ea3febb8a5f510ce79cd0ef6032b0b38bfb079230a09d85ae11036636fddc709

Analysis

max time kernel
149s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Size 766KB
Sample260608-txbleacz3j
SHA256 ea3febb8a5f510ce79cd0ef6032b0b38bfb079230a09d85ae11036636fddc709
MD5 d4c41c134684b69e393b8de72308718e
SHA1 d12e20de6b1f16a333d4fb274a1e0928b54a81c7
SHA512 1ec4c919a5dbc64bd02da924b4662efbd6db6449014f7010dcb7e4d2e7512046989fe1886189dafd94db1ff4ea01ea363bda5ddf0ba8d19f8b66a041391a3741
SSDEEP 12288:xnPrwMB6ExRtopnWmGI8KP9zC1EoL5medLrHbWd9awsjBt3G5S:FH6EhovGE9+rxrHad9Q7W5S
TLSH
T1F4F4BF2B76968E21D2885237C2EB190187E164477677E70E798023D729033FAEE4B7D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key opened	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key opened	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key opened	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key opened	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key opened	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key opened	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key opened	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2240	chrome.exe
4392	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
6128	chrome.exe
6128	chrome.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeDebugPrivilege	6128	chrome.exe
Token: SeDebugPrivilege	4700	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
6128	chrome.exe
6128	chrome.exe
3684	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 6128	2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe	80
PID 6128 wrote to memory of 1116	6128	chrome.exe	81
PID 6128 wrote to memory of 624	6128	chrome.exe	82
PID 6128 wrote to memory of 2240	6128	chrome.exe	83
PID 6128 wrote to memory of 4112	6128	chrome.exe	84
PID 6128 wrote to memory of 2396	6128	chrome.exe	85
PID 6128 wrote to memory of 3376	6128	chrome.exe	86
PID 6128 wrote to memory of 4200	6128	chrome.exe	87
PID 6128 wrote to memory of 5684	6128	chrome.exe	88
PID 6128 wrote to memory of 3396	6128	chrome.exe	89
PID 6128 wrote to memory of 3228	6128	chrome.exe	90
PID 6128 wrote to memory of 3516	6128	chrome.exe	91
PID 2480 wrote to memory of 6128	2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe	80
PID 2480 wrote to memory of 6128	2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe	80
PID 2480 wrote to memory of 3684	2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe	93
PID 3684 wrote to memory of 2644	3684	msedge.exe	94
PID 3684 wrote to memory of 728	3684	msedge.exe	95
PID 3684 wrote to memory of 4392	3684	msedge.exe	96
PID 3684 wrote to memory of 1492	3684	msedge.exe	97
PID 3684 wrote to memory of 5880	3684	msedge.exe	98
PID 3684 wrote to memory of 900	3684	msedge.exe	99
PID 3684 wrote to memory of 4968	3684	msedge.exe	100
PID 3684 wrote to memory of 4660	3684	msedge.exe	101
PID 3684 wrote to memory of 4676	3684	msedge.exe	102
PID 3684 wrote to memory of 4776	3684	msedge.exe	103
PID 3684 wrote to memory of 4668	3684	msedge.exe	104
PID 3684 wrote to memory of 4700	3684	msedge.exe	105
PID 3684 wrote to memory of 1396	3684	msedge.exe	106
PID 3684 wrote to memory of 1584	3684	msedge.exe	107
PID 3684 wrote to memory of 768	3684	msedge.exe	108
PID 3684 wrote to memory of 1536	3684	msedge.exe	109
PID 3684 wrote to memory of 5328	3684	msedge.exe	110
PID 3684 wrote to memory of 4992	3684	msedge.exe	111
PID 2480 wrote to memory of 4700	2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe	105
PID 2480 wrote to memory of 4700	2480	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe	105

