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26c947a8-31d1-4846-bf11-39b95d42c507.tmp

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\26c947a8-31d1-4846-bf11-39b95d42c507.tmp
Size 9KB
SHA256 0745cedeed54b9339668a5eb6e57e42c4551686143385c77e480bd0cee6918a7
MD5 c1796bed54be7d0c6946a41adf227543
SHA1 67624ec9e4016da83e0726301a62de148f44afd2
SHA512 af654907b4eb88e00c73850cf9b18ece39388a880f5de47af9ef4a22b7c7c5c946cd555779c15ad8b7db5af66a1d33cdece335c345a41b0b23a28adc0ffcfc8f
SSDEEP 192:OON26iDOQmiUzJlEq5u88PcnZElWdAOcro01955U6:OON26vrEq5u8icqlWdAO1KU6
TLSH
T1E61229756879FC2B6DD2E814B1C73A53DDA4107BEA84AF84D5EC5A1C00EB39C270BA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Crashpad\settings.dat
Size 280B
SHA256 2c8bd61cd880fecb2ff433c39564a415c9cb087b6925bad6a066beb730366666
MD5 4e629b1630a3adeeb8055ee5593a68ff
SHA1 48d7c19bd695c184b370433073c95495d6c0974e
SHA512 4a2be6f8b4237be8b076c7c47aaa7d827897ad4320ea159d21595dc4955d38eabbb75b79241e38bc1f0c0827d697ae056758eb8d053c2807986b05ab6c3689ed
TLSH
T181D022C0F2A03C08E088003200038F008B88CEB8F0A233C300AECCA0CCC808028F238A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Crashpad\settings.dat
Size 280B
SHA256 5c529ebf440f50a00ba925b096efff228fe3a9da034d703f1fed8ea72fff2e14
MD5 e5523bac6ce0c88f5aba2b720474a27c
SHA1 4da4c8df664246a77653d0a4b2cd167e2206944c
SHA512 f073fdf274eade572d03a039ebb6babda3e41f079c3c326dd83f76cec3157385926f4f8d19ee09e72b9bd652b57d6e0f4bf82a7f96b18f5e24a51cfd43e88667
TLSH
T19FD024C0F1507C04D044003144114F005744CDFCF05133C3005DCC50CCC404014F1345
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 fd6cc938dca94c9325a6ec5c21b3746723bb167e6cff66a587141390ffc6f3e4
MD5 43d9ee2e10e1f44e91f87c1c324aa462
SHA1 37959564eb9b72c7f4f5d1ea3b7031694c7180de
SHA512 646155119e76835face3016751586d091b4abe3dfffbab4edb3019086e40d8385d87430453ae7dbdadae4ece82c1db32c0a1aadb3424dd59a9b7179757be658a
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\EdgeCoupons\coupons_data.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\Login Data
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\Network Action Predictor
Size 52KB
SHA256 1f748422e0b9d41d3258e470a35524c6fd146106b80b841e65f4ca49bd07403d
MD5 8b5918e8869494c27e10b44b373d6e82
SHA1 c632ba43618d1e2884c6f05f55e1bf7eacda1a32
SHA512 9106b4c3dda7724d90729ca96cdd206f6ac3d2a7cdabb47740e735ca780e170ac2d10354600c34ca96151f3df35f7bb31863adca60af8b5e3acad770f16c34b3
SSDEEP 48:TudHYzydB+M9n+8dv/qALihje9kqy2WOT/9F:WHCydB+M9n+8d3qAuhjspFWOv
TLSH
T1F4334EB375176133F816E67CBEA8199008663AC58DE1CAE4DAF00C302FD6650E71F9D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\Network\Cookies
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PreferredApps

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\PreferredApps
Size 33B
SHA256 42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de
MD5 2b432fef211c69c745aca86de4f8e4ab
SHA1 4b92da8d4c0188cf2409500adcd2200444a82fcc
SHA512 948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf
MD5 SHA1 SHA512

Submit Download

Shortcuts

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\Shortcuts
Size 20KB
SHA256 4fb062fed1dd79dcf475ebe91ac5b2a6a89dbcb8fb3282f19c7ee3f97e178063
MD5 0bbd477bb50e68eeb24bcccd9e680f47
SHA1 e804e6926419ed21997775290fc2598396dc89ab
SHA512 e30cb2cc82feceaf1461204476d87eff44a0b55d246be94fbce9712327a03c16e0780d6c04cc8125e7ba270c59d0518fd7c89110aa5b3f20f2301f57f1c89e6f
SSDEEP 12:TLiNcUMskMVUsLjCTH3EfxHQSOaQlvsdFxOUwa5qgufTJpbZ75fOS:TLijMnYLjw0JQoQlvsd6UwccNp15fB
TLSH
T167924E426E206021CA5F4B3A4581D6E95FB6D92C4E43FE138DE44C146FB4580655D699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Top Sites

