91c4eb53e4cad380dfb896788e232b6cadcc6a94e8d5206de2175bcf7dd41a64

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_1e55dc8be7f667f111730348682c4556_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 13.6MB
Sample260720-qls5jadx3s
SHA256 91c4eb53e4cad380dfb896788e232b6cadcc6a94e8d5206de2175bcf7dd41a64
MD5 1e55dc8be7f667f111730348682c4556
SHA1 39975ec1fb6f01fd5b3146739a2bc21861010226
SHA512 0bce3711379c303c91117e9b62145234193fa4014fff378118d1b6eb17c10d1ba50eddaa5a4cca5f3e6f152d1dc4716b8071fb5fd2dc70c33ff13babec8850b2
SSDEEP 196608:a3ZKavtXs66jjqE8jeLKrf+1Tpn/20IxlsX7gWfmG:agmteBIA8WN
TLSH
T175E68C03E89119EAC5ED923489B35256BF74BC494B3327D71A90F2386E76BD06EBD340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 3 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2840	chrome.exe
5780	chrome.exe
5436	leakless.exe

Executes dropped EXE 13 IoCs

pid	Process
5436	leakless.exe
2840	chrome.exe
6092	chrome.exe
5896	chrome.exe
1768	chrome.exe
3468	chrome.exe
1960	chrome.exe
5780	chrome.exe
2536	chrome.exe
2560	chrome.exe
3172	chrome.exe
3400	chrome.exe
3564	chrome.exe

Loads dropped DLL 29 IoCs

pid	Process
2840	chrome.exe
6092	chrome.exe
5896	chrome.exe
2840	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1960	chrome.exe
1960	chrome.exe
3468	chrome.exe
3468	chrome.exe
1768	chrome.exe
5780	chrome.exe
5780	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
2536	chrome.exe
2536	chrome.exe
2560	chrome.exe
2560	chrome.exe
3172	chrome.exe
3172	chrome.exe
3400	chrome.exe
3400	chrome.exe
3564	chrome.exe
3564	chrome.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2840_844008365\manifest.json	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2840_844008365\LICENSE	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2840_844008365\_metadata\verified_contents.json	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2840_844008365\manifest.fingerprint	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2840_736838707\privacy-sandbox-attestations.dat	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2840_736838707\_metadata\verified_contents.json	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2840_736838707\manifest.fingerprint	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2840_844008365\list.pb	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2840_736838707\manifest.json	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290273444979140"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.netdbcaa5333ab96ae225fd260008c17bd4460c0c37	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.netdbcaa5333ab96ae225fd260008c17bd4460c0c37\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-555388578-3621070821-2697304384-3593298140-3393215088-1836346367-3137015324	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-555388578-3621070821-2697304384-3593298140-3393215088-1836346367-3137015324\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-555388578-3621070821-2697304384-3593298140-3393215088-1836346367-3137015324\Moniker = "cr.sb.netdbcaa5333ab96ae225fd260008c17bd4460c0c37"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-555388578-3621070821-2697304384-3593298140-3393215088-1836346367-3137015324\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2840	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2840	chrome.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 5436	1648	2026-07-20_1e55dc8be7f667f111730348682c4556_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 5436 wrote to memory of 2840	5436	leakless.exe	93
PID 2840 wrote to memory of 6092	2840	chrome.exe	94
PID 6092 wrote to memory of 5896	6092	chrome.exe	95
PID 2840 wrote to memory of 1768	2840	chrome.exe	96
PID 2840 wrote to memory of 1768	2840	chrome.exe	96
PID 2840 wrote to memory of 3468	2840	chrome.exe	97
PID 2840 wrote to memory of 3468	2840	chrome.exe	97
PID 2840 wrote to memory of 1960	2840	chrome.exe	98
PID 2840 wrote to memory of 5780	2840	chrome.exe	99
PID 2840 wrote to memory of 5780	2840	chrome.exe	99
PID 2840 wrote to memory of 2536	2840	chrome.exe	100
PID 2840 wrote to memory of 2560	2840	chrome.exe	104
PID 2840 wrote to memory of 3172	2840	chrome.exe	105
PID 2840 wrote to memory of 3400	2840	chrome.exe	108
PID 2840 wrote to memory of 3400	2840	chrome.exe	108
PID 2840 wrote to memory of 3564	2840	chrome.exe	109
PID 2840 wrote to memory of 3564	2840	chrome.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-20_1e55dc8be7f667f111730348682c4556_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_1e55dc8be7f667f111730348682c4556_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\leakless-amd64-adb80298fa6a3af7ced8b1c9b5f18007\leakless.exe
  C:\Users\Admin\AppData\Local\Temp\leakless-amd64-adb80298fa6a3af7ced8b1c9b5f18007\leakless.exe 70493a526f4587cb7857a0af2f8b68f8 127.0.0.1:49875 C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-default-apps --disable-dev-shm-usage --disable-features=site-per-process,TranslateUI --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-site-isolation-trials --disable-sync --enable-automation --enable-features=NetworkService,NetworkServiceInProcess --force-color-profile=srgb --headless --metrics-recording-only --no-first-run --no-startup-window --remote-debugging-port=0 --use-mock-keychain --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa
  2⤵
  - Uses browser remote debugging
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
    C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-default-apps --disable-dev-shm-usage --disable-features=site-per-process,TranslateUI --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-site-isolation-trials --disable-sync --enable-automation --enable-features=NetworkService,NetworkServiceInProcess --force-color-profile=srgb --headless --metrics-recording-only --no-first-run --no-startup-window --remote-debugging-port=0 --use-mock-keychain --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa
    3⤵
    - Uses browser remote debugging
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler --monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Crashpad --annotation=plat=Win64 --annotation=prod=Chromium --annotation=ver=128.0.6568.0-devel --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffee961ba18,0x7ffee961ba28,0x7ffee961ba38
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:6092
    - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
        
