13ca94f98461024b3cae92e02caf980c3a4a24eda9ace4fdcc0fdde9cf0593b2

Analysis

max time kernel
149s
max time network
82s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe
Size 192KB
Sample261022-vbc3saag64
SHA256 13ca94f98461024b3cae92e02caf980c3a4a24eda9ace4fdcc0fdde9cf0593b2
MD5 952e6b772c3db18b3011fc3c94492349
SHA1 7c963eeb02094154af8e701e8d3fee2ddc98e6a0
SHA512 03c217cb06eac414d5ab66c3aa7ab315ee52ba68400cfc27136f6c9f8566df105db36d227e53c806ad8f46fa8b52ab2cccf14926de72e7f8553d09e13eb29efc
SSDEEP 3072:JSzMT4Wc+SfSu5JKAcDstOX+r8XOy4hhVfG2S5zrhQFbKkER8c:JMvWccu5M66eyy02SRv5
TLSH
T19614BF47B3E131F8E077863484625A05D776B8361761AFEF03A5469A1F236E48D3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
behavioral2/memory/5696-1-0x000002102ADA0000-0x000002102ADBA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4796	powershell.exe
4796	powershell.exe

Uses browser remote debugging 2 TTPs 40 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2864	chrome.exe
4524	chrome.exe
4636	chrome.exe
2972	msedge.exe
4488	msedge.exe
5732	msedge.exe
2200	msedge.exe
992	msedge.exe
3728	chrome.exe
1996	chrome.exe
2360	chrome.exe
5872	msedge.exe
5440	msedge.exe
3900	msedge.exe
252	chrome.exe
620	chrome.exe
4796	chrome.exe
2156	chrome.exe
3472	chrome.exe
4712	msedge.exe
1856	chrome.exe
2312	msedge.exe
3180	msedge.exe
4516	msedge.exe
4996	chrome.exe
3228	chrome.exe
3756	chrome.exe
1360	msedge.exe
4440	msedge.exe
2792	msedge.exe
3452	chrome.exe
6028	msedge.exe
4500	chrome.exe
4188	chrome.exe
2920	msedge.exe
2816	msedge.exe
2836	msedge.exe
5760	chrome.exe
3712	chrome.exe
256	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1100	cmd.exe
5676	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3340	cmd.exe
4376	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
860	PING.EXE
4376	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5820	netsh.exe

System Time Discovery 1 TTPs 7 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1104	msedge.exe
3660	msedge.exe
3872	msedge.exe
5964	msedge.exe
704	chrome.exe
4656	chrome.exe
4336	chrome.exe

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
5368	taskkill.exe
4452	taskkill.exe
5856	taskkill.exe
5044	taskkill.exe
4648	taskkill.exe
3220	taskkill.exe
6108	taskkill.exe
3920	taskkill.exe
3672	taskkill.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
860	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4796	powershell.exe
4796	powershell.exe
252	chrome.exe
252	chrome.exe
5760	chrome.exe
5760	chrome.exe
4796	chrome.exe
4796	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
252	chrome.exe
252	chrome.exe
252	chrome.exe
5760	chrome.exe
5760	chrome.exe
5760	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
256	msedge.exe
256	msedge.exe
256	msedge.exe
256	msedge.exe
6028	msedge.exe
6028	msedge.exe
6028	msedge.exe
6028	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeIncreaseQuotaPrivilege	4796	powershell.exe
Token: SeSecurityPrivilege	4796	powershell.exe
Token: SeTakeOwnershipPrivilege	4796	powershell.exe
Token: SeLoadDriverPrivilege	4796	powershell.exe
Token: SeSystemProfilePrivilege	4796	powershell.exe
Token: SeSystemtimePrivilege	4796	powershell.exe
Token: SeProfSingleProcessPrivilege	4796	powershell.exe
Token: SeIncBasePriorityPrivilege	4796	powershell.exe
Token: SeCreatePagefilePrivilege	4796	powershell.exe
Token: SeBackupPrivilege	4796	powershell.exe
Token: SeRestorePrivilege	4796	powershell.exe
Token: SeShutdownPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeSystemEnvironmentPrivilege	4796	powershell.exe
Token: SeRemoteShutdownPrivilege	4796	powershell.exe
Token: SeUndockPrivilege	4796	powershell.exe
Token: SeManageVolumePrivilege	4796	powershell.exe
Token: 33	4796	powershell.exe
Token: 34	4796	powershell.exe
Token: 35	4796	powershell.exe
Token: 36	4796	powershell.exe
Token: SeDebugPrivilege	5696	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe
Token: SeBackupPrivilege	2892	robocopy.exe
Token: SeRestorePrivilege	2892	robocopy.exe
Token: SeSecurityPrivilege	2892	robocopy.exe
Token: SeTakeOwnershipPrivilege	2892	robocopy.exe
Token: SeDebugPrivilege	3920	taskkill.exe
Token: SeDebugPrivilege	3672	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
252	chrome.exe
5760	chrome.exe
4796	chrome.exe
2920	msedge.exe
2972	msedge.exe
256	msedge.exe
6028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5696 wrote to memory of 3340	5696	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	89
PID 3340 wrote to memory of 4796	3340	cmd.exe	91
PID 5696 wrote to memory of 1100	5696	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	93
PID 1100 wrote to memory of 5676	1100	cmd.exe	95
PID 5676 wrote to memory of 2556	5676	cmd.exe	96
PID 5696 wrote to memory of 2892	5696	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	98
PID 5696 wrote to memory of 252	5696	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	100
PID 252 wrote to memory of 2728	252	chrome.exe	101
PID 252 wrote to memory of 5152	252	chrome.exe	102
PID 252 wrote to memory of 5152	252	chrome.exe	102
PID 252 wrote to memory of 704	252	chrome.exe	103
PID 252 wrote to memory of 2328	252	chrome.exe	104
PID 252 wrote to memory of 2328	252	chrome.exe	104
PID 252 wrote to memory of 4996	252	chrome.exe	105
PID 252 wrote to memory of 3728	252	chrome.exe	106
PID 252 wrote to memory of 4996	252	chrome.exe	105
PID 252 wrote to memory of 3728	252	chrome.exe	106
PID 252 wrote to memory of 620	252	chrome.exe	107
PID 252 wrote to memory of 620	252	chrome.exe	107
PID 5696 wrote to memory of 3920	5696	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	108
PID 5696 wrote to memory of 5760	5696	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	110
PID 5760 wrote to memory of 3412	5760	chrome.exe	111
PID 5760 wrote to memory of 4656	5760	chrome.exe	112
PID 5760 wrote to memory of 4704	5760	chrome.exe	113
PID 5760 wrote to memory of 4704	5760	chrome.exe	113
PID 5760 wrote to memory of 2900	5760	chrome.exe	114
PID 5760 wrote to memory of 2900	5760	chrome.exe	114
PID 5760 wrote to memory of 3228	5760	chrome.exe	115
PID 5760 wrote to memory of 4500	5760	chrome.exe	116
PID 5760 wrote to memory of 3228	5760	chrome.exe	115
PID 5760 wrote to memory of 4500	5760	chrome.exe	116
PID 5760 wrote to memory of 1996	5760	chrome.exe	117
PID 5760 wrote to memory of 1996	5760	chrome.exe	117
PID 5696 wrote to memory of 3672	5696	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	118
PID 5696 wrote to memory of 5044	5696	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	120
PID 5696 wrote to memory of 4796	5696	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	122
PID 4796 wrote to memory of 3352	4796	chrome.exe	123
PID 4796 wrote to memory of 4336	4796	chrome.exe	124
PID 4796 wrote to memory of 296	4796	chrome.exe	125
PID 4796 wrote to memory of 296	4796	chrome.exe	125
PID 4796 wrote to memory of 260	4796	chrome.exe	126
PID 4796 wrote to memory of 260	4796	chrome.exe	126
PID 4796 wrote to memory of 3756	4796	chrome.exe	128
PID 4796 wrote to memory of 3756	4796	chrome.exe	128
PID 4796 wrote to memory of 3712	4796	chrome.exe	129
PID 4796 wrote to memory of 3712	4796	chrome.exe	129
PID 4796 wrote to memory of 2436	4796	chrome.exe	130
PID 4796 wrote to memory of 1856	4796	chrome.exe	131
PID 4796 wrote to memory of 1856	4796	chrome.exe	131
PID 4796 wrote to memory of 4524	4796	chrome.exe	132
PID 4796 wrote to memory of 4524	4796	chrome.exe	132
PID 4796 wrote to memory of 2360	4796	chrome.exe	135
PID 4796 wrote to memory of 2360	4796	chrome.exe	135
PID 4796 wrote to memory of 2864	4796	chrome.exe	136
PID 4796 wrote to memory of 2864	4796	chrome.exe	136
PID 4796 wrote to memory of 2156	4796	chrome.exe	137
PID 4796 wrote to memory of 2156	4796	chrome.exe	137
PID 4796 wrote to memory of 3472	4796	chrome.exe	138
PID 4796 wrote to memory of 3472	4796	chrome.exe	138
PID 4796 wrote to memory of 4188	4796	chrome.exe	139
PID 4796 wrote to memory of 4188	4796	chrome.exe	139
PID 4796 wrote to memory of 4636	4796	chrome.exe	140
PID 4796 wrote to memory of 4636	4796	chrome.exe	140
PID 5696 wrote to memory of 4648	5696	2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe	142

