rhadamanthys | a86d3039451a065cfe9f9418303f3d3205b0fb53d1a5b5a5d3ad7cb3a3f437ff

Analysis

max time kernel
387s
max time network
393s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Set_up.exe
Size 694.4MB
Sample240812-hhf2sstfnc
SHA256 cb028d96132d018aaf2c9df7c8bc0bc26aaf09352e386351f99b739faff2a220
MD5 c03b508c97550c36deec734daf5ca494
SHA1 b58f764b523f991afde4e40e7732f6ca2c0f0dec
SHA512 17ef24ef5284fa58b53baff84fb9d8a0b1a6d603c4a2df84363499b38f9e4b18442b182c2085815485d96dddbe4f50406bfe547f54c4690463731bd6b9cf2bc5
SSDEEP 98304:GUpHnwnSJqMtyOT2XEOVN0KhESKDsolB+mXUOOLmC/f:1rQMtyOT2UOV+KiSKZ+CDW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2308 created 2636	2308	BitLockerToGo.exe	51

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1760 set thread context of 2308	1760	Set_up.exe	100

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2836	2308	WerFault.exe	100
376	2308	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133679188747992966"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{1FE901E1-44F3-4C49-BBB5-6E71EAC44345}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{5C085C8F-F702-4C5C-BC9B-C0C19EF415FA}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2308	BitLockerToGo.exe
2308	BitLockerToGo.exe
4284	openwith.exe
4284	openwith.exe
4284	openwith.exe
4284	openwith.exe
2392	chrome.exe
2392	chrome.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5780	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeDebugPrivilege	5476	taskmgr.exe
Token: SeSystemProfilePrivilege	5476	taskmgr.exe
Token: SeCreateGlobalPrivilege	5476	taskmgr.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe
Token: SeCreatePagefilePrivilege	2392	chrome.exe
Token: SeShutdownPrivilege	2392	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
2392	chrome.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe
5476	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2308	1760	Set_up.exe	100
PID 1760 wrote to memory of 2308	1760	Set_up.exe	100
PID 1760 wrote to memory of 2308	1760	Set_up.exe	100
PID 1760 wrote to memory of 2308	1760	Set_up.exe	100
PID 1760 wrote to memory of 2308	1760	Set_up.exe	100
PID 2308 wrote to memory of 4284	2308	BitLockerToGo.exe	101
PID 2308 wrote to memory of 4284	2308	BitLockerToGo.exe	101
PID 2308 wrote to memory of 4284	2308	BitLockerToGo.exe	101
PID 2308 wrote to memory of 4284	2308	BitLockerToGo.exe	101
PID 2308 wrote to memory of 4284	2308	BitLockerToGo.exe	101
PID 2392 wrote to memory of 1176	2392	chrome.exe	116
PID 2392 wrote to memory of 1176	2392	chrome.exe	116
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 2396	2392	chrome.exe	118
PID 2392 wrote to memory of 3532	2392	chrome.exe	119
PID 2392 wrote to memory of 3532	2392	chrome.exe	119
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120
PID 2392 wrote to memory of 4408	2392	chrome.exe	120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2636
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4284

C:\Users\Admin\AppData\Local\Temp\Set_up.exe
"C:\Users\Admin\AppData\Local\Temp\Set_up.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 432
    3⤵
    - Program crash
    PID:2836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 428
    3⤵
    - Program crash
    PID:376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4396,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2308 -ip 2308
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2308 -ip 2308
1⤵
PID:2752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff964f9cc40,0x7ff964f9cc4c,0x7ff964f9cc58
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1896,i,5850092577757462457,12473643997796360955,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,5850092577757462457,12473643997796360955,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,5850092577757462457,12473643997796360955,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,5850092577757462457,12473643997796360955,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,5850092577757462457,12473643997796360955,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4580,i,5850092577757462457,12473643997796360955,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4608,i,5850092577757462457,12473643997796360955,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5040,i,5850092577757462457,12473643997796360955,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4884,i,5850092577757462457,12473643997796360955,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=580,i,5850092577757462457,12473643997796360955,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2060