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.MSIL.Benin.5.92461974.exe"
1⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe295fc728,0x7ffe295fc734,0x7ffe295fc740
    3⤵
    PID:1116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,13274981011236057926,4411902324483062691,262144 --field-trial-handle=1916,i,11354323109468560193,16273586465393289169,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
    3⤵
    PID:624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1" --force-high-res-timeticks=disabled --metrics-shmem-handle=2004,i,8622129973737573169,16624731142984618777,524288 --field-trial-handle=1916,i,11354323109468560193,16273586465393289169,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1" --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,1306897230315996922,2396925433107473859,524288 --field-trial-handle=1916,i,11354323109468560193,16273586465393289169,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
    3⤵
    PID:4112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2828,i,7803471062981275972,980493175028562227,2097152 --field-trial-handle=1916,i,11354323109468560193,16273586465393289169,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:1
    3⤵
    PID:2396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2832,i,4744761657489062553,4064593376706934047,2097152 --field-trial-handle=1916,i,11354323109468560193,16273586465393289169,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3108,i,16467815221786033077,3553560460490929252,2097152 --field-trial-handle=1916,i,11354323109468560193,16273586465393289169,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    PID:4200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3136,i,11779845747799286211,173665751864142526,2097152 --field-trial-handle=1916,i,11354323109468560193,16273586465393289169,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:9
    3⤵
    PID:5684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4068,i,13438104925724595528,12454387736688545618,2097152 --field-trial-handle=1916,i,11354323109468560193,16273586465393289169,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:1
    3⤵
    PID:3396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4168,i,18295327863209035557,17279054456454363709,2097152 --field-trial-handle=1916,i,11354323109468560193,16273586465393289169,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
    3⤵
    PID:3228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1" --force-high-res-timeticks=disabled --metrics-shmem-handle=4160,i,18003445238938066723,17260712368031608673,524288 --field-trial-handle=1916,i,11354323109468560193,16273586465393289169,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
    3⤵
    PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ffe0170c188,0x7ffe0170c194,0x7ffe0170c1a0
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1528,i,1236586755661738902,14575840113964117588,262144 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,14618213632055460984,14796635314744716460,524288 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,10749475031204724308,3169572871689733595,524288 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3148,i,7171859110897930130,8241741696400654799,2097152 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3156,i,7782172056579441609,11334321173614622436,2097152 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3488,i,9162612856423313570,439828649674667508,2097152 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3512,i,18445273228143450390,4481021592571643881,2097152 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:9