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2556	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_952e6b772c3db18b3011fc3c94492349_cobalt-strike_icedid_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\wa4d4f27c' -ErrorAction SilentlyContinue}catch{};try{Add-MpPreference -ExclusionProcess '' -ErrorAction SilentlyContinue}catch{}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\wa4d4f27c' -ErrorAction SilentlyContinue}catch{};try{Add-MpPreference -ExclusionProcess '' -ErrorAction SilentlyContinue}catch{}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Local\Temp\wa4d4f27c"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\system32\cmd.exe
    cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Local\Temp\wa4d4f27c"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5676
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\wa4d4f27c"
      4⤵
      Views/modifies file attributes
      PID:2556
- C:\Windows\SYSTEM32\robocopy.exe
  "robocopy.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default" "C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default" /E /NFL /NDL /NJH /NJS /NP /R:0 /W:0 /XD "Cache" "Code Cache" "GPUCache" "DawnCache" "DawnGraphiteCache" "DawnWebGPUCache" "GrShaderCache" "GraphiteDawnCache" "ShaderCache" "Service Worker" "Extensions" "File System" "IndexedDB" "Media Cache" "Application Cache"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --profile-directory="Default" --remote-debugging-port=49833 --remote-allow-origins=* --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffcc398c728,0x7ffcc398c734,0x7ffcc398c740
    3⤵
    PID:2728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1796,i,3520807611791233890,2483028059453619761,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2
    3⤵
    PID:5152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,3520807611791233890,2483028059453619761,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:11
    3⤵
    - System Time Discovery
    PID:704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --force-high-res-timeticks=disabled --field-trial-handle=1796,i,3520807611791233890,2483028059453619761,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:13
    3⤵
    PID:2328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=49833 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1796,i,3520807611791233890,2483028059453619761,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=49833 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1796,i,3520807611791233890,2483028059453619761,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=49833 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1796,i,3520807611791233890,2483028059453619761,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:620
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 252 /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --profile-directory="Default" --remote-debugging-port=49911 --remote-allow-origins=* --headless --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x114,0x138,0x7ffcc398c728,0x7ffcc398c734,0x7ffcc398c740
    3⤵
    PID:3412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2260,i,7570201255411755020,1701341389054760172,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --force-high-res-timeticks=disabled --field-trial-handle=2260,i,7570201255411755020,1701341389054760172,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
    3⤵
    PID:4704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2260,i,7570201255411755020,1701341389054760172,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
    3⤵
    PID:2900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=49911 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2260,i,7570201255411755020,1701341389054760172,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=49911 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2260,i,7570201255411755020,1701341389054760172,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=49911 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2260,i,7570201255411755020,1701341389054760172,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:1996
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 5760 /T /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3672
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /F /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --remote-debugging-port=49990 --remote-allow-origins=* --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ffcc398c728,0x7ffcc398c734,0x7ffcc398c740
    3⤵
    PID:3352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --subproc-heap-profiling --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
    3⤵
    PID:260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=49990 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=49990 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --subproc-heap-profiling --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
    3⤵
    PID:2436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=49990 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=49990 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=49990 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=49990 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=49990 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=49990 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=49990 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=49990 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=2000,i,12242326258131550471,3909791642519137008,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4636
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 4796 /T /F
  2⤵
  - Kills process with taskkill
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --remote-debugging-port=50156 --remote-allow-origins=* --headless --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  PID:3452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffcc398c728,0x7ffcc398c734,0x7ffcc398c740
    3⤵
    PID:1084
- C:\Windows\SYSTEM32\robocopy.exe
  "robocopy.exe" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default" "C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2\Default" /E /NFL /NDL /NJH /NJS /NP /R:0 /W:0 /XD "Cache" "Code Cache" "GPUCache" "DawnCache" "DawnGraphiteCache" "DawnWebGPUCache" "GrShaderCache" "GraphiteDawnCache" "ShaderCache" "Service Worker" "Extensions" "File System" "IndexedDB" "Media Cache" "Application Cache"
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --profile-directory="Default" --remote-debugging-port=50180 --remote-allow-origins=* --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffcbdd2c188,0x7ffcbdd2c194,0x7ffcbdd2c1a0
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2712,i,14882993201470940728,5202264288877389497,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:2
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2712,i,14882993201470940728,5202264288877389497,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2712,i,14882993201470940728,5202264288877389497,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:13
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50180 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2712,i,14882993201470940728,5202264288877389497,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50180 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2712,i,14882993201470940728,5202264288877389497,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50180 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2712,i,14882993201470940728,5202264288877389497,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50180 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2712,i,14882993201470940728,5202264288877389497,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:4440
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 2920 /T /F
  2⤵
  - Kills process with taskkill
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --profile-directory="Default" --remote-debugging-port=50287 --remote-allow-origins=* --headless --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffcbdd2c188,0x7ffcbdd2c194,0x7ffcbdd2c1a0
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2480,i,14101746416954614251,644116939030575751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2480,i,14101746416954614251,644116939030575751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2480,i,14101746416954614251,644116939030575751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50287 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2480,i,14101746416954614251,644116939030575751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50287 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2480,i,14101746416954614251,644116939030575751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50287 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2480,i,14101746416954614251,644116939030575751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50287 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2480,i,14101746416954614251,644116939030575751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:5872
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 2972 /T /F
  2⤵
  - Kills process with taskkill
  PID:3220
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --remote-debugging-port=50354 --remote-allow-origins=* --headless=new --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x22c,0x7ffcbdd2c188,0x7ffcbdd2c194,0x7ffcbdd2c1a0
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2296,i,1976356239203094426,12923720351690701751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2296,i,1976356239203094426,12923720351690701751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2296,i,1976356239203094426,12923720351690701751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50354 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2296,i,1976356239203094426,12923720351690701751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50354 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2296,i,1976356239203094426,12923720351690701751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50354 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2296,i,1976356239203094426,12923720351690701751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50354 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2296,i,1976356239203094426,12923720351690701751,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4712
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 256 /T /F
  2⤵
  - Kills process with taskkill
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --remote-debugging-port=50421 --remote-allow-origins=* --headless --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-component-update --disable-sync --disable-features=Translate,MediaRouter --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffcbdd2c188,0x7ffcbdd2c194,0x7ffcbdd2c1a0
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2496,i,7193923725685746660,15572449927759520499,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:2
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2496,i,7193923725685746660,15572449927759520499,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2496,i,7193923725685746660,15572449927759520499,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:13
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50421 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2496,i,7193923725685746660,15572449927759520499,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50421 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2496,i,7193923725685746660,15572449927759520499,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50421 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2496,i,7193923725685746660,15572449927759520499,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=50421 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2496,i,7193923725685746660,15572449927759520499,262144 --disable-features=MediaRouter,PaintHolding,Translate --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:5440
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /PID 6028 /T /F
  2⤵
  - Kills process with taskkill
  PID:6108
- C:\Windows\SYSTEM32\cmdkey.exe
  "cmdkey.exe" /list
  2⤵
  PID:2716
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5820
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ping -n 4 127.0.0.1 >nul & rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\wa4d4f27c"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4376
- - C:\Windows\system32\PING.EXE
    ping -n 4 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