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5336

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5476

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6008

C:\Windows\System32\3uu4gi.exe
"C:\Windows\System32\3uu4gi.exe"
1⤵
PID:936

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=3uu4gi.exe 3uu4gi.exe"
1⤵
PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4136,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:1
1⤵
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4940,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
1⤵
PID:5864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=5432,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
1⤵
PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5588,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
1⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5616,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
1⤵
PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6056,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
1⤵
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=6016,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
1⤵
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=6324,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
1⤵
PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=6428,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
1⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=6724,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
1⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=5300,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
1⤵
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --field-trial-handle=6800,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
1⤵
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6688,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
1⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=6460,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
1⤵
PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --field-trial-handle=6104,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
1⤵
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=6892,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
1⤵
PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=5644,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
1⤵
- Modifies registry class
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=7152,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
1⤵
PID:1324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --field-trial-handle=6224,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
1⤵
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --field-trial-handle=7236,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
1⤵
PID:5164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --field-trial-handle=5712,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:1
1⤵
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --field-trial-handle=5700,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
1⤵
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --field-trial-handle=5392,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:1
1⤵
PID:5240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --field-trial-handle=7256,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:1
1⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --field-trial-handle=7188,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
1⤵
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=7744,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:8
1⤵
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5884,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:8
1⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff95e63d198,0x7ff95e63d1a4,0x7ff95e63d1b0
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2280,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1972,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:3
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2240,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4352,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4352,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4748,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --field-trial-handle=4272,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --field-trial-handle=5140,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5548,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5600,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5712,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4880,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4920,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3368,i,12195359108951989316,9328033070913151312,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:5128

C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
MD5 d2fb266b97caff2086bf0fa74eddb6b2
SHA1 2f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA512 c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
SSDEEP 3:mnlllGlll/l/lXp9ZjrPBY06llSl/gX/ZP:mll0dPBY0O0uXJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 944B
SHA256 878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
MD5 6bd369f7c74a28194c991ed1404da30f
SHA1 0f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA512 8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
MD5 SHA1 SHA512