        C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Crashpad --annotation=plat=Win64 --annotation=prod=Chromium --annotation=ver=128.0.6568.0-devel --initial-client-data=0x190,0x194,0x198,0x148,0x1a8,0x7ff7bd770418,0x7ff7bd770428,0x7ff7bd770438
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5896
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=gpu-process --disable-breakpad --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa" --no-pre-read-main-dll --start-stack-profiler --no-subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAMAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --metrics-shmem-handle=1576,i,14783655208535496702,15514102678132540624,262144 --field-trial-handle=1908,i,7249559232598005883,11909261454522448779,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=PaintHolding,TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1768
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=2356,i,7205979541201000133,11046138457783887117,524288 --field-trial-handle=3096,i,7249559232598005883,11909261454522448779,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=PaintHolding,TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:13
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3468
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa" --no-pre-read-main-dll --start-stack-profiler --no-subproc-heap-profiling --metrics-shmem-handle=2044,i,17693464591891906256,10926785247094963221,524288 --field-trial-handle=3200,i,7249559232598005883,11909261454522448779,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=PaintHolding,TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:11
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1960
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa" --no-pre-read-main-dll --start-stack-profiler --no-subproc-heap-profiling --disable-background-timer-throttling --disable-breakpad --enable-automation --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\gen" --force-color-profile=srgb --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3512,i,17603931763630303461,561188483550688737,2097152 --field-trial-handle=3660,i,7249559232598005883,11909261454522448779,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=PaintHolding,TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      Uses browser remote debugging
      Executes dropped EXE
      Loads dropped DLL
      PID:5780
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=4784,i,8401907483360341369,11617936725967676352,524288 --field-trial-handle=4828,i,7249559232598005883,11909261454522448779,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=PaintHolding,TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2536
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=5084,i,3972653653353084449,5303840693796148613,524288 --field-trial-handle=4880,i,7249559232598005883,11909261454522448779,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=PaintHolding,TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2560
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=4772,i,1081548224308070755,2903147345770977582,524288 --field-trial-handle=5212,i,7249559232598005883,11909261454522448779,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=PaintHolding,TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3172
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=528,i,13827060932018577737,16927340387876538172,524288 --field-trial-handle=5224,i,7249559232598005883,11909261454522448779,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=PaintHolding,TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3400
  - - C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
      "C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa" --no-pre-read-main-dll --no-subproc-heap-profiling --metrics-shmem-handle=5420,i,9811779675731315640,2060680106016484020,524288 --field-trial-handle=256,i,7249559232598005883,11909261454522448779,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=PaintHolding,TranslateUI,site-per-process --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