510a84ca-36bc-434d-a193-3769b0d9858c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\510a84ca-36bc-434d-a193-3769b0d9858c.tmp
Size 5KB
SHA256 dc2a616ba5bcfdd6fb089f27571659deac7f234b3bed5d98528af15019b99dfd
MD5 610a98da4401923eb2adf9518e59b20f
SHA1 fd49c94f6d3dd22c27850abceb8db5943923d931
SHA512 09b705c93f7ec4223ca4fa8351b65e22bc5481e49d6ba0287c99985a92ed76d08da531603010faf70e2a0b305d80504d54649c2316e7de02d5452685fd50cf5d
SSDEEP 96:KC0d+qw+CWJKhPPf36vstt6ESl8h4otoZ45+vYDWB6VGyvr7jAixwzFWV2Kegu0k:KC0h2WJiigiUziuG1qj9x7V2KeguUG
TLSH
T17CC12A76A87CAC379AF7D645B5032D43CEB426ABA6047E54D6ED1E0C00E71ED2393623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e72d26b-4c95-4d83-a135-fd7e9d0901ba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7e72d26b-4c95-4d83-a135-fd7e9d0901ba.tmp
Size 4KB
SHA256 352f71daf70a60ac3157d01e47be6e9a53ca86fa3ab63940841d8158496201be
MD5 d46f5bd570b4eeca2225f05e6dcb19d4
SHA1 b1984c5abc2d11430c22987c77acd6c27d499ebb
SHA512 e32419d1b33a5a45c1cd88035b386cab12dad5a6030acfefd31a5c9a8065c3b5939b4a7e436226e42538f64fc7bf9398eca82136ee28fe0f94f7bfdbee7e180c
SSDEEP 96:9C0d+qw+CWJKhPPf36v+twERDotok5+vsDWB6WGyvr7w7esbm3v4a:9C0h2WJiiniDUDi6Gaqw7esbC
TLSH
T10BA1087694785C7B89BAC685B9832A43CEB0236BA521BF44D5DC1E0811F72EC1392A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f9a21e220ce7232c95dad34f0ceb290496dbbf4d1fcc0f5e17911409f73cfcb4
MD5 617cd5c9991a272457976928eb35b807
SHA1 99be2eb1ead0590e2b73ffbdbde54951540602c8
SHA512 a5dfe7dc0f0711ef62e6ac419c6c4edb5f7ae675e42bf339fb8978bb97209b5a3dae387b1587a1033039d9e04f0562f309b4f2516756243a9066a653e35bc716
MD5 SHA1 SHA512