Submit Download

34c1ff7b-21d7-47cd-ac0d-304bb232af0e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\34c1ff7b-21d7-47cd-ac0d-304bb232af0e.tmp
Size 9KB
SHA256 b91e239adc4178f8dc46bd6c68304b708e1cce98234b7e393a0a0d20285caa45
MD5 5edfde06cc9d40f65c37988e1040a055
SHA1 cb968b4a2ab013c34afdbf913c16562681e90af4
SHA512 ffee36c596bac06d1175fb2f56e79bd8e449cb32141d2cbb03a7a7cddc515251da3205950fc06d66bcd9c82ffc56e7c2f8cb7fcc10b6b03c4db4831b07a00936
SSDEEP 192:U4nUtjB6ereHV+F908u7skwk8/KPo6yIsnVdg4:U4UZjqGjuoEIa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a03773dcdd8774e3c952b26b06d7f8500bfcfe272580f9d1ee27b93cb31c3baf
MD5 35593ae7a908cfe09fa6e2fe13726ff9
SHA1 778354e51bd63c45dcfb986f9224faca185f7594
SHA512 7427dcf4a0feb87df2ee7072f0a12e1f842e8b18564a364296ec85155f779c9030ecd749c0c6e07c33e91a9a6f5139b8e4dfa6b2156aaee4869883092d327aa6
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 210KB
SHA256 04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77
MD5 48d2860dd3168b6f06a4f27c6791bcaa
SHA1 f5f803efed91cd45a36c3d6acdffaaf0e863bf8c
SHA512 172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e
SSDEEP 6144:841Spcz/R+SPtJWSzfNE8VJBThCtc1wLulygOG6UlwJ:84aczBWsFRVJBTLEupOkwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 d0827f2fb23386dddad20e5bbee6142ad10ce78eaafa46901e37fd825d92af03
MD5 09aba0ad12543236884e95457ad6c7a1
SHA1 c28f36eb92a809e4c04cc14ab52f22a1b0f8171b
SHA512 fc1fdc101e5bc7cba574ca19b2a9d3d2f453bbec58f368820325499fdd773bbdd31c9589df723e1773b1dd552cf4e37726cadfb8f14b5b3574dec39866bdbc26
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 1bcbd40053205d16ef2ca502f9fcf36781383f89162f2d9bb95ef8a54ae83350
MD5 7e5a3f7621b5748676b87fbb7193b3fa
SHA1 4bd9b5f2b2cc6254374b4d5b08784cce8b02dd09
SHA512 3372c256adf5ddd8f35c0abeee6a9e141542bf5a941c68f8705ab9fa682b254fedd2ae0898fc128824cfe397aff4cdab1fd82cb47a6c5363bba2e96c3af2bf6c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 6881a4c3cf784b44cc7827c1b7d62c4e5a78a1e93e6984c037e637bd66ca563b
MD5 84de18014b811c4f6e0e38afed7df816
SHA1 5facce4267b25b5dc9dc68d011a41b466e8c5749
SHA512 20ea31a476686e4ece6871cd8919e8f3fb54f8a3cdb17d970df4eab3f8ee5f3bd0e4c649ce4c1756ff96617a3f44b843c75e9459ba25eb4cf4979c3a73f31d55
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d54f806258ffc3891efd01747816bb58f9adfd32c546f78d27cba2e5b2ad30b0
MD5 3d19f890f8f42c872c7f0daffa2bf540
SHA1 d2ac541224c9ab6da3a9fb239fe23bff42e23ad7
SHA512 a43414452db109bc5430deb6447d3a21370b4493e98622dfe575d48e7e8531d92145072435dc81b53fb87bbae18b49e6664313c277e54e96fb6f7a67db4fe502
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4ab2007e84f3fc92bfe64b0e8a09dddb23ad255372dc30085f3477d840cfe709
MD5 a70c5abc6340dddb23bf1ebd90f9a138
SHA1 610c682e3f6d8f9cd0afd8a7dec1f54d828f0e32
SHA512 d0b7ca6350b4931990c3d18ab13f8126ae5435e7d770736da9636254c3370cd2447f6198399f9f4e7d1a6a57d254a72ae12163d1ccc99cf90f61461c41159278
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6e671b3de1496975e5447bf24f725943a035d3ec7aedd73dca796099f501e7aa
MD5 3849aef6780814dcd782fc4ecf8097de
SHA1 1b35c73053ffbeed046490bef29286b932b46cc2
SHA512 b6214c2ec5d3df4c65bbc8ccf9468f611c6692fe1491f5d3a7ca79d30d49f101d68b04cf2efe8a926f27cfcc3eb7df5a47706eef091738006f160d7130a1e399