leakless.exe

Path C:\Users\Admin\AppData\Local\Temp\leakless-amd64-adb80298fa6a3af7ced8b1c9b5f18007\leakless.exe
Size 2.0MB
SHA256 1d11bec16a63d85a386c47fb97914ad13318f7fdcbf399c5a895cf642307f115
MD5 f64c225477245d8cd25625fe4d453f62
SHA1 2dea714253f18838babeacff346f33774d764bd9
SHA512 f272c1239bd251e4995e2ec76538ac98d6ca118ec61054cc36b630f2bbf04b51df0ed85d7141cb74594ea2790df38d3c79624ddfd900a6e3d216db58764cda9e
SSDEEP 49152:7bdVK53nuhrb/TkvO90dL3BmAFd4A64nsfJwdv9oiogf8+WhMCIwYvD1:g3VhY
TLSH
T1E8A52947FC9190A5C0AED23089669292BA307C890F3163D73F50B7B92FB6BD85E79354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 9b505b6b25ddb8391155e9099b385f87b7e4a973a9a958cac495db6ed5f012f4
MD5 5d9fc2bcdc84571aa07adb94cb84fe51
SHA1 ee4c49c912b14e00da9244b216e44c3124d309dd
SHA512 19ae02b2e395e54cf428ac397e65bbede011ec59232d13237bf3f39b9bd71e067bcca05bc314a6b244425f9caa60dcf3bc7931928571fe3faea67531e228443c
SSDEEP 3:MsFlYhXllLlX8lPjfJlH+ellBl:/Fiz10jJlee
TLSH
T14D13025FE7A024BED16400356546876073A1D44CC676C35750EA56131C46F410C06248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 a2d69657043e4485b320b484b9c567ca761fc5483389179a39886fba05e86153
MD5 d38cc903f05041487ed7b738e6434925
SHA1 0c4aa084c6f33680b00285043f75a19be633b270
SHA512 c1a825c7c1676ba8d0d6a92f5e7e941e853e4f5a6bcb6f9fd0f5e3e01278cd03cea9e4347f7a8b1f0da55ae3a7f7d67ce93659d08b3d05bbd938f409c66bad24
TLSH
T1E7B0125011161500DBF90BF875B24C0032601D2581FBDA06516E82BCBC533401299105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a71c6.TMP

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Default\Code Cache\js\index-dir\the-real-index~RFe5a71c6.TMP
Size 48B
SHA256 bc1a94cb9b078de33512d0cb6fe2d6b379d2b3987e37b4995902545327f3e545
MD5 eb9aada79d3d3488a46539231919642e
SHA1 e162d90b7ae6791b78f6a3185ae803e85e4d17fb
SHA512 c9196b10e3e90364ff311d0874976837967e05f16c645a602d8a8e24adb957cc0cd67eae5206cce15fc2ad5f136511f5249af9a0c21d319d7aa161b138205065
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Default\Network\Network Persistent State
Size 1KB
SHA256 858ddbf37c50ce29a9e6166347c179fb21d3925ccf42d25ea785fe8f986ec547
MD5 623cf68907bce54e2cfa4b22154f29c4
SHA1 793a9c7f821965385e0206128e09984272dd0d61
SHA512 2457992e713e170c185fea9e35093fbac7c6ce6eb9ab89f67f26b931f7702340fa32a3982dd62ac77ec2ccb0ffc43760b793e40a64726610477ab715e82c21f8
TLSH
T1CE31CCF3C7E8967D895161F87B213E17CE2E080583283A5698E4AF5B53E0830D25498F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aff70.TMP

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Default\Network\Network Persistent State~RFe5aff70.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Default\Preferences
Size 6KB
SHA256 3344594f4e4b561eaea886181df10a02b47fd4f949d6a14578da78678d3e5f8b
MD5 92f75fe2fec7c27bbbee7501eca45689
SHA1 f315bdeb102ee4c4836a19b28a8597b65be379f8
SHA512 6bb1dc66852119a53a2ce4d1f577d7e1c21b4d684f5ab7368d1eb44bf215cd7a3c389cf6da2aec3799e90c03a667db813b1f10c6fa9ed04c294ed497d9e5bc67
SSDEEP 96:rRvhQrKICB5PiXle8E0Ri0WEl6ZbKm9EH7/x+WVHMSm+ue4Bm1CXK8SuY7:rRyr8Ce8PRp/kH9EHV+WiDBmk6puG
TLSH
T16FD18446ED649E774CC6D6097925BB53E1F6203166C51E0CABFCCE1C04AEBCE320751A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a373e.TMP