Submit Download

0b083809-62c4-4d90-8aff-f45fb2d1d0fd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0b083809-62c4-4d90-8aff-f45fb2d1d0fd.tmp
Size 11KB
SHA256 468b18e51708615a7cb46f5841edb8803f626c2e1f34f4f2c407a7c1460ad91b
MD5 51ccd7a194093a18d50d7757d7263a3c
SHA1 7af9f0a8c7ff98bfd6ed4a8352ff21a08d5a51d0
SHA512 590977056358b07d5249cbafff149147de75c302978f922bc2a7b0cb575d73cc5e6c5bdf18f3b83a9d1b489ac6e5e569e708e5dafe2f73ad6e94ba7c5c420e9f
SSDEEP 192:xBR6nyAXXv7dvAPRp2F9JHsb+WNnzCsPkakgrgID4QzjTkwUa+VyIsnAUge:xBR6yQ/p6XCHwOsPkzQk2T0a2e
TLSH
T12232B52EED24793B9DDAC219EE627753E3F5112131942E84EAFC892C21D76CC6227057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dce1f759-896a-4fba-bbf7-1823c5dfea54.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dce1f759-896a-4fba-bbf7-1823c5dfea54.tmp
Size 11KB
SHA256 b02a7a140b03e59bce11500225c2a8f7c95191067a5834f0adc31294f1be5527
MD5 1e5438eb89d255376c8f2e39f43a143c
SHA1 05a1c1d4fb615a86b80678cc2b2362432bdcdbfb
SHA512 1f5c3f61ac75bb09db5f83c61fc1d61a3ec6c0aed9da22eae347eda33c0d4a3a4ce1b057fe0e6a1bc3082cbd90b9c3ff9fa07d221d4e8e5b8738a4ac06d17ee5
SSDEEP 192:ezI4K6i47KxkXqK4I40pUZNCgVLHrKHfFKslEe75XzKD/dY+ErUkKN9/qSXnhHpi:uIj147KxkXqKf/pUZNCgVLH2HfgslT5x
TLSH
T19932E727A48D9E3F4FDCD50DCC126F8BACF4429663680D2852FB9D0803A578E515A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7127858-2d1a-4e56-8617-db31c84a6e86.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e7127858-2d1a-4e56-8617-db31c84a6e86.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

271e914f-91d7-4aa9-b955-2d23eee82f62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\271e914f-91d7-4aa9-b955-2d23eee82f62.tmp
Size 37KB
SHA256 7949e30119baf7b3dc1caddccad4f4d2824de6680ca88149399c844b9bde0ada
MD5 09450b6fb81eb0250d768b0d540df744
SHA1 5787b9711d3a5a5ef80301b0e9c746d35913dffb
SHA512 643950d455dd9c0c560ef4ceea36376f1ca99e709e10da5011d48d50a755f3138edb28afa381db9e2822c0ec6dd73de4989ae8f24436b663cda971ad370f9e52
SSDEEP 768:h/UxvxjgC+i3SQ9TOfqfdlzwKJYe1ELsAvC8/YMUHOSHrkw:0Zj3+i3Kfqf7zNYe1EQujYwS4w
TLSH
T18F03BF36ECB48D375EF2A388774A5713EEF4812395C45AA486DD2B0D06C72AC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94672ef3-75af-4714-961d-efb52d27d730.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94672ef3-75af-4714-961d-efb52d27d730.tmp
Size 38KB
SHA256 628cdae0850a6be79e98d5aaf19c3959efc2ae6d9833f727002a965d425679c6
MD5 8801652ea2e0df68a8bc29c4a224daf2
SHA1 6f71468eed49334fb2eaa33d5b6dd35dc54a6aa6
SHA512 75154d676761d06041e6adfc0356be42d53376008d577edb9b005ec78678038d4aedaf675728e4c8a905ac3e5bb2aa71ad9334364ba0caea9e01ff934c1368f3
SSDEEP 768:V/UxvxjgC+i3dm9TOfqfdlzLfdxz3yJYe1ELsAvC8/YNiSHrkw:4Zj3+i3Pfqf7zLf7zwYe1EQujYYS4w
TLSH
T1EC03BF31EC79CC735EF2A288728A5793EEF4052398C45AA4C6DD2B0D05C33AD270F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 270ba8aa1df705d92f6fbadbf82e0d96c861b10dece72d4621f2502e3e5afe07
MD5 c6e6a98d906ace4f1b8923c1f3b8a516
SHA1 bf039306aeff15e1ddd9564265f9a0ff6a17e6df
SHA512 11dc6974b2d4dcb6fd88b759d6fe33d3beb2d4bade1d3792d6f35577bf898bef8f49d8c9c03b4281b6c278c2098c642235b749d3bba5746261415f71f413e300
TLSH
T1C1D02BB0B76DCCD3D01310FE0014AE0421A370159E0402802302484844001041201398
MD5 SHA1 SHA512 TLSH

Submit Download

CdmStorage.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\CdmStorage.db
Size 160KB
SHA256 40f0f1d38e2061e6a904ac3f66a37d21951b66191fe18719cf955500e651a804
MD5 cfef0cc289575418e8e2fb054b5c2cc7
SHA1 bf30e797003ef765440bcebc9f82884b87a81689
SHA512 c5f31bbd155e22c2ba0a9daa349792040cd3c82ca06b6e5a877f1df7b57c2321ac83074cde63baec8a5e0383aadabd04925a257d7df77266bc22707da70795a4
SSDEEP 12:DBl/1LJ+CGUlzsFWwZLJXFOuceQh40O56HKxFxOUwa5aqfpbhX5fOS:DLlJ3lziLJXFChjE6HS6UwcBfpVX5fB
TLSH
T1DAF39E0F4F2438B1CCE24A7CB1CA25D51F3D151DDB0FDE5103A80874AD95542638C0C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d407f078-61a0-43d3-8966-1524da2593f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d407f078-61a0-43d3-8966-1524da2593f8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ealqgrvq.ww5.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ealqgrvq.ww5.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