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 e9444e33b3ede1aab1782d76f5a0d433340de3e017dcab06e46beefe5eb51511
MD5 c13dabbd19759319b26b679d8aa0461c
SHA1 5b9c34c67efa949ffb3f188e00f45e0b3439a033
SHA512 c6aa2a751ab319ace4aaa7ab537ef2071127ad3642ba240dc1b56a669fdd9803da1db647ea5a2a9098161ef66f5037c8a72acd56d5600988b1fec2c5ba01d338
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 8d8a45e440653acf099eb837ae797dbebf6e76f9168f161c3fdc9b632956857b
MD5 153eec02532cf362f9a5075c31f50cf6
SHA1 7e2cb89ed850a49b01fb196ce98ae1539ae2b830
SHA512 bbe68ffd2bd86847c62733fea603e7caf4f862b91e7f5c4121c6392219323ded9109a7241b6ae6131a7e2bcb883ced23cde56d3e68fa864f7fa859d6a58a02cb
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 8420018563d408a86fba78207a8af9e66a0964049c4892d09782e4ea83f81f20
MD5 8f23abf65084a2f2f4cce97a47a0725c
SHA1 f06e834fa5d003e6710c8adb3565ff81e2f0718b
SHA512 a3b19128ee53d05400ecbca4f53162d1528fe5b4f288fb32ef7d41cd24ac5c4e577c576697a2c2e00c15fa603e129f8422eac878df0b2a0375e7739ebd134046
SSDEEP 192:U4nUtjBvereHV+FLi86hskwk8/KPo6yIsnVdg4:U4UZWqGP6+EIa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 60a076bd9eb6102eb90f4ccff6c86fff3deb7625e9a4cf257f272f7a42243e6f
MD5 004b45611b952dff170dc1a8aaa47c6a
SHA1 f13bc2a4659e810b1f4b47c52bc27b6813d94a52
SHA512 cece61234cf4d41f30fe1b00e4533db2c00e3a7a795bb87676bab6867469b7dac8aaad4e71b375663f85ffdf944fd5e70e3933084e5734d0c207dcea0467c478
SSDEEP 192:U4nUtjB0ereHV+F864sqskwk8/KPo6yIsnVdg4:U4UZxqGJ4sfEIa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 2e9fad1d72ed41143a2052811a115a2e8c7a6293f4708ddad7b63a14c406bc51
MD5 ced7256db312df506b19ab4682e0be4f
SHA1 50a3ea17de6fab3cd379e0dd058f400e07b90820
SHA512 d19dec2c6ed92146f9c2d917ddab3f42a42e9f40de5b3ea65f5a90e0618881e707599faef30cf3a2679f5cda5f13b72dc72085927fbed7ea9c66601d752aba90
SSDEEP 192:UXnUtjBoereHV+FzR40Fskwk8/ordo6yIsnVdg4:UXUZ5qGd40aEIoL4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 5fa900024f5b0c2d9853a217244d2021eecc54875db8f3de15829abfa5af38d3
MD5 9f818dd9f81f6a81f7f6cd0027e8c1c0
SHA1 f1326fe0c87bea9965c23aa7c4a6f410ee3667bd
SHA512 2dc46909813bb87c81f13f3ba87d7e46725de04306054953ffbf748f531e13175a495f60e48cbae86769ddcf6b4e8a6a2167cdd8ea41ad7d53fc64abd218f7da
SSDEEP 192:U4nUtjByereHV+FDmaGatskwk8/KPo6yIsnVdg4:U4UZ/qGLGdEIa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 a76ecb37593c4500f10c5ec7a6d08ff03fc37196ba044a49fdec52cd994f17cd
MD5 8376e3da2496a7123f635723b789c8cb
SHA1 cce040a9f65197b23bd6bed2d3035fea5c145aa6
SHA512 c8ba78f69bf0e826024b243ba6a8380bc8eff8128eafd3e1d78eca62db1e4e519ad96daf7979a3545c67871045416ef690e6938bcdf32502f3eb6cbdbc3d20fd
SSDEEP 192:U4nUtjBEereHV+FOM4Ikskwk8/KPo6yIsnVdg4:U4UZxqG54IxEIa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 da2433bd98254763c85a5a3ae7529701d941b68928de447a777030fd6d00e73a
MD5 8c78a9fb791300f1f6ba3741e0bd9f82
SHA1 4fc29312c6742911b2fbb50b0bc2cde5e7b050ae
SHA512 1ce876749a5b293d896701c85ec7bdf484ed137409e0cfefde51c06536c845234749d20dcb57719a5c025a6b231b2f11990594ef8924b1116b5ff2e80c35ce87
SSDEEP 192:U4nUtjBTereHV+F7Tkhskwk8/KPo6yIsnVdg4:U4UZqqGXk+EIa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 4fb4820838df9f93c16357a0529d93bc5e86069db35e03cdeb3e1f76ce7001f7
MD5 600c986255b5d2a3b6334dce7a3e2ca8
SHA1 375913476452466901f0ad8534c6c7fb5185745c
SHA512 e60bc18735d0dd017edf4c34a4b92a8960e34831deff8d5415123aa73aff97093ae135701f95b8acdc73fe4fd4407b8a295070ef65841356b9b1535fe2307c8a
SSDEEP 192:U4nUtjBZejeHV+FRgHskwk8eKPo6yIsnVdg4:U4UZKqGRPEHa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 1961fdb8b6d9c7106fc6f8956d424125d9050026215ad1e013fd15e178980d4d
MD5 fcfca8eb736ec38fe6c7372cf0464a7c
SHA1 ce853cd5c2f095bfbd34c6abd3d756fef60a6c0e
SHA512 25c0f60647d8fbd8cd418933a68a4c2b44b5f8178b0a280d8746ce334b095c0bb17a1874ae20dbf14dc7a20e4515c25573cb72f42db202c2012601ede2e48404
SSDEEP 192:U4nUtjBrejeHV+FRgHskwk8eKPo6yIsnVdg4:U4UZIqGRPEHa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 90f3ab8bbf156e7f2c365f5b83cee7f137c308b58160d2f0bd4b54cf21279dc4
MD5 05214fa2f37082bd465ac5afef6f17de
SHA1 7448507525c7e53927d7acb6bf0046a6d199a953
SHA512 8704b05007451767eb1ce2a108454aa4e34789c858639dd272dc4c43331b0fae889aeea2b23ac3d1c71756aa49fcc2d37ea010d8d4dd59959f74801d6a2490be
SSDEEP 192:U4nUtjBqejeHV+FRlskwk8bKPo6yIsnVdg4:U4UZvqGR6EGa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 7fe75089a778c3ea6977f669935497da0976dd4d8edda1bad401aa0af7c68374
MD5 8d8716ee6aacdeea77ecd8fb83c3375f
SHA1 7b56449bd609f9b6f28b5694db4587ea3055eede
SHA512 715b1601a6f4e4c6489f16cd558e05f50f8d26a1eb250bf7eef10fe175b5beab7f734af6438fae84d2e3218b703095512afdd5bb25be2780d3bfeefb09b6eda7
SSDEEP 192:U4nUtjB4ejeHV+FRlskwk8bKPo6yIsnVdg4:U4UZJqGR6EGa4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 f1727e16befa031a32f8f112a052596b52e0c38e28503f9367595cca2257fc3b
MD5 1fb266d03ff19b4d386dd7c692afb157
SHA1 15faa4766b6f87ccb27e345be586cb64ff5751bd
SHA512 fa7930e8be06bc401b64f27fe89c8d6eb39b02a2990fa36552099f5f2240fd22fd93748201440664580ca36eed06138d8bca5b9494f820cdb145b683d9d59fbf
SSDEEP 384:7/tg7pLhLc+ejmXgi1kXqKf/pUZNCgVLH2HfSDOrUCjHGwIyLN5:71g7pLhLn8sgi1kXqKf/pUZNCgVLH2HV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 9aa76ebf70927f5eeb7d0fe18f238f70d9684a605956188450ab3ab47f06416b
MD5 f4d483153caea55591e46bf1d917f398
SHA1 9daafc21a35bc7c6759b4146a0cd45a108183b78
SHA512 74b0e4f33397602d049d84ed7d2f5da612cbb0bc6b2e7dce24365af246cf1cd30c37530c631f5d791920e9f72b406bfa6ff920cd4ecc75afa6f63003829117ed
SSDEEP 3072:F30IaxbsWubS8TcdyK62LA8ML9CMQrxtNKTfLWzGH03oe35YUG0TFrmf7lJaQoda:GQNbHTcdhL3MBCMwKf5U3o310MBdodSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 d94b78d80281e30d66b91c2a204969774ddd0112f1aededdb06d55d28a899c4f
MD5 be186b4f48c5c15890580b2bbb0acf7e
SHA1 a8a5ffc746dac20fd0b50636cb56cc01d885f3d3
SHA512 9000edadf3af81d09fe178532ed646a6c8a5319b55cf0325e36dc2d13a6350e096c31609e6707a6da766dd9d265c62cda971c3355ffe6c3cdeee954427535619
SSDEEP 3072:FN0IaxbsWubS8TcdyK62LA8ML9CMQrxtNKTfLWzGH03oe35YUG0TFrmf7lJaQoda:wQNbHTcdhL3MBCMwKf5U3o310MBdodSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 90b70eecba124ef04a17705e70a5e1ce91212b756da4c311573518acfb6d0d3e
MD5 b4c7b47b303b55c5fe36bcab7fbcceb3
SHA1 8225d66ce4092d41c2b12999a4eb549bec52cee6
SHA512 63a9e9655bfcaa036675c366805f06575cab7f858a5a2cc36deb61f1b4d58d49ea3738cadc2a456b2e6a5a30cfe3ae2b0045e31c487e65e4b8484b4f1d1e0310
SSDEEP 3:MsEllllkEthXllkl2zEgltiyll:/M/xT02zjUy
MD5 SHA1 SHA512 SSDEEP