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3536,i,8503663503364308375,15356978571120093356,2097152 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3612,i,7231533047695492967,8340499341123773458,2097152 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:9
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3620,i,4277090053054976977,10394525472831368369,2097152 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3636,i,1358486559488754536,3421273518333809005,2097152 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:9
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3720,i,14185705661377408482,1342031884931164416,2097152 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3728,i,5386433781616640375,13548766960151346756,2097152 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:9
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3780,i,14361894229787464534,16016226873225023670,2097152 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
    3⤵
    PID:768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3792,i,6015275071263119652,17255565102622615528,2097152 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:9
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,9906845331075132863,9425328695116150084,524288 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:14
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,5184696266906725948,15037528455573309980,524288 --field-trial-handle=2056,i,15377418571664960216,2191904293067791187,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
    3⤵
    PID:4992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Crashpad\settings.dat
Size 40B
SHA256 e3786c73582fc4bce6cf9f0cf344d655e3f320db2866f8794ae249c5f3fdd0ba
MD5 9df3f256b3278fbf128c13257ec59ae7
SHA1 55caa8b7d13c3d23590e65c06ab1ef394f46c272
SHA512 d988b3b46cacc1587a60957192069b27a0c828046191d113048aaa96c612a35cfadd93d703dfca296b34f763c6d24a698ce31648919c4e7432917afebb0d972d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 64d68811b77c753ebfe5ca9ec705a41765a017b29dc778e2ea8273412c58cf32
MD5 cf4390dc77c87ad264d5a19f0c208670
SHA1 942182fedde8cdd8a261f00fa0e30a26b1d0bb29
SHA512 1ca6216ce64b62f5a9af3255da34d897a22966f895e5fc36d5120e716f6f4cd7bc0553676ebcee71db826257cf8e76e36094ebc6c741e4f9a37733452a142205
SSDEEP 6:/FoEXE0Y7sO9EMNmmOTiu5jxU8ewu11fhGuj94kEXTtCmykllKJYu9bo:d7Xncs0NdM15jxRqT94kEB/Kx
TLSH
T1BC13172DA9522E39C2C4523C942B5BB193F4D4C8EAA2834386302311722A23A231FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 702f89f78c4c9f1dfa0d1dbb2d3d152df6f15556f663cda16e38d6cfae0d7a4f
MD5 2a0ec78fc4d833cc33864892898a6074
SHA1 5d64e3e9054294d6cede63e9eb6298eed9c515c4
SHA512 5d9d08b3841026ab55114fb7547f4a76f11fa526390ab9604b1a8a8815b5083ea26c2af0fb46d0d1fc47649742ba2bb55e41e81b69b15c204cfb091338fda15b
SSDEEP 48:1/lCXdY0v1PyM1Xg+8DXjf7MmXodVEPLVBKWwtl:1tUa21Pyug+gb7jGVOLHKWol
TLSH
T1F644C9F71C00EEC3E715CAB86C41A22CCD3246112C9AEE79F53544A21550EF3376CAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 c51a4ce88c2eea81bc6b420105af62e40b679d9b7493b72653a419e26641f3cc
MD5 ddefcd3efac38902bee7978b557b40fc
SHA1 0bfa92f006180e5bd7905e060bdb2d7d526a0231
SHA512 c5d0804b247b7875814da6a2d780ffe7c08d1e6d994d61161ea70beae6847a1c722f70605302ede6157dfeaadc39e42cb853cfbd7d700774f0d5cbf5360ee52d
SSDEEP 48:pmsxoZkYK22u1xWF5g8dKeuvx1GUrGafgo0xHrDFv99X0lZH9/Aufwjj0wf5:M40zJXq5dIvx1GUrbmLDFvDX0Vxwj4A
TLSH
T138252BE5FD08193BC08751BA8BD07D8BCFE58350C18D54538A785A18FE18981C4513EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 6cfaa36790dc08874a87605f9d28825f52b5335630558e8be063df6f3bd4ac9c
MD5 d6652e2f180d33a14fd13097250dbce6
SHA1 72c47d1fb5bc4d502a734f393e697887a8b5306c
SHA512 930362a11290503a4f4b06cd2dc75a060eb4791a066f73216eebf37e6931489a193da00194cfc2bb460f39b914b8be01bb88a154bca5555e4b6f52b0d7648a96