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\Top Sites
Size 20KB
SHA256 20985daa9b399a1a4c8cb0f7b8de8dc2d708236f2effe8b175bf0b3a67579568
MD5 3e76d9cac1f9ae7467eda94c260c2741
SHA1 79499f9edf34efae2559b6bb769d6f4b8890c959
SHA512 3b4427622b43c653dc72173848df6d2d37f5e0c5b001e49c97bdf6678ebb951b7dbcc50c6de30cb4c6677f238c5eabe52a0137975847fd51905c3ec3d6ab6d0e
SSDEEP 12:TLiNaCZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiQCZwE8I6Uwcco5fBtC
TLSH
T1E3927D8B5F246832C8B5473A92DBC2D44E7BD51DC781AFD1419858619ED0580519A466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\WebStorage\QuotaManager
Size 40KB
SHA256 a6f15fa38462d2d628dd235913be401d7a44d425f5891d72d783f4e87804197a
MD5 cd1b330978e17e191094764259457e48
SHA1 a5608b216b15cc7252934f8f9fb5e96628e481c4
SHA512 68c22cf979c45b89980796f89cf270c8dbfcd2a501f661ab299d940cc5f7c6444e2f8f8085c7029683047e34ef16380c151d079e18b39cb8b41b7f1fa06714c2
SSDEEP 48:THj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UzBBrBRWLr:P7doKsKuKZKlZNmu46yjUlB4Lr
TLSH
T1E303DB8F5B7891F3D0F2C53FA98246E6FC78610C931A7DD101BD47B68E88436A17947A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e456d27a-db8e-4fea-8c63-b1a610447e1e.tmp

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\e456d27a-db8e-4fea-8c63-b1a610447e1e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

heavy_ad_intervention_opt_out.db

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cae6d4f\Default\heavy_ad_intervention_opt_out.db
Size 16KB
SHA256 3f988de8cc924d73c7490c68529a8b25a9ca22f9578c594f554d1e06e0fac307
MD5 d3c18b5df876d89397c233263de4d4ee
SHA1 8ddc51297582d13332d57893a998f114ee504115
SHA512 9e4a3fd3819b6e9f1708f979fc9495fd1bdabc0e8d057767c4febc8fa855cc6e2e8d45c994e5c327ba87855a741034e2d71bacae23b2bc68cd0974eb1e7dafa0
SSDEEP 12:TLCewaBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLvdBgtBgJBgQjiZS53uQFE27MCgGZsR
TLSH
T1FF72596D4D14B201C4BF9E75ACC1C0D23A2C712B0757B6E1A74023FF48AE032A5358A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

136d07cb-6c15-461a-ad62-e95c9bc811e0.tmp

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\136d07cb-6c15-461a-ad62-e95c9bc811e0.tmp
Size 130KB
SHA256 b45e100c67c08f45b8e92284096bde172314f475d5735d4f8b159d83279a9739
MD5 fe6f94cc229c6974516535fa18514cd8
SHA1 f747ce9dad90b24b17f0fbccd5f99b00edf2ae64
SHA512 2c135995263e00f0e75e983c910b0620cc4c279167675616960dece987991b051fc92ba7c0900eb3d3df22eb085ab44f9891547cfb61177fd2d320a461eaa78b
SSDEEP 3072:l+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:l+hFD+7t56OD9ZfSApprU
TLSH
T107D31232AA91D87BC9FD6541B197A300DD766CED41EE2A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Crashpad\settings.dat
Size 40B
SHA256 a3c322e8c8c267ce2571407179d89bbb2d7f55c0fd5f8a17624ad836f80be47b
MD5 4a8c3f99c0f2c3b101a0cc3c0c71048a
SHA1 f7ab6f0b63d20b2f19459fec2e77ed4cf069f7a2
SHA512 5af15a9f5e035fa7f858b3a4d6ba9d3486abf275aee941263bffe24f4ac9d0e7ab586e42d1cec2636cb35c530eec13f76a63d4aef704af07e72b1b8653c6e12e
MD5 SHA1 SHA512