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Default\Preferences~RFe5a373e.TMP
Size 5KB
SHA256 36390a3282fa95e95f7ef6a05e0459e726d8ba06bcadd65b6878fcb0609b1ac7
MD5 6760db7bc6e89aeab7ccb3e3dc61afd6
SHA1 4de96db1a6c28b389e931b7c59bf38d676b50db6
SHA512 d8509f873176a2a6376665c9541e78ece3615332cba0afb9ffdc8e6fdd9bee81ab298baf830f2cb9cb8cb2e24d38d4ef3cd5474d020eb83c14cc159403e6287c
SSDEEP 96:rRvhQrKICB5Plde8E0Ri0WEl6ZbKm9EH7/x+WVHMSm+ue4Bm1CXK8SuYq:rRyr8fe8PRp/kH9EHV+WiDBmk6puX
TLSH
T148C18546ED649E774CC6D609B935BB53E1F6203166C51E0CABFCCE1C04AABCE320791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Local State
Size 1013B
SHA256 0c5e0f111b7cf2db1fa61633516339713885506035e2d7d159c8f40e6714007a
MD5 4cb8d83eba4872b4b900a8374907630a
SHA1 4657da28abcfb3097328ae42e79c0b1d2dcfb6e7
SHA512 cfc0f36795de5b18224fa125f696f147b7ce791b1ff42f448b934b67d66c5f924945ef2b7d11aad4236a9ac9c0add8c8dd5296e99b24da27436c2c568dc3b75f
TLSH
T107119873F1A01EB2EBC39529F3517A130E30103680551A4831CE36190253D4D572BC30
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Local State
Size 4KB
SHA256 a6a0bbe8e33ca4c254c523af204ed8d67f9a0972ef987e8c2942b207fb2cf062
MD5 df951eadfa41ef89cd0c0bf25967022f
SHA1 5f7ebe5282cd5243f380af3be47b444c0873c500
SHA512 c9cbf6a71526919ac707a82d8e71a4e2c62b9c539a0891448198316eece9be4b193f5ce1776c475c98bd7439d551d755861432f94242153231dc0af086ec12db
SSDEEP 96:rGbJFfaGMSzzggyRDotoj57KLsBmzG+i8IHtuc/JJux9W1xGQ7wNpCCuJa:qt17zyDUmkgV+aHtu4ux9W1xG9Ns8
TLSH
T1CD91B836E3E94C77496BE445B5417953CEBC1116E820EF88A3EA5E4C029BBDF1342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Local State
Size 4KB
SHA256 7502aa8c0c09f8e70dd3dbedc0006d901dfa93b917258ad3dd3f389e9d51d6a6
MD5 69f2b34f437d65b283ced6db57fcf2c1
SHA1 42268e6a4c72af173656169244f3f5421d89ff44
SHA512 53090d79536a5e54f2b8bb8d2e409fccc0473518394bc2403e603ffc662f46274d5e5dda623197bd5caf17436e4ba64ad8682d5b2e98046c5dcb1fc94803b0eb
SSDEEP 96:NGbJFfaGMSzzggyRDotoj57KLsBmzG+i8Iutuc/JJux9W1xGQ7wNpCCuJa:ot17zyDUmkgV+autu4ux9W1xG9Ns8
TLSH
T1C091E932E3E98C7349ABE445B5417943CFBC1116E820EF88A3EA5E4C029BBDF1342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Local State
Size 7KB
SHA256 bb22fa58460cec8799b57013e3ceca3623fc2c22d693b5cdfd162a5c8169e48b
MD5 f6e2e3b66d23f3d202fa4a79ba4eb7d5
SHA1 be0f34f18db0bb334619b53bdadbe4b12d997ff7
SHA512 054784dbd0b57eecd9e20f60437a0c5fcf1671573e3b34530aac495887dba818d2639b4fc551719ebdd691139896c48d8fd9ac7a34dc9da66a289f3f898ca638
SSDEEP 192:ot17zyDUmkgV+RDThSTutu4ux9W1xG9Ns8:ot1XyKg0RATKug1xG9Ns8
TLSH
T190F1C83AF3C6C933FCDB95D72242B683DEAD121559508ACC5EE65D8C018FBEE630581A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Local State
Size 7KB
SHA256 f595aba64143ac25294b7fce2fee2ad2ec4a8452bce59f45e861832cc4c46d0d
MD5 2ce7d3340fd3a0390c6b34b620aae704
SHA1 62f4aef595ae1f9b7e96d57ee0eebc92eed4638d
SHA512 a230455152b4399da3fc97dfbc7b7b7686fe8d67f85f092d86b0d2888871dc043e4f356f230254e97ffcc9a8bfb0cee2f97a484e8cbfde15d07a9f83caa282a4
SSDEEP 192:ot17zyDUmkgV+KEDThSTutu4ux9W1xG9Ns8:ot1XyKg0jATKug1xG9Ns8
TLSH
T1EBE1B739F3C6C933FCDB95876242B683DEAD121559508ACC5EE65D8C018FAEE630281A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59e71a.TMP