SSDEEP 768:sMiUfDPLSgcRUv+94BUfDPLSgcRUv+X4FfDPLSgcRUv+u4gUfDPLSgcRUv+e4Lu2:KWEynua
TLSH
T144162AE64F24A982D645EFB0BBCDED193C703299EC925C82E122927D46F0FC51B8615E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 dfa4e760624ed39014aa244a3da29c6b6be78939d1b6d8f85b688dad36f5de61
MD5 70380279ea8c5200c52c3d34bee694e9
SHA1 2912d772ec78e32925f446babc66312a509fcc17
SHA512 e9f7912204a6ae6ec5441c51615417cb6db8ab2890f934da6acedd200f8df96e1f23418f64de718ac3b197268da8402ecab0daf08fdbfd1235e0cd6cba86f63e
SSDEEP 768:97XeplANkJX5rOI3aeXDQlTIqarBOw21xVIAQSQladZ:9y0kJpHqMDQlZar4rzpQS5
TLSH
T1F7F2F2C843A20575B8A667DD170443F38E2F05C6CED3AE8370452F0D6BF7A9531965B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 6cb2b7b885f4b1e09aa5fc5187589e0d011150c6b2b3a6140ef616f890581004
MD5 b1c469282cac79134bd4aed04c10f65d
SHA1 2ee7fb4b240ff8d1ed702a2a88a2bf177b09dd05
SHA512 e80f56a547d7f3d58ba1f8b70a7d6f55ee06021ea732f14c4f8cd0a3710d7ff6836d3ee59be5b7da31efe05fc7548190019b1b5ee4342eafe13a8fc53789dec4
SSDEEP 1536:0eIGaeEQNubiYEwrVETS9dEiD+kNNBM38GULO6c8zx6:pIGL3EG0VE5iD+kNNBM38/LXjt6
TLSH
T11263021EC09082DBFD41E2B535B91976C18F01A7FF5BB200BAA8727524C5F6F49A3489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Cache\Cache_Data\index
Size 256KB
SHA256 5a95a00f7e0eda88c3a9e2bed405cb8094d947ee7e662b5aab6d34cbb100fec4
MD5 dfa50ef81f6658eab8f659fb16a4f058
SHA1 6e0cb8c043d325995ab0eee8b86c7b8e37493070
SHA512 3fbc178a2fde9694b20be657730e3e117b6af11133fcc83a363d789d68df2f42005fa1649ce483dd0d3f0054d6312a285948da1a25362e7dfb51d11483fb95a1
SSDEEP 3:LsLllFlklNllklkXlvozuEyl/lollLll/mlt8ll//WNtlNlXl3Nl/lZNtlQlZllX:LsRa3lPQzu5tl44ulteNtbklll
TLSH
T13E44112EA3802EA2C3C00AFC800B8BA03338C80ACACF8303030032202CC03A02E0F028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 05425119cd60949af1e0e47a3b4400e4b500fccf212764f59abdb09271cd3dcd
MD5 96f4e5515d93570766bcebd8c1b21377
SHA1 4b443b71c96c2364b3a275c3b31edcd0cb2a83b7
SHA512 b2f644872840a728521a776ee9381742d1dda6d69dfc5b2061191596cd59a67051d003c7e360be9e6fab682ac31c0c93920c77584db14e84ddfa21711a24ff48
TLSH
T1B7E02B81C24D1F0DD32D96F7CEE603444A0E42C42DBE7A03A880C6C133528641248222
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f3fd5fd135f8eebf5cf110375ccfc67ec7279e0403497c179cd0e203ee74e8f8
MD5 d4bc4b778cb7ef4e31d3fe1f8d394958
SHA1 0c2e6dd0f408d22264045734a96588b810a6bb6f
SHA512 b6580e33d1902e1e19523ee34b2584ed18c3677fc4387bd300c2f1059a2569f6e989fb5c38a8f0176a2ab645ab38f3ab155fef7513b0eb4b42e66a53bdc548bb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 d0a6920c6359b8d77bb5ee569c0712885a7acdb810c9441f8e26825d0e52442e
MD5 db2a54859b35bc80f96d44355ef4dd51
SHA1 76d54ce7300cea9fbb6e98ded4696ef4ef718c1d
SHA512 34ca8e17f3c1e6e7c75787abe181c2d509e74cb7e683f8ebd3ce3736b7d4b8b3ad17a674816eb5932b45361aefdf3f6815f3050de1cf4caf9be77f1a41ff792b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\DawnGraphiteCache\index
Size 256KB
SHA256 42f202bd22046ae4dd0b064e6172aaddc9de12eb774534feaccb8850aec3a549
MD5 5f66d1196750b540ccc0462a0c79cd42
SHA1 fa13a1721aaa3023407c8d1a4852444a4bd38796
SHA512 7a2c31bfb89c89ab3b18cf76861743a9cf2070da63c41630b141f6fa5caf5695cc04cd822edbfcace8628be2846b5bf136c4cae12a9376a60c84ed6a9bcd69ef
SSDEEP 3:LstlNllklkXl0utl:LsX3lP0O
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\DawnWebGPUCache\index
Size 256KB
SHA256 0f03c6625b42fa32f0b5153482f6a506b1d2738e50d4cdcb0f302de3ff777c4e
MD5 31d29cc801694a4d703d213c5cae87a8
SHA1 fb91b848249fc0bb2068f5bfd4c377551267895c
SHA512 b10910c80e4cccc213d5f9c4942e7ab387192522d5861543fe2fc68d826fa755c926aabc8f4442eaa8e94ff2ef644024d5e795de78df90cd0eb83fe9bbffe258
SSDEEP 3:LstlNllklkXl4zutl:LsX3lP1X
MD5 SHA1 SHA512 SSDEEP