Submit Download

Account Web Data

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Account Web Data
Size 76KB
SHA256 4f3e18eea355690c25b4de99b18e90f0c81cbb088228ffca12c84a53c6dff98f
MD5 b89fd902b32528a846212c73a9bfbe73
SHA1 b2bc3a06c5bf56df8b8245e2947e7f78fb6a416d
SHA512 ae387b21b2d3801abe3543f23d1705b51982e4f076c923cfee764f3ea525ce276d8360623be00d402ed7c804f801e36ba42b68d32a5f6e856e153d6b96ea750b
SSDEEP 96:pv+kOyOFXmT7i04MDDPtg3IM8n0ys5bSAoFLoeqclNz58rx2n:pln06Ca
TLSH
T15A73224A7A342505EDE28A362CF090F75D7C722D8F01A9412DA73028CDA5897F23A4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Affiliation Database

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Affiliation Database
Size 52KB
SHA256 4cb381b1a653296a38381f16bfd94dd09b9c900c0ed24eb532d372d647bcb96e
MD5 142456354ac4a1d7e89f037c2ebda0a2
SHA1 60b5e6036da7c3c1e4e10dc04c319e55cd125152
SHA512 cad919e47513bfbc050db3a996811643f5381ecbe3224c5ed34bf7dcfdec993d7a5e0af674f36625648866b4fad55578ab7427be38c17f6d9eb74403da02960d
SSDEEP 24:TL9VAlZGUWEKdPq9XUeS0z8jNvN2HhKroyr0d8D4BmhltoVOq6Uwccm5fBGQww:TbBzdPqJZSm86Uu8baVOlU1cWB
TLSH
T18F33DF061B685434C9ADD23498D90EE279B4126FD9D1E9A42DFC1D190FE04546CFD46B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 7a36bf4b3e84ed5b7316b7e1446529be52b8eb59909bd42fce7ea34355b84de2
MD5 0418236e1a57957d4e348d96f5d0713d
SHA1 a8374e3c21c0e377bb48e0770d6a994bdd170a19
SHA512 c1e325df855faec4f87042f6f3cb7cc08e809538c7b77b5d8b4f15a65c75a38f01a2d3f2be2663d7ed6acabb70b31cb0a00507f3495712e260698eb6b270174a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Extension Rules\LOG
Size 277B
SHA256 6b1ba4e6d8adafae2bd19102a5b7117de1d05089f1f64a9d67bfcfb1732a28aa
MD5 97351029d8b379b03d40e0d43f98bcb0
SHA1 8762f68f876e7e2e9c42ee74666b3c50ccffefc0
SHA512 246781103da0f3223e9e4c0139fae42f2b3a72f41d0e4dd4781dae563f67fbe4ab00e6575306bb58aa9fd309dea6b1f2b43b204d6b422b3dc616ef4ac849f923
TLSH
T109D0C24A69DAC9BE1194C1E2D7B1A30DCBE82408E7CC76060F5ED84431CA40C64D06D4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Extension Scripts\000003.log
Size 133B
SHA256 3c9b04c37907ce34d683996e5ef4106d0357c0130cbdd298188a160a6032e1c4
MD5 16fd67d91540483c7c1d029d3aa39ae6
SHA1 ec308c605b5b7accdc12201ee426dd1d00524924
SHA512 c56efdd14350241d20f1700930cca786c2db8e6195e03b32c6b17a178cf9f27e6d33dbadb38c68ec05ae26960dbf59311a5826d04ebea3fcf1e19d60bc660e36
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Extension Scripts\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Extension Scripts\LOG
Size 281B
SHA256 8ae484a0f4ece0349bfbf5fd47e734348998120f1071ffdf3e3dce9f6baa297a
MD5 f27f84480e8b111972f5cbd0d24dbe25
SHA1 37f5c0c57c309af543d3ea72f4e10039a63f1c1c
SHA512 01d5e9596caf159834e449f40fcb6f2400fd8f007ac055be653ee76220cf26ce6918589b0ef6e35ebc8d4b0ce7dc74f03cd549fa1076ad40e92ff99c0e3cac34
TLSH
T1B1D0C2486DDAC97E2294C5E38772B30D8BE83004E6CCF6060F56DC0420CE50898D0A94
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Extension State\LOG
Size 320B
SHA256 1ef3b3b8b269d5818cfcf4d205abaafe6a9597158d3d80338636b52bd5b3c5b0
MD5 a1d4b7f4e4d10ef6351bd2e92bfe9b51
SHA1 c6b2ad4da9f29573d53c133a3f4788661244394c
SHA512 701b21121fb35189b2184c8665b4802d374cdef9c7ee7cedf9b7d84ddf4448d30dcadbcaf0ce1c657e340d486a05c138d8b0da6bb11701d34445c4395c37fc2e
TLSH
T1D3E0269529CAC9BE6194C5A7826A630DCBE0B4A8A2CD39470795C880218650C73E1660
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Extension State\LOG.old
Size 277B
SHA256 0df00d0c51bcb00feaa7ba25567ec76ddfcf070ca860917c1a1f0f2f62add249
MD5 deae2caaa0bb1aca5774b0f9f514ab42
SHA1 ad3a28404a0e597d243180b31c13813f16c1097a
SHA512 e7c73a89d69dee935da87afd4aee8c8d8cdf5620f0f4be706425e3c38b8ca4b2a29ac649c91bcd6b5a71f584c0ccf1417e7b1129c63a0f0aea1e9de35c95a126
TLSH
T15BD0C205A5DAC96E1194C5E38736630D8FE83004F6CC36470B6AE88420CA508D4D0795
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Favicons
Size 20KB
SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
MD5 198e1617955c70ad9263e5ae041f3c36
SHA1 623233da85a56e3b75fbd55f5159d83f764db270
SHA512 ca7a586adc01389778c75ac85b1968f8604f39138362db57684b0ff7099be46653f8f98706b0f9aec9059d437a604b82021bc7be8c18dff6a7e60df89c40d2f0
SSDEEP 24:LLiwExh0GY/l1rWR1PmCx9fZjsBYuI+Qo66UwcEv+75fBmI:NeBmw6P1U1kmBmI
TLSH
T1F592AA075E387407EBA11E7D266A183A9E3FE26D9FA29CA4347410618CF8582D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 4a5336706bc10157ee81ed2b0a79f166f90514ae2db09f73d010cdbf5934bdab
MD5 ffb9833496165daeaf3663201424d8f9
SHA1 52e97d49c9f7745983925dceeca253b372c1575e
SHA512 bc9d937c48613af4499003f013835147b7efd3af69923b96b39a16e723ebcfe350b3a3a4480665b68b3faf923389906b65694ceb1b26b0f4515872e84320bbb3
TLSH
T1B9E0205215DEC95D224C91575215770ECFF43518D6CF6B874B54F84574CA40C53D1383
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Local Storage\leveldb\LOG.old
Size 291B
SHA256 3bb8ac8c27e8c173cef92f1aa29beda9b81be5f199d2e93738e408336bca6f4d
MD5 f38f510b6eac12eb307b8e115d0094a4
SHA1 32d7819b3028b39e36802b2e41bd421a95ba6cc5
SHA512 11fb3279b4deff0a3ea5c40489efe100bfa17f0b2fe40638842b223be0d15ffba83c833c1150cbf900030fabd48462b4ac52c3279c7b64d8e9691e91b7cee343
TLSH
T148D08C91A4DAC9AF128481AAA226B70DDEB82108EACD7B464F95E80470CE40CA9D1696
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Network\Cookies
Size 20KB
SHA256 8f4aa6d8eac9f02268e0ac1b4b4c7dae7bff8c8b9c206e35f42ffc5e5a9984ec
MD5 c4bdcbd29bec1a470e40c145bcaa7e57
SHA1 8c2446f8e563a99172a739b6b74fdd9ce127beae
SHA512 d6b9c364809aa1b692ed574dfa1fc90b7c76251e2abca7c5df316a421322dda57296c67c6b8eab1c62e9e8b0d49a4ecae1a43e54eec348051b86bea631019dcb
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBTd5iSgGGkweXbrrFc1nAdlUj:TeW9aw/aHLopFMavU1iBTHiGwurFjlK
TLSH
T1BA92444F1F303620C0F48B37E9D1059B1E7D211CA3236AD9AD9010F39CD699BF4061E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Network\Network Persistent State
Size 2KB
SHA256 d1cbb832bc0577451bb3886c219ebde24fadcac43be09d6641d06b2933b58b30
MD5 00f591f7f518f2e4a446c4fb814c0c37
SHA1 ff9ede2578b57152eab5d84a6f2fc5d1e00c5ac0
SHA512 357f5c205b4ab61dcc9c58e7d7177e6ffabde7373a20fbd2dd64e484c8c3ccb2d72d67419ee305d7e83444ac07fe45bd3da14a2284e82883478106436fe455b2
TLSH
T1CB41ACB7C3E88A3DC90166F4AB256F1FCE690A14532C3C56C9D4AE1F53E28F5E24058E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Network\Reporting and NEL
Size 36KB
SHA256 384287c32999a15429f5d29c2ee7c244d66c0494b0f80716e2f8f0b12b76c2b2
MD5 69c7c09c8256b2cd0e019be546a8966a
SHA1 56edc289721c5ecee03b92309795f7e1ba4da352
SHA512 8c1886b0220ad1d1336ab8eaf858706e352900df269c3ae12f756660c94640764ecd4f416b861422d70a19a48365bf689294daf2b92ffacf4d754f8feace543a
SSDEEP 48:TqIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoO8:+IEumQv8m1ccnvS6hG
TLSH
T123F2DFFF0B197601C0E49675D6810ECFFD2D051D4B9BBEC09AAC09F2AB865E3A538259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Network\TransportSecurity
Size 523B
SHA256 f41d8220d295a26cddecceb888fad29812a10fb44a17252fa315a30ff5b337b2
MD5 224bd5a13d0c9c791db315cdaec53020
SHA1 ea35df0e5d71b5a2a99ec208a3f57828d500cff2
SHA512 e50b4b7f30246ec6f88839f42ba3f914133fb635784f2fa89d14f0cef7a9ec65497836c95f38191091c1c8c6eac887517ae476f21723154e5d5cda5924145b26
TLSH
T1AFF059FBDA6B7523A17E98776D04B80525FAA87D03811CE0CE9AC26DA1E40F31F07047
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Network\Trust Tokens
Size 36KB
SHA256 f6dc3ce8ce21647c61b493cd86c6c3fb5992d5ee4507bae9da8e33fdec247804
MD5 2098aa1459265f01606da9581b7b810b
SHA1 4d9839da23cda7ca4a315b87253f7dff444b6178
SHA512 ddb46a6c9bc1ac4e52483dafb92bdd67f0456473a4b2a5ee7cfbf471615eacddcc6c0ac47b3088ba592af39822e9cbd9769430658d2b1e1e0cb9cfe5bd88714f
SSDEEP 24:TLKEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TWEeWOT/nDtX5nDOvyKDhU1cSB
TLSH
T18AF29A4BE93C6FA3CCC56FB08B07D5B41F722BCAE68276C4247120A01DA964495E7447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Preferences
Size 13KB
SHA256 0f64dc217f75d64626d076104f5e666b8b57ca29a12b1d40fd839c77cea52284
MD5 916d7218b8f80b6383e90ff30ed1552e
SHA1 4028be1286487d9b635f0de0842159ce2b05378a
SHA512 722f8ca22a584c408f4cbf09abd3fc64d73d8f456b3f13946179957df5c86ff2cbf3d516d33bedb0d351756d84589bcdd01bd1c3c10e5d0db912022759e46244
SSDEEP 192:yRx8VZ6LdxYAv7TpAPRp2V9WHsb+WNnxC2Zq3OOjlwwPyIsnAUge:yRx8T6rYcvUX6UwQ2ZSOkze
TLSH
T1A552A52DEE24B53B4CDBD22AF9267B93E7F9102120A02E44E6FD893C15D7ACD6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Secure Preferences
Size 17KB
SHA256 7de93b8626db93a678a29700e276a60d4305609574acc17f334f70a2bafddc6f
MD5 9171e74584c2f114e2134d06d50642d8
SHA1 02aa95316d6ad6ee4bcf0d36acf9b7704e7d78eb
SHA512 f55e9dbd5bff3c1f2e966213e421b6028bc837739cd66e06c0bde4f7833c1a32dd139043362cf02a9730cd63422f164c0a631ff91d1008a70842edca5605f8c9
SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5p7pLuLceSZkXOD/q+ErU3v7HGISDpQw:TN/O7KxkXqKf/pUZNCgVLH2Hfgsvp7pM
TLSH
T1C272E8677C489A3B0F94C9CCD8167B4FECB9024B65E9896486FB582503D4ADF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServerCertificate

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\ServerCertificate
Size 20KB
SHA256 55c38a40a44105325365ebfb7615e7d38e55d7d02853c1002fa2a9ae98974140
MD5 c36580cb88a6268715ad1c3213ee3e62
SHA1 0e829bd8521137f80ac1b6fc9439c2622e3c89f8
SHA512 268e6d3593d346f2e9289d3b1505282d8bb684f4a829fecf1d807a04645a93d94f4267a50bf99df54047612023388a4afdb809781ca362581ee1e8a7826a56b4
SSDEEP 12:TLiNXB+TR0wfQQ+aoMllfIHFxOUwa5qgufTsZ75fOS:TLiZkZC6UwccI5fB
TLSH
T1D492468F9F843935E8A947B9458706E00F7AD73E8382AD6352E848503F90D8081BD45A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

SharedStorage

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\SharedStorage
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Site Characteristics Database\LOG
Size 345B
SHA256 206c3bc77ff4ecb9717d022669ae94baddf6b2f5c5a2860df679123886321109
MD5 528cf936bb4aa6b6b2b33d002c011f31
SHA1 d9c80b5d2482a885b0fd4090e4e3622f09affd8e
SHA512 ec02922e5913ca9558c767492122060c00dae5c5f29cce8b0678ecd785716211e2abe9f5f4555a63f05f9fd229da104a57ede1fa2dc518e7261da729055a4ada
TLSH
T1C4E0262137CECFAF21C5A19B5221F30CC6F17421E7DD69572F65E080628F848B2E2341
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Site Characteristics Database\LOG.old
Size 307B
SHA256 7dcaf85ba74a8aeb094e95226595017e9e71f6ed2d9dd19cb37c119f60554b0f
MD5 73db7da40f26ec893fcd563b5a9cceeb
SHA1 8f08fb48e77fef78de87a737cf84792058fdcaf7
SHA512 34c8177a2b5b74f118dabd2d2325e0082143a275ec0243fb185e5f1c4ad9bf8a6b8710b2e5ba02c36410b3c19ad5016f510b1ce19bff22c242133b7fb9ff718b
TLSH
T1F1E0866466C6CBAF128A81EB5721F30D8AE57004EADDB7161F29F544228F548A4D2A50
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\db
Size 44KB
SHA256 b08af7745c49533422c5afb2e683b61ab1b025a2ef13f892321a2cd1383fba79
MD5 ad4b0d21f32cbccefd98c28e33a59a6e
SHA1 1850a90ed7ec61efca181fcc35927a2888549e6e
SHA512 0bc8a37f441ce5cbb0fe4ea3f766f741cc6424ac4274ffa42fcf507c8fc7154115375bc669449da02d8b57a19227483814357367cc8611cbecdf247d7b65706b
SSDEEP 24:TL6BgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:T1OIy4m1b3fbUdeqSB
TLSH
T16B13BB0F1E187551D1BD0236E9E64E6B2E7E204C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Sync Data\LevelDB\000003.log
Size 2KB
SHA256 a70423c48119f29be0127edf68dbffe2a325b9955a3462f5d6224af84ac397ab
MD5 903e512bbf5604c333ba41266a37f2b2
SHA1 03e0040d85a348e1e8e5c1d0c2369ff26a2cdb8e
SHA512 7b6bb3a5296220d5dba5703c14b057335669de57967ab8ea9ce4116c7522f1097f8c990bd1bb4926350f2ac4203b71c2606c45d8709d32ee76a561ee05a874d4
TLSH
T1FE51D1F37D015435FD6398FA11EA385CCE6B930E18A8D3E5D3C65D31204395AB41F2A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 ee3e278018dfd183901f46883e8e52c773c964a68679a74c92fe5c28514bcff2
MD5 0ae719dccef95a6045f5121f5e53c616
SHA1 2455160a08020ab3466d8ae1e474e3bb4af5facc
SHA512 7c5c0060fea8800ae40ad63df9845818c89baaddd9d47810c82ec2fcf5e2c311f323e79096158abb9accc411353ad0cbd369fab12475afb3e50664ada50a3cc2
TLSH
T175E0267126CACE7D29C0D2874264B71C8AF8B81893CD368B6B64F04065C690CA2F0282
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Sync Data\LevelDB\LOG.old
Size 283B
SHA256 ddaa6d66585163fdcea4153a35f2d531a32106d284268cdd4281309c2b666e76
MD5 6b0fff1a37447fc9288ff0ea912be9ad
SHA1 072fa06137d8c277481e420db05016367b92b8a2
SHA512 a1af309d8b0cf107a08f486d48b91ccdae7b3ae22c5856d6e815bde687b86eea24fce2fb4b3a86c728550208915a770e139187d8b5ffa8c859f960383c56334c
TLSH
T134D0C2B495C5CB7E2185C1D74F21AB0E8DF8A808E7CD778A4F1CE804218A408A4F0681
MD5 SHA1 SHA512 TLSH

Submit Download

Top Sites

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Top Sites
Size 20KB
SHA256 46ce0815c17cf69ac6ea71b0b62f6bffdcf2f186345c902db74590aa1f6e0b48
MD5 8f968e2e8336299c9c37f0f1c9303d98
SHA1 2285ffa966112b53f56283949ec2219174358f16
SHA512 e12b9b7274bff0334e8298f12b81d446c40f3eba0e75b500c74a46d195f409b7219df160a850c92d6389f8c74ebdb200b5c87325a5a9dc4e20cff0f395c3d466
SSDEEP 12:TLiNaCZhDu6MvDOF5yEHFxOUwa5qguYZ75fOS2Rccog2IccogL:TLiQCZwE8I6Uwcco5fB2r2oL
TLSH
T1F4929ECF1F246833E8B54B3DA3D781D84D7AD61DC791EF91509418619ED1880525E06A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
Size 1KB
SHA256 97bbe02ee0327548d5b3bf2b6f00b507ca4425425e04f95e072b3617b3e4e6bd
MD5 398cdbfaa7de9f8a3931365e364d27f4
SHA1 ed1a3d000aca1e13108f0c0dc68235e444126d5c
SHA512 998dc6d33b867dedf26dd9e773e37038c697407b5d0600e9fbff01a9d30e50c004b9ca00e5ff4f13a18bfe4cdd7669e23a28b8c547c8cfa2fff1fe323506f092
TLSH
T13F3107848DBA44924EC31A70239760AA3C18F91EE235D48A109ACF527B063099BDFE51
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
Size 2KB
SHA256 444572dc6fc2eb8f1a880711379a0ec4a80d041549fad959fb5678b4c0b08689
MD5 ae3b722b45c677f2b47afa1d9f0fc94f
SHA1 609c3dc27cb90e805157537c673e6b4e7a6c3d96
SHA512 7cd894c041a3c7530698931a93639ed7fd9131aaf1bfeaadc6d29867f5b0a49e101dd0b1572eb113a465d5adfc497f872617cc8c51270d08227f9981db71d19e
TLSH
T1F6516C2378FA9142C8345043D0EFADAD71FF52D3C74A451B31E64020ACAFAE121A139E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\shared_proto_db\LOG.old
Size 279B
SHA256 5a30dc9dd1232d1d2a35c129f5091ec8fdc592bb8e7954c341b4ef70a2f4a17a
MD5 5c89288ce3150e75659163ef6973620e
SHA1 c7d524bc5fdb35fed6f9e7ecaa5f4a890efb72a5
SHA512 447ed84d85a3553ad3437c473c0265f18af1d44df7086d5f148662e50e5764722ad66928cc6538806abc3c82f9078c9cb912e6fcdea2fcd638ed8dbed96f071d
TLSH
T18FD0C211F9C1C9AF20A881E71722A30E8E9C6815FAEC260B0F51E41820CA40868D0691
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 457c8e65d939a92b523b4d596769f01e3d58aab71ef876e05813afa472368f80
MD5 e1167991e643ea341fb25e0b2fdc893c
SHA1 cbbc49a5fef60ac96f3c7932dbeef0dae8559c60
SHA512 7c814835b6bc51ef600a4199975ceeaf7f56853f0631cc97f02d1d3d0bf4fb21e02ae43c9395b0e818644eb3dcca434ad23c0dcce54d6fbc58e8a9b9ec08a25d
TLSH
T195214791F330C205C649863B247EAB251338C8669FF8FC0F50B5242D2EB7E140D4B2E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 59ce0705349bae0f647da288b1db15f5023de37593d10a64c3ac3e3a4769d8f9
MD5 36c33c972e907e295b9e2ae1077a9bc5
SHA1 777e91ac170142ba68dd3f569e9151e91e831c25
SHA512 232e086d754ccb6c1df2aeee6205375761d625aa9e8987798bcd52ad69be79724bc80a361c7d132cda865c179dfc241a683d72f71a441bad743fbd876fdd242d
TLSH
T16CE026017DCFC9AF60D081931371A34CD7E43A1AEADC2F4B2F94C884518A04873E6241
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\shared_proto_db\metadata\LOG.old
Size 297B
SHA256 0cae6e123def18b7426f773403eed8dfb7771ba69b8667f70ec647c0c1430b8a
MD5 2685a37637117d4886590b39d2e6721f
SHA1 aa94c5d517cf961aac71546adaa635d915357904
SHA512 26b6e09e386195610a4e1c12d6529e4623d319a5627626096f8488115e8b645d816dac7e60b7e0df67b2c409f47c4494180e282591803287a23ac3e44d89335f
TLSH
T1FDE0C210F9D5C9EF109981E71722A34E8EAD7814FBEC2F0B0F91E81855CE40878D5691
MD5 SHA1 SHA512 TLSH

Submit Download

trusted_vault.pb

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Default\trusted_vault.pb
Size 84B
SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
MD5 85d7a7c1e12b26cd994cd41e587629d6
SHA1 bf53173aa4b19a217eb542951dbafe3ec3506810
SHA512 b3562e0466d9e218e96be44a01feac567e2843f61d1fe5201a5c7d6eef0e714cb5d7d8aa380dbe4f341aca2c46e615f3bfd29621a4898cb8e027cf1155b8df83
TLSH
T115A0128266008642461DB130C80B4C4018311C5A0B34400111F36EA362D5900C541440
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\Local State
Size 130KB
SHA256 dbaf57978dc50ac0f76a98d18cf00da130065fe6761305ef66dda2cca29effe8
MD5 9603102038e88600d0617e2ed7ed1aa3
SHA1 5470b2a4a7ee98b45ee227b255046a8e973b8cd5
SHA512 953ace67f9ad7b4a892092f9ea88044d5c1d0516a749d9ff6bdaccb0d7b37b276e3372b4e013df2f582e7a3e86a0b50dcdf2eaba818aaddc2256d83cb5749473
SSDEEP 3072:w+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gb:w+hFD+7t56OD9ZfSApprb
TLSH
T1BAD31232AA90D87BC9FD6541B157A300DE766CED41EE2A09444A9F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\ShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\cd44314\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

passwords.txt

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\focus\passwords.txt
Size 56B
SHA256 da9b916004a57e1855df096af5211d0eeba0cc7d90fe63c786d7a77ba221bc5e
MD5 3cb32ca1f8d23130e604285d298aa4d4
SHA1 88bda6769997b8237f180b7fd59ea90f7d3425c9
SHA512 e19a0b48f3714fa9f30f5e8e17cae7611a2a77ec8750f596ded6f27b915148694c6a63fc674353fe89d1ad0d47882fd1d4b039547efb8d7f462fac795781fb88
TLSH
T1479002F4410718761A69C100000D14062CA5A442C0872641B17E5A049575897CA86A8B
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\logs\cookies.txt
Size 32B
SHA256 5cc3752db5dc00fec7c7f01fe0b97b4d3d2e923676b2eb7d36714a660999a6ab
MD5 84517da404e303ced18ecabaa6c6457a
SHA1 6d6ecef8c4a50ce0ddc82544ea2278c65a9156ef
SHA512 98cc5d0fea4367edab7e5e0780809dd75a896020bf45d5a2a5c00fc57e72bdf0a1a13b454a3599100d4314679c02a0c16f4635f75bc75772a956de7743f43e5e
MD5 SHA1 SHA512

Submit Download

roblox.txt

Path C:\Users\Admin\AppData\Local\Temp\w55adaab6\logs\roblox.txt
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

memory/2896-14-0x000001F9B2AE0000-0x000001F9B2B02000-memory.dmp

Download

memory/2896-6-0x000001F9B07F0000-0x000001F9B0800000-memory.dmp

Download

memory/2896-5-0x000001F9B07F0000-0x000001F9B0800000-memory.dmp

Download

memory/4876-2-0x0000020E35150000-0x0000020E35160000-memory.dmp

Download

memory/4876-0-0x0000020E35150000-0x0000020E35160000-memory.dmp

Download

memory/4876-17-0x0000020E35B70000-0x0000020E36098000-memory.dmp

Download

memory/4876-4-0x0000020E35330000-0x0000020E354F2000-memory.dmp

Download

memory/4876-18-0x0000020E1C660000-0x0000020E1C6B0000-memory.dmp

Download

memory/4876-3-0x0000020E35150000-0x0000020E35160000-memory.dmp

Download

memory/4876-1-0x0000020E1C500000-0x0000020E1C51A000-memory.dmp

Download

memory/4876-1023-0x0000020E1C610000-0x0000020E1C61A000-memory.dmp

Download

memory/4876-1024-0x0000020E1C640000-0x0000020E1C652000-memory.dmp

Download

memory/4876-488-0x0000020E35150000-0x0000020E35160000-memory.dmp

Download

memory/4876-487-0x0000020E35150000-0x0000020E35160000-memory.dmp

Download

memory/4876-407-0x0000020E35150000-0x0000020E35160000-memory.dmp

Download