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\0e150f5b30c8a6aa\Local State~RFe59e71a.TMP
Size 847B
SHA256 53a9536bcbdaab72cdb118b6b78bfd866160165fb64c8f0ff6676a6048f4e985
MD5 96e5eab2ec877287a7cf085d4d4e8d71
SHA1 d59292e50e032dd59294cbc0dfd7076f795dd6b5
SHA512 32c89bf1d6b69ba9c4be48b563579239a1c1a17f25b621b0fd2270c2eeae56308da1d7f159258c3eb8fb5c675710f70ba1f645fee57432746838e5f3a3d8f3e5
TLSH
T14D0146B3F4E02FB1FBD6942AB3517A030D34113BC1251A4872DE72190157D9E5B1BC30
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\D3DCompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\MEIPreload\manifest.json
Size 238B
SHA256 44844cf3dde6e80087ae0e6bf0d9326d7ef7d23326d24ac83af0850be26923d2
MD5 442699c95b20a60470421c6a4d29960f
SHA1 c7317f2d2414c991c21205ba3c68a187b997e3c1
SHA512 c89cf089f7feeb80c6ded11f1fce84287abe8216a6e05723d1a7faf567c501c043cd1246ff8dbee1240d2d79c41b698ef4cc3459589e68e5bfc5bed7fc3a150b
TLSH
T127D0A7633841CD770198AA993D31AC0A73BB3F0B58429C1722B3100D80D5BB6206575F
MD5 SHA1 SHA512 TLSH

Submit Download

preloaded_data.pb

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\MEIPreload\preloaded_data.pb
Size 8KB
SHA256 c6070a157b4e28d16fbccbd233e93846ddb070c85e1a1bc64469b7a5f1424fad
MD5 d5e4c2634eff8a9b3faf432bf406d6d1
SHA1 a691f5c9877079193c1f7dfb16dbc30bb0372ec9
SHA512 b264e28ac8f111df01c553445aadc7bcdb3f32a38a1a19d3f9d458270dfeaf80efa7144407bd999892022af9dde9dbf8a0e19e7212720e1c6511ea9125afb166
SSDEEP 192:bTOpyeS7AOv6EVp/m3FPKk15jjKVcOmQppXavFbeLfzrLyp:bTOk7AdEugo5jjK+5QppXaBebzrLyp
TLSH
T177029EA4A364287B0D3921C74860A75D3BB2EFAED6D67C98CB190B015413D4C3C25F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\PrivacySandboxAttestationsPreloaded\manifest.json
Size 121B
SHA256 300385cfb80f9f3b5b2d186f25b4dbb076471047b5531c0820ffd3482a743b6a
MD5 c660694e3c9f23c0e7d32b8f234a3ec8
SHA1 77c4658572391faa1cdf7a6703460e9dad3381ec
SHA512 0ceecf2e827b6a0a32a70333b0890fbcbc79f7c59944b15ef9446b89f16be95b473a3c8ae50845ec9d180516898d3badf393afbee6ea52224b1784e8e42e9c0a
TLSH
T1DBB012B56D04B2B728C103B50B7683935BF19D576C237D38A7071441217973B7277A1D
MD5 SHA1 SHA512 TLSH