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\GPUCache\index
Size 256KB
SHA256 7bf9e302b390900825eefb8402fbe824c4c277d7608a8ffde798a7f5c684d6c0
MD5 e4e9c79ef7a78e203a942f2d9a12c856
SHA1 055c85d3237e2808a740d5c02ef80efceb14bca6
SHA512 b8c988c42e9310dc8ed7630ffc3286926a225ef2c2224bdffb5d469e1cadf48ec3fcc19a59cbe074082b0d9c1a739e5ca5ec41d5e55da3e2ceea91fe9391c66b
SSDEEP 3:LstlNllklkXl8zutl:LsX3lP8zO
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1fcba7b97356c2d11056e8e1c5755a593ec0d9c4d252a6e332b1733b42009cf7
MD5 5a95cb49a81de93f9301a6d64b0d0ded
SHA1 cb3574e7b19a7fe66a3e7938ee16804a4d7b791a
SHA512 b4891c39ef6723d4b93c0c427485223a2c9dd133d5efa36c554962f0d953f1aeed518660af7ad1be56cd516ce59396fa172b80af7d6f258c199daec6e2ca2ee5
TLSH
T16EA0022102448667C18003B02C81979AB220B969C206022777D01766AD64A608A35584
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 36462b914263325092a99862d8ca6ce6d521dc4fdd37e5570326d9d0dd601b3f
MD5 be36c39c73ddad160697747e5eacf6d7
SHA1 840629cca6274eac9e9e14634ddfdd44cabb89e4
SHA512 d1ac72c7c0dce073757d9b76960e7d1c11bd172bfce6770e6c06f07981b07f02adb616161a797b892f111659592db9451ad8ff1d728c909470fd757659a60c17
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3aru0usg.mt1\GraphiteDawnCache\index
Size 256KB
SHA256 506603a4a4e21195309288d1856feb66edb8da05edd72cfdb55ee95a1563dfc6
MD5 34b198c826ec8300a9c317fb5b04c91f
SHA1 7fbe844d3c70782109d208d07456c64900e766b8
SHA512 b76afd5522bf008c8f4174d00deef70a6b6b50d23731415cd4b030d1eba65907228f32d9397da8134f66a1f3614817ceceb26fbf33aaf981b26ce03e0b098409
SSDEEP 3:LstlNllklkXlDXa/l:LsX3lPDXat
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x\Crashpad\settings.dat
Size 280B
SHA256 3b004bc9bedc1aa45c0d43dbcb7556a4d9ce29a35fe481728162e12efc892ccf
MD5 7d53425cd6e74983c2abafc2b18bb740
SHA1 a4abaa83c162ae663351561025412cc165d2b0f6
SHA512 f88530e40d3ff7d7236d325a09c5d14b23823ba76dd3ec4376e13286240b0363f3a72bdd95bccaf1266e7a0c59bd5892a9a54ed0f2f1b6a04dd82f6e2ee77fd1
TLSH
T158D024F051715150C1C1407C5D315F300C11DD55410435C055D11104145C303C003150
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x\Local State
Size 3KB
SHA256 34b5867c63ba077c9a796bc94a08fc7fcb42bfddb0f92400d5c62605e8195c6a
MD5 6dac17d2690f68b0696dc09db7be94be
SHA1 14e2acc57fdc40b1f2432fd2017e12f99c46fed9
SHA512 b3dcacd92fd1de5a10dfdbe554a1c6f6d263f54499e87330129a1dd8676bc2342b3752939b1cbba375feaf1f853a7dff6d06269f15e8a843a4cc0ff52fb2402e
TLSH
T10981B8726425EC7385E96906B59637A78E7831B3DD43AF48E1C8531C01EB75C3B4A827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x\Local State
Size 4KB
SHA256 166421434398c9bcb3aa545cabd3fe8caf811f0dadd3a1f9905ee697a7b61b39
MD5 de2a81ee8fc759b5ca63a45f8259b87f
SHA1 749b1e156a31d969a381c191edf6e8dc00245a5a
SHA512 b06685c3291e8c42a15b323342b3e47f44f9054b5736225a352bd1a67d191b76f8c59b90a17be67343c64b609fe5b41adcd1c293449667fc5e6d48a0f046645e
SSDEEP 96:wqGNk1ZQsFfbZBj09cJ58Frh/cInURoDotovUFDsBSQnvAvsocnI0eUnD+3q4a:7GNYySZBWooDUwMgRYcnIqD3
TLSH
T1FDA1DA725475EC278DE9AD06B5D63397AFA42173D886BF8CD5D81B0C01EB7882746C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5807db.TMP

Path C:\Users\Admin\AppData\Local\Temp\b0gn0old.s1x\Local State~RFe5807db.TMP
Size 1KB
SHA256 e683fbbf0df9b2cc34d7346dc215f2ddb18e97d991fbc8dd78a0961d84b9c57e
MD5 29a450f1efb926ce54e11c6f287ddc3b
SHA1 7f867a79ca4683cc837d5b6b5139f56e1e5a2a92
SHA512 b086561932cbef8cbbc31762c08e0f4e49ec6461bf295745173f51773562874ddbe3153fa0f4a3d4b819ef5b6a68685ca93f26dd69aa7fe89013b21b4974331d
TLSH
T1C931B7B164642CB3E8D40A1BB35AB77F5E391272C2426A4851DC170C03F76DC562A837
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2480-9-0x0000000007600000-0x0000000007692000-memory.dmp

Download

memory/2480-2-0x0000000005370000-0x00000000053EC000-memory.dmp

Download

memory/2480-11-0x0000000005410000-0x0000000005420000-memory.dmp

Download

memory/2480-10-0x00000000075B0000-0x0000000007600000-memory.dmp

Download

memory/2480-149-0x0000000005410000-0x0000000005420000-memory.dmp

Download

memory/2480-8-0x0000000007AD0000-0x0000000008076000-memory.dmp

Download

memory/2480-7-0x00000000073B0000-0x0000000007416000-memory.dmp

Download

memory/2480-6-0x00000000072F0000-0x0000000007326000-memory.dmp

Download

memory/2480-5-0x0000000006E80000-0x0000000006F54000-memory.dmp

Download

memory/2480-4-0x00000000058D0000-0x000000000591C000-memory.dmp

Download

memory/2480-3-0x0000000005620000-0x00000000056F8000-memory.dmp

Download

memory/2480-150-0x0000000005520000-0x0000000005620000-memory.dmp

Download

memory/2480-1-0x0000000005410000-0x0000000005420000-memory.dmp

Download

memory/2480-0-0x0000000000830000-0x00000000008F6000-memory.dmp

Download

memory/2480-151-0x0000000005520000-0x0000000005620000-memory.dmp

Download

memory/2480-154-0x0000000005520000-0x0000000005620000-memory.dmp

Download

memory/2480-434-0x00000000074F0000-0x0000000007502000-memory.dmp

Download

memory/2480-416-0x0000000005520000-0x0000000005620000-memory.dmp

Download

memory/2480-415-0x0000000005520000-0x0000000005620000-memory.dmp

Download

memory/2480-431-0x0000000005520000-0x0000000005620000-memory.dmp

Download

memory/2480-429-0x0000000005410000-0x0000000005420000-memory.dmp

Download

memory/4700-420-0x00000279382F0000-0x00000279383C4000-memory.dmp

Download

memory/6128-152-0x000002290E2A0000-0x000002290E374000-memory.dmp

Download