Submit Download

c5b79571-2381-4e97-8406-1711c1290b56.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c5b79571-2381-4e97-8406-1711c1290b56.tmp
Size 193KB
SHA256 ca1837388b461ba613b7b065fc8ea2725dd2c49d8e2484d92ffdaa1602cc3037
MD5 a380b5b69c0e17cf254494a72f8a5eb8
SHA1 e6b778f5e46a41919d8114e7bdc5cccdbf87c15a
SHA512 7bd5919ecdcfa61e11b9ba4bc8593522d1da7d61490f55195684d21b12c353673b348c8d526b1d46814d2bbfd505ae7dc10dac62bb79dc7ba3bd22e5cfedbc22
SSDEEP 3072:4N0IaxbsWubS8TcdyK62LA8ML9CMQrxtNKTfLWzGH03oe35YUG0TFrmf7lJaQoda:FQNbHTcdhL3MBCMwKf5U3o310MBdodSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 df2450a3d7ba5d1f68a7d373a0e14e38e63206801a20037e83feef71fe64c734
MD5 9458f8d80afc060aeb6617084ec8ec32
SHA1 69debd717a2099d8a52d0d84eaa77f3fb83da568
SHA512 5eef6e30502cd21c967d2bbb26ede34bb611e09311dd9bf69c293b782c4a48cacb2e95fdf71a21507486cddc97562be8e0cff9c3a57e6dfb8d445d504b177b26
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 34bffc5b70ecbf92be33a43855af3a5900e9c9d7addb033e391f96cce474116a
MD5 08955ba63025862bcbe9577e34612b8a
SHA1 c22df4be3667174c529011312d2e7a0e12fa9c25
SHA512 bee8e4294217162de548ced340b5a5a493c982bc8fa9ec7962b141053005cc0a9eefab7fbf26232c3b7ed361e60600f4d77907b6e7d3c0ae2b3de7a350c8a9e5
SSDEEP 192:sV4JRcB1IsfWckp1qCbPskZ8ptsHj++1Ij1zg0mtlyQGXIgGJ:sV4Lm1IsfWc8cGP6OHp1M57muv3S
MD5 SHA1 SHA512 SSDEEP

Submit Download

f60a6892-5eb7-4148-bcd1-219621586d03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f60a6892-5eb7-4148-bcd1-219621586d03.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 88KB
SHA256 9783976ee579173aab17261856756dbda2b973f9d7e77a0ef7b830ae7456cfe7
MD5 7f1a5d0e7afc03438071cb520377e78f
SHA1 d248eaf13e1fdcf6eba69d1e3b7089f6337d192f
SHA512 b3c225d4867e07ff445867b06cbe425de7b30dabdf967a67981941793a3125df9636d5c76d5c9d16f671d8ec89440fd646b1643aadadbd102333ddd0709a7048
SSDEEP 1536:CgeDL7Hp7BrJBbAVznVY3ScHqwzPtSk85v2zgnoIUQ2fsFofPdN:CgUHpdrLeqHqw5Spv2zufUQMsFg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 84KB
SHA256 5cd1a93c8eedae5b4b70fd188f78c2c2c4206cc7ee413d17d3f82584f93d4e06
MD5 89c18d69281833933aecbdeb6527c1a1
SHA1 621f31e83f8ee5a4ede962087472a229932c7db1
SHA512 0ab324a150d168dcc3d52dc8889e997dd5f8f630967ab6ad7e985b1c73e17db4123257fd15b5580d93951e8858618c01fadcdf7682a29086598c58046fc765b7
SSDEEP 1536:rgeDL7Hp6BrJBbAVznVY3ScHqwzPtSk85vfUQ2fsFofPdN:rgUHp8rLeqHqw5SpvfUQMsFg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1760-6-0x00007FF718320000-0x00007FF718D20000-memory.dmp