Submit Download

privacy-sandbox-attestations.dat

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat
Size 6KB
SHA256 ec7bb86c6cff06847fa597946fc38375ccc6dd09871f0388acd8583b8088769f
MD5 73b706daa7f90a56249ac27d72b22460
SHA1 475b770a5374678a4678f2f6d6d92aab9df0e679
SHA512 d8c94ee1ea1965803a956e11648d79f5dad85f3a3efbd31bc75828f55b0dca71f2182983ded1f5067998d907f377e2a357def8656a74b4a154043310c4a6f003
SSDEEP 192:F+0we/ueVGHhNtZbCkWgxxaNv/xGg6unJ26YYb:s0we/u5btZGRgxxaNv/ggZ2fYb
TLSH
T11CD156FF213065144F5101C7B24BBECFEA57021C8EDEDAE9C7A0D59622C52B6A9C3395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome.exe
Size 2.4MB
SHA256 089abfebea2302c5e31f84c9d9658408f87ee1b647464d2067d706aaba251ed3
MD5 ae279e4010dbffa62c9293b24aa77780
SHA1 4a04933e501a6315c65bfabc7fe46bb94d0a4c6b
SHA512 cee24ea9466c6c0f2a6be977da2a1feaf7da601a9631a300731a50f78ba14c1e10c996dbdd359c603244fe7bad396afdf962929f3a388cbcde134ded39ba9650
SSDEEP 49152:i6r6K9VH5Xa04VmjaMPm5SLIPehx0gxrQRM8y8jwHGgIKlzO2K:KKYR60jRMPGWzK
TLSH
T1FAC56C17B2AA50E9D02ED1B8C7469232F9717C450B3479EF0390BB252E77BE42B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome_100_percent.pak
Size 660KB
SHA256 c08e5a9065d56c734995bdb2ac92e152bd3a2ef777bf76b286541eec203d15b4
MD5 ae59e72e9ccf0f13f49df1c70a7dc985
SHA1 dba44aed170b48e2389e6636f79f3c467b190c87
SHA512 98b8fd0cdbd7abf89339c6fd6e62f5fa625bf74d5297eca68c9cdc3cbb537cffae7c55ed37f0af2897ab70afa0b1d342e215dfae12fc0b834431f0a7b70e5df5
SSDEEP 12288:iI3H1fJljzgsz5B0GDJQrnKs8SNP+QSsSilxNzJ0D+wIivWPKkxuoO0TehEr2:l3VBl7zEEmPLSUNzJ0KwpvWPXuoO0TO5
TLSH
T126E412D773B4EC7DEEAB167B926504B0EC7349281A92010B179EE8796A53748D8CD3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome_200_percent.pak
Size 1.0MB
SHA256 4629c33e1ec805c72096906c93d5f4cd8a7da9c66a6856c0d7bd0a5ad03e0336
MD5 e0696b9fac7c6a753817a18e1a7b717e
SHA1 5c6362a6b9fad8df3d209d8ecd044c9c8bcef2b0
SHA512 35ff86a51deafe32f225e0d9e0fc1679d64b78b93d54aa8d99c3d0f4054777b2a765bb1c17f5a19715077f75a78beb089f805bdb1e15452d62140a35c450003a
SSDEEP 24576:C3zB69v5zLmmibkFR8+mZZhQumegvQtCP0KhwvABEbafXa6edhOLoe4:C3m53mNbkFRJmPhQRhQsP0KCvABLajrR
TLSH
T1183512D7E3B4DCBDCD630AB3925A05F0FDB510360AB6100F076AAD79395678899CA6C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\chrome_elf.dll
Size 1.4MB
SHA256 20ee07a524b25e6c16986191f3bc5a61a4d91ceceda6b0ca4742bfc25a72d8fd
MD5 d339c9bb3545b4fa11d1441f4a204c23
SHA1 72377e9a0160fd898aba346457129ceec335ff08
SHA512 d5d20c09df8bf0de2ebe1e831f1ed9e5f2f8d26a164923cd47bfb2691a25afd4e2a616dfb15c785bd93bd8f546f04c7c3fb54fbf031be06140311dadc5ef09e8
SSDEEP 24576:d1cIqyWzIxdfQ6x+5uGCFscTjRdiOiffEmxeSItlcS:ncIqyWzIxdrL7FZRdiOQffAzc