0666d7ad75b546b68e1e4afc24e1b853.db

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\0666d7ad75b546b68e1e4afc24e1b853.db
Size 138KB
SHA256 cd7f4339fb75d02a3741aea98d0a15d5e1490e93bc547abef97df3acabbb293e
MD5 ebc75d13ec86b4af2feb1870ac1f170b
SHA1 025925dcc01343a4d2529535fbe0986773e0448f
SHA512 fb67eb0c17e27ecc4edfdd42be996e14259381cc8e4d3b9c6aa29512f27716bf5801940d2c60ef3039f289d0b7d612dc2e61661eceebe2eb37214402d08e088e
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OrnpX6MCHVfqgVumBwkn8in:zeuvBnhJsueMEGvIW1DcP2OrBmVumBnF
TLSH
T1FDD3874B3A743102DDE58A726CF050BB5E3CB16D8F55A1D428B620688EF2953A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2768f289e7df4dfaac5f5c9fe284ff85.db

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\2768f289e7df4dfaac5f5c9fe284ff85.db
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28524acb4d244fc197bd7eaef10a500f.db

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\28524acb4d244fc197bd7eaef10a500f.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9240c25c-5f08-4db1-b440-22b410a2d06c.tmp

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2\9240c25c-5f08-4db1-b440-22b410a2d06c.tmp
Size 37KB
SHA256 8e2cae745cc965d1e714397e98733ffc8415c7332857859e1f47a27997175383
MD5 07ce2ff18ae57da59419131c7ab73662
SHA1 ae4f9f87df4419ad25d978bcdad31e15a0d5891a
SHA512 ccd25e3d42e009277c9d3b7ac3f0316fe2f515101ce8c2b41d05553f7dddd2590139c46a3f8f113585026c6fe810e1ad9e13af2c4cd324f5948def515e68dd5d
SSDEEP 768:j/UxvxjgC+i3Ea9TOfqfdlzwKJYe1ELsAvC8/YNL9SHPa:2Zj3+i3efqf7zNYe1EQujY/Sva
TLSH
T19803BF31ECB99C735EF2AB88764A5757EFF4411394C01AA8CADD2B0D05C33AD230B85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2\Crashpad\settings.dat
Size 280B
SHA256 594de5aae682bd8eaa4e496f9af73c963e4e2516722cc1e08a0bf45d588c6bfe
MD5 c1ddeed16c2c5476d600acbd0ff064e2
SHA1 180f09f8c8c6e80eca4f9d457b6f2431685d2445
SHA512 bfed5b9a478c1bf0ce2d50aa9e46dfe689d07c1c14f54905cc828303413dc8fb8497d599a18e2ff700b14bf3b768e65474f676f456e23c5743471419028c49c7
TLSH
T1ABD022323E00A823E8A22832303020A0F30A200E000C3C0C8A00A22CCFFC02C02A33F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2\Crashpad\settings.dat
Size 280B
SHA256 3c1b1fa62a344e4a567a90779e1605ac60ab036bc9f7a3c76a00fc77c3f5318b
MD5 c5b10f72d28abaee7e08b3e15eb0c121
SHA1 4be4616d9c285d5bf96f362c36cb79197d4f24e0
SHA512 6f12db17ac65be496d1ee13e344d01d1e1de0d57b265508739d4cff363ed5a24c02d1f8b6688c4b206cb1c9103f4b10150d82d18e4631410e7b632d56208a3e3
TLSH
T1A9D022B23F00CAA3E8232A3320302A00B323800FA80C380E0200A22CCEF800C22032FC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2\Crashpad\settings.dat
Size 280B
SHA256 472ed73ae7f86340f9fe94b76d3ffb6cab5757781949860e11737aaef1c0bd0f
MD5 61b9171fab21a6ac8be4a93742658494
SHA1 ff8ab538856b6d1fadf362ef6994d56c4eab803d
SHA512 8a825e3d00af4badadbeb3ed21499c193c5212fbc0c746bdb5e54ff3211779b677ecd2bea86f107f37c9293e342be17563b4b1b5dd37ba03430162444ba205e4
TLSH
T1EED022E2B32282E3C8232ABB00388F083B23C00FEC02200300000A8C888202832038EC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2\Crashpad\settings.dat
Size 280B
SHA256 5e403c36b4cd20e14ecd776a831819b30eb55df72b363d689fbc675a6dacc47f
MD5 66508194fd5847e7d3df3118e0925023
SHA1 2125819d3a0c49037bad7451801b7792d6c7e0bd
SHA512 7135630e2e4225e7bbf4ff72d774d616a04a5057cfe65fabcbba2db0b15e53bace968239dd6522ea6c7a2fde04281c4834c9bac2dca60b2d97ffc53dc2d5f579
TLSH
T1FBD022E2B32280E3C8332ABB00388F283B03C00F8802200300000A8C888202833038C8
MD5 SHA1 SHA512 TLSH

Submit Download

99d4b057-36c5-49cc-b28b-cb8977b20247.tmp

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2\Default\99d4b057-36c5-49cc-b28b-cb8977b20247.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c31f4b2\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 52d2e97dbc2ca0ba01b6703a39a51127abc45641497a54505efe118af9783833
MD5 a9910f455309cab01f370947f133e24c
SHA1 4d94ac8b210549315dd7c68825853060f121fb79
SHA512 509828d03c29af41fd9992370d5a88a032cfcd68dda16fde2b07173eb8858c728dc23ac8ce6f372d48894ab8592b34fb72878275d2af7e63f01f49b834478f2d
MD5 SHA1 SHA512

Submit Download

363792b2-4667-452f-8379-733d2515dd09.tmp

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\363792b2-4667-452f-8379-733d2515dd09.tmp
Size 4KB
SHA256 f4cdd0353dcea12ef4ccd76bc46384f61b431894c92ef36934b194f44a798e13
MD5 7850bb421a8d358259059a58dfc26fed
SHA1 b0b645651c8bc113c6e7998b75f49df283acb955
SHA512 2df4cad415b4bc2285f20e4833f403ac2673b5bd5012ffd7a03f407410655c8ee8adcab5d11fcfa6e9ce2509a1ba2cc11c4eeb16cd68a77dbfe47ca8c729641e
SSDEEP 96:9C0d+qw+CWJKhPPf36v+twERDotok5cSvsDjmB6WGyvr7w7Ksbm3v4a:9C0h2WJiiniDUD/6yaqw7KsbC
TLSH
T16CA1087294795C7B89BAC585B8832A03CEB4226BA521BF40D5DC1E0C11F72EC1392A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Crashpad\settings.dat
Size 40B
SHA256 1a991990e655e3877e7bb4cad47bca4059da0b13e0d7218690ccae3951271907
MD5 c1806d67e3da2b9f4e7b8d29bc09c280
SHA1 dc0813294059645886a921af8900cfa11d4e41e6
SHA512 549bef72a187d184eaac11a98c205292c634ca753b7c895c35eb6fa694ea13b681779f8c4ac54ae60cd01bc591844f81606d19b2c0549eee36020085e303718c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 1a89d8c42bafea69dac8b545f651f65a6b7093ea9f369bae439f208d89735ddc
MD5 711d744927edc3eb4ed28e705de0f8f6
SHA1 e3565472155e80cfd717dbc5e1146c899a2db48b
SHA512 7b00392e6fe19db3dd9fcf5f6b4e47bb666c65d4af2cdf9d4ddf5d08c0e209f68d7b114db0c2effd560d357782cc372e43371128ac1b58c4674ff88fc63ca84b
SSDEEP 3:MsFlYhXllLlX8lGJM5+ellNt:/Fiz10eden
TLSH
T1651302DDF7804417C10832B88497976073A0D58C9D2E67B3B8E19D722E48F400D00A04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 df18392f7e821b549cc0628c82f75dac8a0c9ad3984549cca2e16dfbeae3c704
MD5 a374571e2cdbd21d96c5f68d6a763d3a
SHA1 aa448261a41a25eb366dd5d5819b73c66e9d7a9c
SHA512 ed13ea01de62672e7c28acc576a28aff2ba1c63bad75dc7481fabfc2bd7dc85712b6e34e06f92557d200ec0c5a685c05c2f17cce4732fa0f3dfbf79a68a69be4
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\DawnGraphiteCache\index
Size 256KB
SHA256 05c4ed4d37bc98ecd67fd29eb1b4f3f3fe61e64070e52125c3c1c44270d49101
MD5 2781806ea9bde229936a7b1acc4f32cd
SHA1 8e198a16d941c8bd4f6b3f3f619d9a68b271a8ac
SHA512 d9b7749d2e6f73db2de2572c24c970f2efb8393da48818c8cbb1ca4cba14c72ba9300701164ab62197daeb52b30304bf37e1aa8e266bdd28121bb5131222ef2f
SSDEEP 3:LsOllllklkXlhYJ:LsUlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\DawnWebGPUCache\index
Size 256KB
SHA256 8b3f9376f10220b1809cdab04e77da516cd061839377384de47b19dda8ffe0ad
MD5 0e14f38468d17790e1cae862510b6ac6
SHA1 4014ff174d44b1bce0234dfbe2ea7b77e3631f7f
SHA512 cdb93b5c712678af5bd36e0e172dde1e15f0bb54832d462abd5b1e44cf0af5fe9412458be24766b607dd45a92451dddfbfcd408fbb669ef0511c6d17ab18de24
SSDEEP 3:LsOllllklkXl1j:LsUlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Extension State\LOG
Size 318B
SHA256 99c175bedc44611abde470381e8c4623ae999edc39e23d828a63817f3c5699bb
MD5 910fddcfc35416d401ff71390518fdf5
SHA1 aabe12608c05533c06f778ac101c59e105767f77
SHA512 c2ea2b1b80863f6e89ded6157397442c3ca9c76b32cede7e2742fe5dd9ea268dd2e06086b0dd29216c81d156e03a28d5f0a61e3f2c9fa94c892201cade5cc5eb
TLSH
T152E026851759C36B896C44AB027A7B18DB513A1AF3CA3D144B4BD8882047503A279340
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\GPUCache\index
Size 256KB
SHA256 703eb3ece7267b1cbc30ab69a1cc7f6dae8331d24f8e470a1d8f0e36f01a408c
MD5 5a6526739483df7b3fb62adfb4f90952
SHA1 51a386996af2b426f1749e1b3a7c72223df06198
SHA512 85041551da1df648bf02544a995f8613afbe2b597604ac97800b29e19818c69b697706abe8774265432f722f01c705ea8b5af5a8a0bee75d369fc6bf1a78711f
SSDEEP 3:LsOllllklkXlnjYK/:LsUlPka
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Local Storage\leveldb\LOG
Size 330B
SHA256 0f2606c54285e5a30aacd076ddb05a2e1f9040464ba172722293d98cc5167b7a
MD5 1bdefe373f9544e81df1dcdb48006bc1
SHA1 07744c83c8ed51e2a5aa5bc34f1ffa094752e9e5
SHA512 8323d38e01289d14fda7611fdc80a73dbad1246597327cced5234e2d3a51d12bc88dc5f50ca4c07f22c02208f4ff81a36eadadb29b37af525004a40922ea360d
TLSH
T1BEE0D891475EC26A031C401B417A7F48DB21281EE7CF3A248B56E59970460049251282
MD5 SHA1 SHA512 TLSH

Submit Download

7e88d798-33d5-4e36-9692-2ba996d1d22b.tmp

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Network\7e88d798-33d5-4e36-9692-2ba996d1d22b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Service Worker\Database\000003.log
Size 80B
SHA256 b7e25784d1b3a3653c618822715dae7cc86bf0b05fff0cf3c5d6a1fb169f0614
MD5 8da62954b0b14642cf287a260418e39b
SHA1 e82bf98669ae1d73bbd9294d9f454044d5c2622e
SHA512 e44dc92caa0579a81cbf176a589493421aad851d7006603b54684ee8cbfc67f572f2b0219f4483227f3ff9cc614d882b2adb8060873e358c7d6870caf9e3865c
TLSH
T1C3A0220B2F280322E88000F38C8C30080288800C83FE038302233020AF2CC80322A200
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Service Worker\Database\LOG
Size 291B
SHA256 f4ef79a66c1e3c873c74e6b88bcb864a56d2f7623ef49fc575afbef25a5f9bc3
MD5 97b38301dcb7ffc7e1cc6b0861f9d4a0
SHA1 6ecd191999d57f4b8d8b6b7275ffb9c5d11db709
SHA512 e34bd4ff3e576f164618c6c9501602cb67edaf322148c4d8718dc056a8753c3e610f56f65cb4ec8e4d5a48e0f88dadfc2029c830f40478259be6864363ef93f0
TLSH
T152D0C20147C2C37B067D41970A32AB08DB58A42FE7DB3A188FF2D64810CB80EA476240
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Service Worker\Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 2134f9684af20cb62fdc46b026cd7c695f22bc28fa6cc0c7ae5bceff7a54d9c3
MD5 3c73f258e2b4cd5c0c6c2bc0b04dc168
SHA1 538ae49507c72b12ca851062ac65253ee43221ee
SHA512 74d3bdf95e553b6f3f6c8c49cfa850b1ef8803b9fceb50217867695f04946b8f7cade56a50907ed28db12ef3697700f8a9fef836fdee29e8434e3717ff9578e1
TLSH
T1E0A002514680C110C20016B42C43838D1206B96581151217B6D09756CE604904911158
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Session Storage\000003.log
Size 156B
SHA256 00dd3c8077c2cca17ea9b94804490326ae6f43e6070d06b1516dfd5c4736d94d
MD5 fa1af62bdaf3c63591454d2631d5dd6d
SHA1 14fc1fc51a9b7ccab8f04c45d84442ed02eb9466
SHA512 2c3184f563b9a9bff088114f0547f204ee1e0b864115366c86506215f42d7dbf161bc2534ccaee783e62cc01105edffc5f5dabf229da5ebd839c96af1d45de77
TLSH
T151C002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Session Storage\LOG
Size 318B
SHA256 ff4b24e4498a79c7de58aa6fe74317134e9174cbbd8e5faef100e05164b2de4c
MD5 f4014313e750047d82340d422c33fe1c
SHA1 1f2da7e3ac3e55fafa1173f1b8b68c423c4fbc5a
SHA512 157a6abc9ca991a2c4b5eac6a0e90f85f7dcd06e64fd9e3335525bcb7e423c64a1aaafb7b11ea75d6efba1e078d02845311890b073f5dd92271cd094aa4ecb8b
TLSH
T177E086A5175DC33B037C903B017A7B18D7A2681EF7DB39145B52D1982147416A7B6290
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Site Characteristics Database\LOG
Size 343B
SHA256 6b9eeca309a9f8991d1ce51143549dd15f35ca6230dc9b73183c494f9e9da0ff
MD5 84a71778dc83f3e9a258bb3f2d47f100
SHA1 e5dc656ded0d3ce97980d24857e59b751b511658
SHA512 bbdfd7a7a9de65b2038b6976c047d46399754e28fd3c0c65ce64706cfdd156c30d533df34c9eca9db565bc0ba73a70ccc3313c0819bec7b34b88106b4cda8522
TLSH
T1E4E0DFA657CBC32B02AD102B023EFF0CD6A2681BF7DB35246F26E6846247000A362280
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Sync Data\LevelDB\LOG
Size 319B
SHA256 23577e0c0f046644689968710105b2a99a5dbfc90a04a166ce57c4178337bf2a
MD5 734a82763d7fcf729e4092966868d750
SHA1 674d13e12a10c50c424468f3852010ed1bb89811
SHA512 38168a4688dc8fa0ad4856501ecfdad7ac5203d13c7a1ef73b7f856751bb2eac47d8d406c39fa4501bd94a44cfe334e2d01ac55f2e04ae59aa41d2e290d9309d
TLSH
T19AE086B147CAC73A055C51570179BF1CD7706C1BF7CA36689B15D484A143115A275680
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data-journal

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\Web Data-journal
Size 10KB
SHA256 10a0376580de83706b97b4642492f191e3c9df0f006ab230169a827dd6830bf8
MD5 448315698efe6aaf0d10b45baba4b389
SHA1 16f5f32d8949de09f878368afdd565f9468ca14e
SHA512 ea5112c43dbcebda3784b6bb89a57b7ca4f5ffcd5859cf6f96166fe39fe889bd6916a17d356373d4ee8a8cf1799b7df445c682001b0b829862cf8c6dd56df559
SSDEEP 96:OeinSYYCWs3qvUCKvsHV/QIPCgVumrdfW9wkOM8im:OrnpX6M1sHVfqgVumo9wkn8im
TLSH
T1AC2242A335847053EE78D9BCA497364C8B02B1A9CD95D2FD607018584AE1F63519F1FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\shared_proto_db\000003.log
Size 18KB
SHA256 5de93a741af874f17e94d7fe6cd53cd2ba072b95e86158ca258d045ff5e1246d
MD5 c84a15d85625552a7dce62e2585f2c82
SHA1 23980e119471e45f7c642d3bd554402515e78ced
SHA512 da241648ea880454d5c76b5813834b0ef08fda0a0ae5e62cca134c08f7b8fc333a6f50604f8cc9388b484e5129cb0c7e8abd2f2c4da1ca16fb5c72055cf8f561
SSDEEP 384:0PidAsdGpYBuAhx0sdGVzqoiuRosdGwrFcosdGx3:MtYLaGoh1n3
TLSH
T18E82B5AAA3B11784CDCB93FFBC94CD3E03339D8944BA044294A657B83893E07C98135D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\shared_proto_db\LOG
Size 315B
SHA256 fe9b72a405d13c1ff526ccfd9cacaee295b1cde733b4e92f01ebd4b93e0e17b8
MD5 717e544abce84b27531a06690d0a3250
SHA1 897074eac263c36c808f3a677164230f6b61966d
SHA512 7e4a2c496efc0f8ecee661c7bc04216a963c785bb3034cc70a9a39cfb59656140d30707237b0b308ab4d32f49739c7498560c7aed9921e031da784e8966333fb
TLSH
T196E02686BF89C37F912C001B0236AB05E720289BFBDA35188F22C4885043101A2B6280
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\shared_proto_db\metadata\000003.log
Size 808B
SHA256 cd0bb357a39d4eff9f47324f0e23d1a792ea87e1e633cb1916d30f169c9e672e
MD5 92aeb8277fbddd10897a865293d9e303
SHA1 b1bd6f807d8ad5fa1af898895eecd6460024dde1
SHA512 59bc253c6f74f242d46a04187aec8db1c8ec486c8db7fc2969f51bf3cd66ab3c968f64f73bc3c570d9f3889efdf907860a238c1c30b0680389500b5d6fec9270
TLSH
T12A016D16F730C114E14A923A646AEB251369D9529FBCED0F443560293E72A201E8B6E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Default\shared_proto_db\metadata\LOG
Size 333B
SHA256 7903ced87e19772549cd99e88e67f059a075ae4b1e9cbafedd65365243c3d44f
MD5 6274a0e5bdf7a7d1a034fc5465e1696b
SHA1 4b673a880fd89dda65410e8234cac3c3f53f0373
SHA512 aa28374d5def19e210813edc96a13d232a72e84b25cf7ef8a4d8b54b4b3366a33e9f2c4c43be7aabab1a06b28500ae26a36fd72f2fc679df664a651c0302610c
TLSH
T138E02086BB45C3AF417C001701BBAB44D7512C1BFBD63E144F53C5486043005735A241
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\GrShaderCache\index
Size 256KB
SHA256 5740e399fb0bcba5adc0161efe83d2c0206f01fec0055705f59fcf53a4ede87b
MD5 14fcdb77d3f20ae053146e6a12dd887a
SHA1 0757f79549c2dff6078ea1cb7d403fea39f12959
SHA512 9b7608231c30310364a7056b6697d886c9190248320261b6e76e57827f1f2d5d9a4c91164fda40ef5813899e96bd3fb0a50f0bc270fdd82d22698e714e2f2943
SSDEEP 3:LsOllllklkXlMtk:LsUlPMt
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\GraphiteDawnCache\index
Size 256KB
SHA256 91dce527f03a5a773e82412d30b0c7829f4551261cc0c7334c48bbe537552f4f
MD5 3133612d0e048b97819d0f5166ee560e
SHA1 b55a9028b5a5a879b96f28f69c138dde0c0e9f15
SHA512 92fab7e28f3db2db4415b0b0a7a6b423ef3b0d1e03a89344257e2503061f6bb1945b57613ba843385fdf2a4d9497cb63cfc769958061f08b0b316be2f389e11e
SSDEEP 3:LsOllllklkXlHJ5:LsUlPHJ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\ShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\ShaderCache\index
Size 256KB
SHA256 1858f89fe8936192a0ff4c770e57da45f54084ae3dda5551e39ee16436d1ac29
MD5 80e6f73e1657eb2b1695cc1dba498148
SHA1 5b5d09df0663ca71850834e641808e931cd758d9
SHA512 e1f6eefbfd0153d3214bd4da7d0d256d737d959f315ad2b5bfdacbb21e7bd87a8908c032a872d7780a86b40c18a3e1aad1b05d89398cb38c39eb5f080dca05b1
SSDEEP 3:LsOllllklkXln:LsUlPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\c431196\segmentation_platform\ukm_db
Size 48KB
SHA256 7434597d22726641acf6c1817319992b54ec582f0a7474d28dab085fe2f3747e
MD5 a9ae40fb5b25887e90a305a17a7d352f
SHA1 81c9a3d4ea776de2605c894f759d773e2eee77ed
SHA512 dab18020ef0e0506b4f0f2fffe09c502aec24955ae1c5a3072f21dfa1df1f98be0a25bbe1953fa2c0ac3f6cab3b111ceb0f5e81b6cd9a7bf217713e45acd3389
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0JQ:TkkhCU2QB2zbBxx
TLSH
T18D23490E5A6821E9D4D9193EFED34C517DBE0F588A2B78D205E00C768CE21EE553E4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\logs\cookies.txt
Size 32B
SHA256 5cc3752db5dc00fec7c7f01fe0b97b4d3d2e923676b2eb7d36714a660999a6ab
MD5 84517da404e303ced18ecabaa6c6457a
SHA1 6d6ecef8c4a50ce0ddc82544ea2278c65a9156ef
SHA512 98cc5d0fea4367edab7e5e0780809dd75a896020bf45d5a2a5c00fc57e72bdf0a1a13b454a3599100d4314679c02a0c16f4635f75bc75772a956de7743f43e5e
MD5 SHA1 SHA512

Submit Download

passwords.txt

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\logs\passwords.txt
Size 56B
SHA256 da9b916004a57e1855df096af5211d0eeba0cc7d90fe63c786d7a77ba221bc5e
MD5 3cb32ca1f8d23130e604285d298aa4d4
SHA1 88bda6769997b8237f180b7fd59ea90f7d3425c9
SHA512 e19a0b48f3714fa9f30f5e8e17cae7611a2a77ec8750f596ded6f27b915148694c6a63fc674353fe89d1ad0d47882fd1d4b039547efb8d7f462fac795781fb88
TLSH
T1479002F4410718761A69C100000D14062CA5A442C0872641B17E5A049575897CA86A8B
MD5 SHA1 SHA512 TLSH

Submit Download

roblox.txt

Path C:\Users\Admin\AppData\Local\Temp\wa4d4f27c\logs\roblox.txt
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

memory/4796-22-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/4796-21-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/4796-7-0x000001FD79640000-0x000001FD79662000-memory.dmp

Download

memory/4796-10-0x000001FD796D0000-0x000001FD796EE000-memory.dmp

Download

memory/4796-27-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/4796-11-0x000001FD796F0000-0x000001FD797A2000-memory.dmp

Download

memory/4796-24-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/4796-23-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/4796-12-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/4796-13-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/4796-20-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/4796-19-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/4796-18-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/4796-17-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/4796-16-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/4796-15-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/4796-14-0x000001FD797B0000-0x000001FD797BA000-memory.dmp

Download

memory/5696-1-0x000002102ADA0000-0x000002102ADBA000-memory.dmp

Download

memory/5696-28-0x0000021044120000-0x0000021044648000-memory.dmp

Download

memory/5696-25-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/5696-187-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/5696-29-0x00000210437E0000-0x0000021043830000-memory.dmp

Download

memory/5696-4-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/5696-3-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/5696-2-0x0000021043A20000-0x0000021043BE2000-memory.dmp

Download

memory/5696-0-0x00007FFCC146F000-0x00007FFCC1470000-memory.dmp

Download

memory/5696-622-0x00000210437A0000-0x00000210437AA000-memory.dmp

Download

memory/5696-623-0x00000210439A0000-0x00000210439B2000-memory.dmp

Download

memory/5696-40-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/5696-108-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/5696-119-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download

memory/5696-649-0x00007FFCC12E0000-0x00007FFCC1C84000-memory.dmp

Download