Download

memory/1760-2-0x00007FF718320000-0x00007FF718D20000-memory.dmp

Download

memory/2308-13-0x00007FF983830000-0x00007FF983A25000-memory.dmp

Download

memory/2308-16-0x0000000003A10000-0x0000000003E10000-memory.dmp

Download

memory/2308-26-0x0000000003A10000-0x0000000003E10000-memory.dmp

Download

memory/2308-5-0x0000000000AC0000-0x0000000000B3E000-memory.dmp

Download

memory/2308-7-0x0000000000AC0000-0x0000000000B3E000-memory.dmp

Download

memory/2308-8-0x0000000000AC0000-0x0000000000B3E000-memory.dmp

Download

memory/2308-9-0x0000000000AC0000-0x0000000000B3E000-memory.dmp

Download

memory/2308-10-0x0000000003A10000-0x0000000003E10000-memory.dmp

Download

memory/2308-11-0x0000000003A10000-0x0000000003E10000-memory.dmp

Download

memory/2308-12-0x0000000003A10000-0x0000000003E10000-memory.dmp

Download

memory/2308-15-0x0000000074F90000-0x00000000751A5000-memory.dmp

Download

memory/4284-21-0x00007FF983830000-0x00007FF983A25000-memory.dmp

Download

memory/4284-25-0x0000000002DF0000-0x00000000031F0000-memory.dmp

Download

memory/4284-17-0x0000000000ED0000-0x0000000000ED9000-memory.dmp

Download

memory/4284-20-0x0000000002DF0000-0x00000000031F0000-memory.dmp

Download

memory/4284-19-0x0000000002DF0000-0x00000000031F0000-memory.dmp

Download

memory/4284-23-0x0000000074F90000-0x00000000751A5000-memory.dmp

Download

memory/4284-24-0x0000000002DF0000-0x00000000031F0000-memory.dmp

Download

memory/5476-54-0x0000026782DF0000-0x0000026782DF1000-memory.dmp

Download

memory/5476-56-0x0000026782DF0000-0x0000026782DF1000-memory.dmp

Download

memory/5476-61-0x0000026782DF0000-0x0000026782DF1000-memory.dmp

Download

memory/5476-60-0x0000026782DF0000-0x0000026782DF1000-memory.dmp

Download

memory/5476-55-0x0000026782DF0000-0x0000026782DF1000-memory.dmp

Download

memory/5476-66-0x0000026782DF0000-0x0000026782DF1000-memory.dmp

Download

memory/5476-62-0x0000026782DF0000-0x0000026782DF1000-memory.dmp

Download

memory/5476-63-0x0000026782DF0000-0x0000026782DF1000-memory.dmp

Download

memory/5476-64-0x0000026782DF0000-0x0000026782DF1000-memory.dmp

Download

memory/5476-65-0x0000026782DF0000-0x0000026782DF1000-memory.dmp

Download

memory/5780-419-0x0000020450E70000-0x0000020450E71000-memory.dmp

Download

memory/5780-426-0x0000020450E70000-0x0000020450E71000-memory.dmp

Download

memory/5780-425-0x0000020450E70000-0x0000020450E71000-memory.dmp

Download

memory/5780-427-0x0000020450E70000-0x0000020450E71000-memory.dmp

Download

memory/5780-428-0x0000020450E70000-0x0000020450E71000-memory.dmp

Download

memory/5780-429-0x0000020450E70000-0x0000020450E71000-memory.dmp

Download

memory/5780-430-0x0000020450E70000-0x0000020450E71000-memory.dmp

Download

memory/5780-420-0x0000020450E70000-0x0000020450E71000-memory.dmp

Download

memory/5780-418-0x0000020450E70000-0x0000020450E71000-memory.dmp

Download