TLSH
T16C656C17B29640A8D06ED1B4C7575936FA727C450B20BAFF0390B6292E77BE06B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\dxcompiler.dll
Size 20.3MB
SHA256 1ad75abefadb0c1e9127f9a8c63308d9591e36d875f60fb264b0b3327eaee640
MD5 297f78ef0a7e1b15079bc6f307d24d1d
SHA1 cc8524c3250b8446655422a24bb1b58d5fb59339
SHA512 3056adfb77ab3576495b165bbaf7a4940a24e2990dae7ac364154418aae707237157b0d48aa05ae0505e14a593ee9afb4303a7c2074fcb54ab0255e8086124b8
SSDEEP 393216:W9CDBWwHQrln2ki9ghM26Z2KuQU0/iSIIeWtFqoj68lhSCBJB36YQoufwQCK4wJw:JNsRdMbkL
TLSH
T130273A12268654ADF45AC4B083478963DA6434CB0F39BDFF44D892392F7BBF41B39629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\dxil.dll
Size 1.4MB
SHA256 a5fe1d8d9caa2ff29daffd53f73a9a4e19c250351b2abe4fc7b57e60ce67ac68
MD5 30da04b06e0abec33fecc55db1aa9b95
SHA1 de711585acfe49c510b500328803d3a411a4e515
SHA512 67790874377e308d1448d0e41df9dd353a5f63686df4eb9a8e70a4da449b0c63a5d3655ab38d24b145ad3c57971b1c6793ea6c5ac2257b6eb2e8964a44ab0f08
SSDEEP 24576:+Cfhbh3v3mtZDiAQeWj26k41ob2nrZ1rqpegQDJqoZtp22GkmgA9u808jQPEdkrt:+Cfhbh3v3mtEAQrW41obCraeRhy9ou6f
TLSH
T18F658D1B629801B5D4BBD178DE578E0BE6B2B41503709BCF12F006A62F2BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\libegl.dll
Size 520KB
SHA256 4cf555f3789b44bc4fb831d0eb51c7bc9a11a1509a79ac210cb3b0ea7e3a3dd9
MD5 936596178cccb2bdef662ef83f6200fb
SHA1 60430aa94c4461ef1e6c2d2b14d30740db075f8a
SHA512 1e35b2d124217af114f023882d57c086ca3d3fd330225dfd0e03834752e8ae1f794dd734aced48003e4fb30848bc2d524d76acc12b8a6b85a0ce273022d49629
SSDEEP 6144:DMru5W0SIj5FKo+KKEA6e3CpE7xMY/t0lNIc1N0nwIM2eaaZj4A:U/fI7Ko+vE63Ce7xMY0xN0n3MF
TLSH
T13FB47D25B6999BB9E426D174CA134552FB3174821F70BADF03E082792F773F85A3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\libglesv2.dll
Size 8.3MB
SHA256 d1a7a3b587b4d6c358754aa70a4166a9464bebb0a6c3b20b08ca71692af1ee3e
MD5 e14357fa6d1ee8d5ee9cef79e8415bd0
SHA1 1970dc8094cb98c0c5a7d6d6a28f9d8f6af1f419
SHA512 cb8aeb0e3361996fb1dfd62d1a9a3afc2df60c43ef5c11f88b6117534be34da9549c523980b5039e80a64369fd0b37459e507ac29a071c3bbc30a505b9878e34
SSDEEP 196608:JL/ydVV3+rNHzuJA3FdA5R5Sx7MgmNwmD:JL/ydVV3+rNHzuJA3FdCR5Sx7MgmD
TLSH
T19D965A03F29680DDC019E1B88757A226F731788907347ADF279497292F77BE0A73AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\locales\en-US.pak
Size 478KB
SHA256 2c5f8d8b53972f0d9f8935339d563d815fa2362d156c0824a3e0bf014267ba4b
MD5 bb412b5c0eb3021c1e0be2b725dd4fa5
SHA1 e63bb90c6c747df2fc55a21ef7ae74ef0b6a7921
SHA512 431d3a3fbda0b357e772d1b13292a590919294cf549d92f3f9b911aafa0aad2537ce3d22b37000190113e988af3a8f8117dfd00f4bb9ebaf868a10b88417a174
SSDEEP 6144:m/qoMkbhamyJf5dJhBMP9eBQgDJfaY1se95g+xkngdH/xF+wB:wMk16fbBMkQgDJ/55x3+wB
TLSH
T10EA44B1FF744126A069352A27F0995B2BF32D06CA36112563CBD812C33B7B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\resources.pak
Size 9.6MB
SHA256 3573d8ea4f51e7afeb3f02da2cd2e7079c88487bfe91cd8c4f5690de34325919
MD5 9cfb3304873b07923a26008bf12255b2
SHA1 d10ca85990d69cb420ec93b452659fc679628af9
SHA512 f05691978e73be2bb39485f9b089f0d461d87047181e33d0e6e52ddc8341f56184ed0e3f2b5a7ea937425bbd570cdb072f4697c2f74887508b056adae4aa8b4c
SSDEEP 196608:QeyiEFrbGpD0EwEwRLn1gG1wPqK4fkrP5rJN5laMySqLpR3:QeyiEFrW0Ln6PdMkrP5rn5QM4pt
TLSH
T1D4A633E3759D6C7FDC88437A41CC84BE137D21AA1651B9A6100CBB6DFA212495FC827F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\v8_context_snapshot.bin
Size 648KB
SHA256 d130ad63b7f92fa8c79e7983de05de66fa3106c7adfb1b4ccbd1984f94ff74dc
MD5 bb45bf12b3f984e67b7f91918a8f6d4d
SHA1 ea0d3404b1146b0e75ea6166f5981fd13f0e5fc1
SHA512 6b84e90759727a0ed7f3be45d665b5285179f50e015a551dc203fbe7718261bf7df36d92f748d7035a1d97e808f8b99d6ac638fa4551c0f799665150670c84b7
SSDEEP 6144:iBaCPhFiw3TawqezYbz8bkSHGWDgqcAc9WjSvwSrHDZgx9iqOblE7FkojA8hoHk:gaCPXiwTkGGWDAfFjVeVObUFkX8hoHk
TLSH
T12AE484A2B784DF56E2E95EB09EFED6A23674F18E9E0A515B3107232D353D3242F4424C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\vk_swiftshader.dll
Size 5.3MB
SHA256 8778d3406ae70efe5cc54c9375a98cc7e5b03a38adc3f1aa6d7e007ae8076a3c
MD5 ef56eca347d99d712883974e6a6ab443
SHA1 d7ba934a3deadecdecea2a75342a8bd2ca6e37a8
SHA512 d4b4b81fa2384fe03e3c006e90a9d90dbfea1155462f6ae2da875e72f6b6bcdfe8996dd92a4053fb8cf4aa74bf309b3d4822659e3327fffe1ccb8b33633f5c92
SSDEEP 49152:9/Z5yatXkVpvq+hPB8IQ3OyszrnB/hjR+cOB2N/Pq8JyqSUtEtyaEfzD99+WyaMo:kkKfNBkqntbMgP5FuV
TLSH
T159463A43B25291D9E00DD179835B9633F231BC881B727AEF4AA44F252E37BE06739B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Roaming\rod\browser\chromium-1321438\vulkan-1.dll
Size 914KB
SHA256 8cfdbcd4a90fea5893c0ca144dbaf6c5d8f5ed0dc84a93c6ec40ba822dea8abb
MD5 e84050828d8cb51552fdf81c904f1112
SHA1 a53135639dfc2e16b013615c1f2229a1c4cc4eaa
SHA512 01c8a10897fb25cb96a4d0a7fa13ef393f74ecd71d875860c04e9d889ba856fd0103ae1d7702c19588f37c798421dee2d08c79e5019abcad9536131bc59abfe2
SSDEEP 24576:YtvYt/pajevU8ulbVZQTTP2Kw6Z5W1DYsHq6g3P0zAk7Gch:YtvQgjevUFlbVZQ/2Kw6Z5W1DYsHq6gx
TLSH
T161157D22E555856AD976C034E9828703DA7174822322F9DF02E897187F6BFF47B3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1768-304-0x000002915E000000-0x000002915E4B8000-memory.dmp

Download

memory/1768-354-0x000002915E000000-0x000002915E4B8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads