salatstealer | hxxps://workupload[.]com/file/yALQmFUa6MF

Analysis

user interaction
yes
max time kernel
137s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://workupload.com/file/yALQmFUa6MF
Sample260723-st8lassanf

Score

10^/10

credential_access discovery salatstealer persistence ransomware spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 10 IoCs

resource	yara_rule
behavioral1/memory/2296-1157-0x00000000003E0000-0x0000000001036000-memory.dmp	family_salatstealer
behavioral1/memory/1828-1166-0x00000000003E0000-0x0000000001036000-memory.dmp	family_salatstealer
behavioral1/memory/2296-1223-0x00000000003E0000-0x0000000001036000-memory.dmp	family_salatstealer
behavioral1/memory/2296-1233-0x00000000003E0000-0x0000000001036000-memory.dmp	family_salatstealer
behavioral1/memory/4468-1244-0x0000000000C60000-0x00000000018B6000-memory.dmp	family_salatstealer
behavioral1/memory/4468-1243-0x0000000000C60000-0x00000000018B6000-memory.dmp	family_salatstealer
behavioral1/memory/4468-1245-0x0000000000C60000-0x00000000018B6000-memory.dmp	family_salatstealer
behavioral1/memory/2960-1261-0x0000000000AA0000-0x00000000016F6000-memory.dmp	family_salatstealer
behavioral1/memory/5032-1283-0x0000000000DA0000-0x00000000019F6000-memory.dmp	family_salatstealer
behavioral1/memory/4468-1315-0x0000000000C60000-0x00000000018B6000-memory.dmp	family_salatstealer

Executes dropped EXE 4 IoCs

pid	Process
2296	Midnigh.exe
1828	Midnigh.exe
4468	wininit.exe
2960	wininit.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001100000001c21f-549.dat	upx
behavioral1/memory/2296-551-0x00000000003E0000-0x0000000001036000-memory.dmp	upx
behavioral1/memory/2296-1157-0x00000000003E0000-0x0000000001036000-memory.dmp	upx
behavioral1/memory/1828-1163-0x00000000003E0000-0x0000000001036000-memory.dmp	upx
behavioral1/memory/1828-1166-0x00000000003E0000-0x0000000001036000-memory.dmp	upx
behavioral1/memory/2296-1223-0x00000000003E0000-0x0000000001036000-memory.dmp	upx
behavioral1/memory/4468-1234-0x0000000000C60000-0x00000000018B6000-memory.dmp	upx
behavioral1/memory/2296-1233-0x00000000003E0000-0x0000000001036000-memory.dmp	upx
behavioral1/memory/4468-1244-0x0000000000C60000-0x00000000018B6000-memory.dmp	upx
behavioral1/memory/4468-1243-0x0000000000C60000-0x00000000018B6000-memory.dmp	upx
behavioral1/memory/4468-1245-0x0000000000C60000-0x00000000018B6000-memory.dmp	upx
behavioral1/memory/2960-1251-0x0000000000AA0000-0x00000000016F6000-memory.dmp	upx
behavioral1/memory/2960-1261-0x0000000000AA0000-0x00000000016F6000-memory.dmp	upx
behavioral1/memory/5032-1281-0x0000000000DA0000-0x00000000019F6000-memory.dmp	upx
behavioral1/memory/5032-1283-0x0000000000DA0000-0x00000000019F6000-memory.dmp	upx
behavioral1/memory/4468-1315-0x0000000000C60000-0x00000000018B6000-memory.dmp	upx

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\6e42c432-380c-1e34-f3f4-20db56b63238	Midnigh.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\explorer.exe	Midnigh.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\6e42c432-380c-1e34-f3f4-20db56b63238	Midnigh.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\SecurityHealthSystray.exe	Midnigh.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\wininit.exe	wininit.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\6e42c432-380c-1e34-f3f4-20db56b63238	Midnigh.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\OfficeClickToRun.exe	Midnigh.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2964_796468100\_locales\hi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Midnigh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Midnigh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6116	chrome.exe
1092	msedge.exe
3848	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292940095845336"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{19C9ACAC-2855-475A-AE77-5790C4265F3A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{1D01FDC4-5C57-4ED7-987B-83513821EF50}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
2296	Midnigh.exe
2296	Midnigh.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
2296	Midnigh.exe
2296	Midnigh.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
568	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe
Token: SeShutdownPrivilege	3488	chrome.exe
Token: SeCreatePagefilePrivilege	3488	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
568	7zFM.exe
3488	chrome.exe
568	7zFM.exe
2964	msedge.exe
2964	msedge.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe

Suspicious use of SendNotifyMessage 62 IoCs

pid	Process
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
3488	chrome.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6028	taskmgr.exe
6028	taskmgr.exe
6028	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 1932	3488	chrome.exe	89
PID 3488 wrote to memory of 4964	3488	chrome.exe	90
PID 3488 wrote to memory of 4964	3488	chrome.exe	90
PID 3488 wrote to memory of 6116	3488	chrome.exe	91
PID 3488 wrote to memory of 1520	3488	chrome.exe	92
PID 3488 wrote to memory of 1520	3488	chrome.exe	92
PID 3488 wrote to memory of 5040	3488	chrome.exe	94
PID 3488 wrote to memory of 5040	3488	chrome.exe	94
PID 3488 wrote to memory of 1888	3488	chrome.exe	95
PID 3488 wrote to memory of 1888	3488	chrome.exe	95
PID 3488 wrote to memory of 4340	3488	chrome.exe	96
PID 3488 wrote to memory of 4528	3488	chrome.exe	99
PID 3488 wrote to memory of 2728	3488	chrome.exe	98
PID 3488 wrote to memory of 4528	3488	chrome.exe	99
PID 3488 wrote to memory of 2728	3488	chrome.exe	98
PID 3488 wrote to memory of 1196	3488	chrome.exe	102
PID 3488 wrote to memory of 1196	3488	chrome.exe	102
PID 3488 wrote to memory of 3344	3488	chrome.exe	103
PID 3488 wrote to memory of 3344	3488	chrome.exe	103
PID 3488 wrote to memory of 3052	3488	chrome.exe	104
PID 3488 wrote to memory of 3052	3488	chrome.exe	104
PID 3488 wrote to memory of 2860	3488	chrome.exe	105
PID 3488 wrote to memory of 2860	3488	chrome.exe	105
PID 3488 wrote to memory of 3448	3488	chrome.exe	107
PID 3488 wrote to memory of 2660	3488	chrome.exe	106
PID 3488 wrote to memory of 3448	3488	chrome.exe	107
PID 3488 wrote to memory of 2660	3488	chrome.exe	106
PID 3488 wrote to memory of 3724	3488	chrome.exe	109
PID 3488 wrote to memory of 3780	3488	chrome.exe	110
PID 3488 wrote to memory of 4768	3488	chrome.exe	111
PID 3488 wrote to memory of 2400	3488	chrome.exe	112
PID 3488 wrote to memory of 2400	3488	chrome.exe	112
PID 3488 wrote to memory of 1428	3488	chrome.exe	113
PID 3488 wrote to memory of 1428	3488	chrome.exe	113
PID 3488 wrote to memory of 1204	3488	chrome.exe	114
PID 2964 wrote to memory of 2932	2964	msedge.exe	119
PID 2964 wrote to memory of 1092	2964	msedge.exe	120
PID 2964 wrote to memory of 5832	2964	msedge.exe	121
PID 2964 wrote to memory of 5832	2964	msedge.exe	121
PID 2964 wrote to memory of 5832	2964	msedge.exe	121
PID 2964 wrote to memory of 3712	2964	msedge.exe	122
PID 2964 wrote to memory of 3712	2964	msedge.exe	122
PID 2964 wrote to memory of 5788	2964	msedge.exe	124
PID 2964 wrote to memory of 1708	2964	msedge.exe	125
PID 2964 wrote to memory of 5788	2964	msedge.exe	124
PID 2964 wrote to memory of 5788	2964	msedge.exe	124
PID 2964 wrote to memory of 1708	2964	msedge.exe	125
PID 2964 wrote to memory of 1708	2964	msedge.exe	125
PID 2964 wrote to memory of 1120	2964	msedge.exe	126
PID 2964 wrote to memory of 1120	2964	msedge.exe	126
PID 2964 wrote to memory of 1120	2964	msedge.exe	126
PID 2964 wrote to memory of 3272	2964	msedge.exe	127
PID 2964 wrote to memory of 3272	2964	msedge.exe	127
PID 2964 wrote to memory of 3272	2964	msedge.exe	127
PID 2964 wrote to memory of 1292	2964	msedge.exe	130
PID 2964 wrote to memory of 2776	2964	msedge.exe	129
PID 2964 wrote to memory of 1292	2964	msedge.exe	130
PID 2964 wrote to memory of 2776	2964	msedge.exe	129
PID 2964 wrote to memory of 4428	2964	msedge.exe	132
PID 2964 wrote to memory of 2928	2964	msedge.exe	142
PID 2964 wrote to memory of 2928	2964	msedge.exe	142
PID 2964 wrote to memory of 4472	2964	msedge.exe	136
PID 2964 wrote to memory of 4472	2964	msedge.exe	136
PID 2964 wrote to memory of 2404	2964	msedge.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://workupload.com/file/yALQmFUa6MF
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffead1ac728,0x7ffead1ac734,0x7ffead1ac740
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,1589218488738243045,192817365546387428,262144 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2196,i,15460827926925713651,12500672559702617022,524288 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,848914356832927021,7419848671712961315,524288 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,164047805047711655,15668354994934076674,2097152 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,12580042511261470182,10564580308182284263,2097152 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,3821129078335047183,5478585993457627124,524288 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5588,i,15126310313822195784,13024888087291079601,2097152 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5640,i,14526046897931279009,9125350798392688493,2097152 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5940,i,10012516198531837383,1585815889533893035,2097152 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4972,i,3531373571086979570,11939626382875017277,2097152 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5912,i,14155508634471332961,14356321446502987217,2097152 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4752,i,8913198850414481894,17965862900911793697,2097152 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4948,i,8475223572626316312,11592317939909279427,2097152 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5796,i,12879365347210551625,9878603714124865784,2097152 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5088,i,6955458723904567401,16014807524847586439,524288 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,1272543484367422838,14345613755087123063,524288 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,8731481703382875389,10046504705245364596,524288 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4784,i,3689761431371523838,18028305628028533444,2097152 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5968,i,8734852958532554493,17795267023431495974,2097152 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,1029878256184545191,4311377705067014260,524288 --field-trial-handle=1928,i,17316133470297518753,4073366035118116647,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:1204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1528

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4768

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Midnigh-cs2.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:568

C:\Users\Admin\Downloads\Midnigh-cs2\Midnigh.exe
"C:\Users\Admin\Downloads\Midnigh-cs2\Midnigh.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2296
- C:\Users\Admin\AppData\Local\Google\wininit.exe
  C:\Users\Admin\AppData\Local\Google\wininit.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4468
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1656
  - - C:\Windows\SysWOW64\ReAgentc.exe
      "C:\Windows\system32\ReAgentc.exe" /disable
      4⤵
      PID:5912
- - C:\Program Files\Google\Chrome\Application\wininit.exe
    "C:\Program Files\Google\Chrome\Application\wininit.exe" -
    3⤵
    - Executes dropped EXE
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\wininit.exe" -
    3⤵
    PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\Midnigh-cs2\gup.xml
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffe9b70c188,0x7ffe9b70c194,0x7ffe9b70c1a0
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,16502422385779197153,1826542303950327321,524288 --field-trial-handle=2400,i,9322790711444924906,8263775229618821149,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,10865849581823149165,4938248356297700080,262144 --field-trial-handle=2400,i,9322790711444924906,8263775229618821149,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,4288879381523814438,4629252667249855885,524288 --field-trial-handle=2400,i,9322790711444924906,8263775229618821149,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:13
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,6027494814321852657,15021702923635492453,2097152 --field-trial-handle=2400,i,9322790711444924906,8263775229618821149,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,16234566500728901270,12429812253287179880,2097152 --field-trial-handle=2400,i,9322790711444924906,8263775229618821149,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,15530284221666158047,5737709290057184202,2097152 --field-trial-handle=2400,i,9322790711444924906,8263775229618821149,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,766495050802512243,17778212852244717401,2097152 --field-trial-handle=2400,i,9322790711444924906,8263775229618821149,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,2892354433804263144,14134413386054453580,524288 --field-trial-handle=2400,i,9322790711444924906,8263775229618821149,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,15658066812887220230,11350062234403183031,524288 --field-trial-handle=2400,i,9322790711444924906,8263775229618821149,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,6213087539474661078,17452069017316730879,524288 --field-trial-handle=2400,i,9322790711444924906,8263775229618821149,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,6213087539474661078,17452069017316730879,524288 --field-trial-handle=2400,i,9322790711444924906,8263775229618821149,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,5021073863662334127,7525347987385571061,524288 --field-trial-handle=2400,i,9322790711444924906,8263775229618821149,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,8877187250970750693,17575684564586565315,524288 --field-trial-handle=2400,i,9322790711444924906,8263775229618821149,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffe9b70c188,0x7ffe9b70c194,0x7ffe9b70c1a0
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,2756808887484587279,6451949773063369992,262144 --field-trial-handle=2228,i,6798930645685584763,13399115947116454749,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,15282036117021947056,6579839895747736850,524288 --field-trial-handle=2228,i,6798930645685584763,13399115947116454749,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,3502104084662305519,3540084201886108274,524288 --field-trial-handle=2228,i,6798930645685584763,13399115947116454749,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:13
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,12159712955940602452,12831555673124961055,524288 --field-trial-handle=2228,i,6798930645685584763,13399115947116454749,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,12159712955940602452,12831555673124961055,524288 --field-trial-handle=2228,i,6798930645685584763,13399115947116454749,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,8297715950203280614,15505912945742013525,524288 --field-trial-handle=2228,i,6798930645685584763,13399115947116454749,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,9188345278625621411,16835494718247843024,524288 --field-trial-handle=2228,i,6798930645685584763,13399115947116454749,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,13560182548407099008,685730686955941845,524288 --field-trial-handle=2228,i,6798930645685584763,13399115947116454749,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
    3⤵
    PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5600

C:\Users\Admin\Downloads\Midnigh-cs2\Midnigh.exe
"C:\Users\Admin\Downloads\Midnigh-cs2\Midnigh.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1828

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

79e1d66f-ca3a-41b3-8260-08b75369e364.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\79e1d66f-ca3a-41b3-8260-08b75369e364.tmp
Size 11KB
SHA256 872fc604f2454799c6db0c405d1695f2a5e40bbe51d161160a9174fd3e2bb366
MD5 3016cbe284210e4c10c8b066576a9dc1
SHA1 1b7247e198458024dd2bd1f9f6415601de47615f
SHA512 06bf6c90b105c3487c4b03cd90c6fd73a58f813cf36d7cbc57ee46c6fe04e79cd62c843a6dfba6f8f964b5802b01fff09ad55278d8d213f253b45d11fe0befa7
SSDEEP 192:5RLV7ZNv7+qvAPRp2TX9pHsb+WNnG7Z+Ve/TDkwzVVyIsnAUgE:5RLV1tV6XGTwaGe3TDE
TLSH
T1AE42A62FA911693B6DCFD22AF9657793E6F5002162952E84E7FC8A2C11E79CC2317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 73KB
SHA256 6dbf4ce8bd7984da3b3dec2833e8107b11b10aa56a537a2e23284cc52a2d9ea9
MD5 86ab42d92e8aaa951eed274da507ad23
SHA1 311714e51063b0fa75cc3854c967f6a1d7ceaf10
SHA512 8272707b178435da9ec5a970dbfc34f76d6b0b0cfbdfa0fcc7c068507e0681318916ec3aecdd2f3227b153a5285bf1a4b9ab367ce2670223a925bee6e56ef655
SSDEEP 1536:moe3GAn1hvFY9yIeaRApCRxZNBo2TePOYqTvPOaYE6meGxfwpw3vidG7:mj1h9rIHApCReO9vWR+V317
TLSH
T1B17302C63DA8481B07FB429B47D08C556C2AB3A5CB7559446FB81C2CFEAA427132E58F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 3.4MB
SHA256 817bf39090bf6f5cff709ffc5839ccb7a3b6efa809f785072ce8d4656c4e6445
MD5 b6d676f797c2e87c742272c42b15545e
SHA1 345d3823f7283b3861b671ea31a8e14677258dbb
SHA512 f7a7a9f3c0f395a35d021d62965a600b8f21dc1853f9146aa5ad1e3cc97e44586a27d4589d3a64355a1e748a60d84e739d0fed578d6aa32cf91f96e497508114
SSDEEP 49152:mKpvxCc3weXzMpbmhtIp9iJ8oa82Px/3BrzvsGZ2JkkMK9vYKeGQ/CDYGM+7BRmt:mkVDEbeIpESnP/1Qi9w9Ve7zy7zfI
TLSH
T177F5332890129F3EDE9079A6799B1166B6F94274CADB006DD1E3664F30183CDF33CA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 1ed57b5c1182481bc9f0c4e6b860083813303c1f95feb4d0081265c9acac7967
MD5 dc717ab787c0fe0dacc48cd4d4e5328b
SHA1 f73e5a614b56c9aadc46fda2d025fae2a6445c8c
SHA512 40ac374546b206f3cea956d3fa2f4d99059c511a0ad2f0b05bcd8777fc7d35bca8ab059d0096e23b4f136e36be62de52a706e87f5d6b83918c2029a40447381b
TLSH
T1ADE0C29038404942EBB0A9FC8B950B93F13305F303172F8384E845E06CD6BD580A4C45
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 04047dfa6ce231ab4e1ab42beefa235229fb6aefc174959ef8b4c74f51606c56
MD5 7cbc4bf0dd96ec4ab79288560741db99
SHA1 7ab0be3cfb4ab63f83fb5ec832572b94d9d7e606
SHA512 f8e432c2e9258dfa47aba5be052fb6f6c0186629a29939b26599a931c4ca5b247de4c7d8b4ad64f176b33c1bff011c0f90bb4951637b9e097c54ccc4a32f28c6
TLSH
T10521AAE03BB40C1BDF507CBD52B62D57B56011F306C9AB4741C906A29893FD4486C9F5
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 909e2fdaa0f311da46adab7dc0ae47a59267dc5249b2a757f8dbef18b2665268
MD5 ae1d3e239019299e3e93ece9f6bbc605
SHA1 9d47821ae63094da96f4e63376bf2bbf2d1f9e88
SHA512 f4cf573fb25ab0380ad32c40fd0580d6e00c34a4383a2230e13e0c749b54a51593ad45c243c4f462f2f5befd467e2b6c897b3481a12d1553efae4426dfa883aa
SSDEEP 192:Dke+9JGwqJHE8WPJjPJVyDjr92q12NhRP+VBNbEJePyNbjM0MvlCCcLzwlz/xclU:Dke+LGwCHE8WPJjxVyDjZ2q12NhRm7N5
TLSH
T11D2292E7C3D88B2EC85552F55B243D27CE2E092856693D1B8CE8FF8B53E14B2D28154E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 859B
SHA256 7192c346b75d16ef0d2fb1d76a9b553fcd821ce3b38ba7be6bb78ebc738cc0f9
MD5 e70565be8515e1721d3efc26017fc7a5
SHA1 3a2b540ad92882e3a0d21ed80917a43abaf195bb
SHA512 e4cfef5bde8741bb3cb28e108d98b381c2492d21599663e08144f82eaa25d2ea9c8193a4e773eaf1d113e23a15543300c2c94eecd835037ee657ac48374366b9
TLSH
T171118CA7CABE7027506C857B5D047C0524B2B83125A3A8F8DE6681BCF0DACE70B16852
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 35490bd1ae0f6bc891a290d4a07e58f880152a9639947330c5d0d9984ce1ac94
MD5 9838bbb6b545ccf511e749555dbdf64b
SHA1 3ab6c717d2b895ad28dbd2a16f6897ed2e3bbf2e
SHA512 04a10478ab73e82cb0c19c621080a1b78d4f167a0c37f00584df15bb87f13d9239347e07d499ff4e853b852aac7d3dfdc67a8f447a8900c7ff77bfa1f34a41b9
SSDEEP 192:5RLV7ZWv7+qvAPRp2TX9pHsb+WNnG7Z0W2PTDkwNVVyIsnAUgR:5RLV1iV6XGTwaH2ntDR
TLSH
T19A32A52FA911693B6DCBD22AFA657793E7F5002166D42E84E7FC8A2C10E79CC2317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d95f8399f41d0553148e53d0bf0cb5b597dce80190e53defeab79a8363efcf62
MD5 395a7ac58a2d0036a1fe92676852e30c
SHA1 ebc104028b78c9f83d5603b06f09fc8b2f96cfeb
SHA512 0c0f7e34eefab4796848af42ce5c06696918d42be34e3e1d83a0ea258ce47997b048607556e1d9a6b20cab387d262d98d3024a8251a3507b91e35bcdae1eef96
SSDEEP 192:5RLF7ZNv7+qvAPRp2Te9pHsb+WNnG7ZfEYeTDkwzVVyIsnAUgE:5RLF1tV6XHTwaOYETDE
TLSH
T1C042A62FA911793B6DCFD22AF9667793E6F5002162D42E84E6FC8A2C11E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8f7bf8404935da1530f1e44afdb27cd0fbfb6aed9d346ad8762acc211d58f9d8
MD5 8d8801f590cc73ff255397c30b31dcb2
SHA1 0a2950d28d2c770c660d8c86458d76923c94ffcd
SHA512 f601b3f38ba7106c40ea65afdcbbf3d4eabdfc29d2a5f990020000e4ff5a9a9c8f3e5b9ea99f25cb14d3e15330278389ce0dad7c50df86b25b31d1f6f03e37b0
SSDEEP 192:5RLF7ZNv7+qvHPRpbTe9pHsb+WNnG7ZfEYFTDkwNVVyIsnAUgE:5RLF1tV3XOTwaOY1tDE
TLSH
T16642B76FA911793B6CCFD229F9657793E6F5102162A42E84E7FC8A2C11E79CC2317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fb377604f2eff03c4677a647c8c94a33496bb6a03f2ca3b617f73d6d02079dca
MD5 c879080c9ba72d4bd02fa06950d0d4da
SHA1 51eeebb8e8d90b5930e9e2aca5c65a6a5e11bd40
SHA512 b3049b1fedf12cf8e69c46588916533fc10ffee805ef2066c1e5abada55bbd8178d890f43ff726bdcb387c44a2df1d11d1ba3d3d6ee4537f088d19751b4a55f8
SSDEEP 192:eLE4K6Xn7KxkXqK4I40pUZNCgVLHrKHfFKslEiTtXzKD/ML+ErUkKNxn50i4S+h:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLth
TLSH
T11532C727A48E9E7F4FD8E51CDC477F4B6CB502567378082896FB9C0403AA78A214A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 7358d61428e52fc6f9adccf084a94cdd71270495c4ee49d4e17d7d5795bf855a
MD5 22fbd50c1c97c75f51c7ff05734e73ce
SHA1 db66b5e8c2dea68d4d1407b9111d7c632e5b9265
SHA512 eeb6d36f08a0808b57365db5d6103e1b4d8c79210153c66b502c8c51e4db3246bf75972398fa2a6e5a978bd60ab7913053c520402652bc7cdb7549ba4d40c36d
TLSH
T12DA0021123510109D00406B511954761B314C851968103076CD8A1C4DCA8D809D02024
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 11f428444ebb6872a4ca0b3d056c4993d31b4c34b5355473d90c977598f0731a
MD5 7d8d1cc4b68dd06cc0eab3daf4b5b65d
SHA1 48d05f2738d74ec3a1827b05f34b665973a90c2a
SHA512 6593c01f8a5fa61d4c3cfc4e5441c913d6c93e75972d508fd9b3c8fe5a11f1921e863f03dea34f95ccf195c0ab948f53073cf9b4d57119217d504db2655aa240
SSDEEP 96:EbJ0d+Ar2aetJRxW2rgj0+f+U+/EmezKSl8h4otop5a3DBB6cXGyvTNcZ2nQf99m:Et0Nr7OJRPrL9/EaiU2G3N2IcZ2QfDyb
TLSH
T122C10A72542E5CA75DF3A445B1033E43CDA8316B6A25BE58EED91F0C00974DC4383533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b3232531fbda0cebe18e662eb3a86239aefe96cd5742192182d5886531fd5871
MD5 a53f79251b16d6eb9c4f15bd20af2f19
SHA1 5b47835beae06c65555d3e0ff571e04591eece71
SHA512 50e5600593c4f66d249f36cc78f98d1c1d857419998d5c24e092bb2c4f6bedca569b23ad3043bdfa22048096dffc89c8a826c5955ef45fc847603e82875e817a
SSDEEP 96:EbJ0d+Ar2aetJRxW2rgj0+f+U+/EmezKSl8h4otop5a3DBB6cXGyvTNchCzb30n1:Et0Nr7OJRPrL9/EaiU2G3N2IcMn0QfRg
TLSH
T1B2C13A72687DACB369F39456B5433603CEA4707B9A21AF54CAE91B0C00D70DC0387637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 605361b240dad0dd8b0dda5792de04d6376641260ba245f6d7305f49f2bbf9a5
MD5 dfd0aa1ded9fffdaebb905eb029e65c3
SHA1 26484cc561ccd54eefb8557dd783782b41fdfabf
SHA512 9fa45736011466cb62f46c0c98a1e6ca8a2a9e5964a52eca8ac1525cc112ab7338226b38e3bea1e76f3ead975e242a62fa4af5344af71b28e2bbdb6d9e93b802
SSDEEP 96:EbJ0d+Ar2aetJRxW2rgj0+f+U+/EmezKSl8h4otok5atDBB6cXGyvTNcZ2nQfO9A:Et0Nr7OJRPrL9/EaiUDU3N2IcZ2Qfsyh
TLSH
T101C10976947E5CAB5DF3A499B1033E43CDA8616B6A25BE58EAE91F0C00974DC0382633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 abe69075ca6bab581aebbd1a0d943e4d5d2bab402a5a51eafd3598279cb337cc
MD5 b8c5d1d81adf4be0e2cadac4f101a1f3
SHA1 c437f82a590c4f90cb8a957659b94d383cc8ddc6
SHA512 c5fab279e5b01b499e4f24b375c1ea26551d09be0580a04e71181d475783b3867dc84b3d5ad4005d8e3e0c543837e99576bd4062388bd237c9fb50d7ae2e552c
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EmezKSl8h4otop5a3DBB6cXGyvTNchCzb3vfLV:mC0Nr7OJRPrL9/EaiU2G3N2IcMnvfiyf
TLSH
T18FC12972687DACB369F39856B5433603CEA4707B9921AF54DAE92B0C00E30DC0387A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 bd500b5f4ed1b0b6d17932e5bffa8b636ceff8d412921623c6933bd38f69dd63
MD5 1a7d406589e0ec4d22bf3f4f9af196b7
SHA1 77db6db95edb2e1ba9c792031ddc58962cc38cdc
SHA512 77db8c21086f2c56723d363b0d49498855dbf094bc21d613eced20e0096cb91216c9a964802ecae91e455e0ecb83864cf55225752297bb7ec6267c1f5717f8ae
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok5aVDBB6JGyvTNm6zjh+PEhiv4a:mC0Nr7OJRPrL9/EtDUDs39Imgjh+shM
TLSH
T1DEA11932647E5CF759B38549F5563B07CFA4716B9A21BF84D9DD2B0C10A70DC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 12KB
SHA256 c182aa907d6c483bd62c1c8eef5c2e9b3035f55c10ca92da3cbd3f80243a7ea6
MD5 2f5f319ab0ab6394181f66a8585299b9
SHA1 a6fa5053945b1da301d538b99bb4871ec963bd0e
SHA512 ff76cdf39322ce35e2e99bef5c1115742b8743dd1d8bd384b9f9615bf2d21154979f8f9184996d032ed321702729ce79e93b7ff1b60626bf86c625dac0e20dce
SSDEEP 384:Eto7Ixd/EaoNCZfdTC2zvREMpA8uuyY93944/lWH7wfujBaT:mo7EdK4ZfdGQvNpA83/lWbnaT
TLSH
T1AA429F35687D4CB71CF77909B1432E478CE9607B6B29B959DADD8A1D009B0AC236303F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 aa286867bc05b45d801145c20dfa9b4cc39ca11123bbb90ef04e64d97aee22b1
MD5 10fff967bcac67ea3614bd437238efce
SHA1 28854682b609551783da16f0df8ca6bc67904783
SHA512 41c1a54e4f6500a2bedb10141245b5f7b6a58d41dd30dd34acfb192ede3c580671ba61896d07585e41091ddc167bbbc698213b593761a6516da34ec32f3ac75a
SSDEEP 3:MsEllllkEthXllkl2zE/l0+//:/M/xT02zE
TLSH
T12E4402457B840806D5001130405183A02370D4610652EB43246104235CC5A800CC4101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b5b369bc5b1f0e5824a13ba2eb0e1fbad23bc2955074bfae65fd624e5741ca27
MD5 adccf9fdd0a90036d28cbd2af59d8799
SHA1 d5ed64b41be7f0ef983466e210499c6b3782c7be
SHA512 e586880eb5a7e33a92a27b5fd690ac4d3b9889bf2fb1ab933f8a011dd0f06234889156192348a5729b8009027649db6295f4f2d470a1ce1a9a246d783d4f0583
TLSH
T117D0A7B476299901CB0B11315514D661335683647C8B967385A1740D9D7A850D69E1A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9bb02e5c3df0fe5da83794bd9fdfc835234bd8051ebd671dc536fc72b521c60f
MD5 1518285c968ab72392c86c75a8ac2a2a
SHA1 8fc3874d30c34841870f1b306694e5b4ff0ac295
SHA512 908df4f740c1becb3f92cf0fc9a04e433e63c9c814f694281b9aec9b65eb60564d14d427617215ecd3564122c459cc98464217d15b9dd5cbf115803275a43a97
TLSH
T12DD023B07529EB80CB0D003540245A00322A82323CC7032399917C0CCD7D800D3DBBF7
MD5 SHA1 SHA512 TLSH

Submit Download

356343ef-1373-4f29-aa44-c3bb39cf1d97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\356343ef-1373-4f29-aa44-c3bb39cf1d97.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

94a6cfa7-3166-42f2-ad7a-68f0c106cf08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\94a6cfa7-3166-42f2-ad7a-68f0c106cf08.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 788980459dbef565a982fa8087f60486348138c1821532b3db954f2f0fc55e01
MD5 692414c97ab7182677c8a67ddc5b4ba7
SHA1 6f1741045c8cd1830542588a3fa2b2dff532479b
SHA512 6f9394dc7da002864df43be88274acd4acf76b446df7b763f2d8f431c8c553035a06099d7f1e4df69c09d5a2629b0104855c6b6c6e1ac3a54adc4df15a93322d
SSDEEP 96:gQbAc/N/lFz/bVLbq5NqlQ2c1TYIs8lV5T9z+iHiSi716hhU0KpgASUQ:tbAM/lFz80ly1v9iiHiSiLpgASU
TLSH
T15D13583DB9617EF2D2A411BD8967AB3953B0E0E3D6A44453ACBC74FA54A0F8084CE917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 50edf64ecfe612a3cfb6cb7e6114d575bde37058fc703a5e3420b6c32a3b8ad4
MD5 45186e44fe87ef6761de274b195dd393
SHA1 3a27802db3775f7997d69e28b237a7eab3e25822
SHA512 5a55ec16d22e87c570744aabbacb06dfbc33bab14d535c472993deea0c4ef92d4289040bacf76231f7543e44b68f9b6cb52f1289c2b14c623561d81f253fa0ed
SSDEEP 384:aeMD3lt+DuZKp4OMNvrA93moL/TAOL/2XbVjBnu78gJmT0CN0wEn+A:YD3lt+agp4OMNgL/TAOL/2NBniFCK
TLSH
T158443FFB1950601ACBA852F5D6033E6EC077410E6CD6E8E8EA7C5C912828F75B2F8F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 ad0c4468bf3686611ee40a85110c812af72c26bd8642271f18f20929d0a83437
MD5 5b65582629d0a2135ce91f481d8aa6ba
SHA1 72f9f760305224df92ab4f862a57c2095f03b8bf
SHA512 620f3d56864d360f5cbc17c1cacb09b05b9bc2dd248f56a657db23814a559fdc431b8ad71944e3af8e962c0fe20f10e757e2f449e20c5811f9d5cb7866afd179
SSDEEP 12288:o2ZTHpXQpEJs9Lu2TjY2vLfyXPBAOFHZBaVxqVeo368MKfN4GfHq7wZ0d45qoVu6:DHpxZguK7hyRr
TLSH
T19E167DEDC96858C3CE62D930B1F0E9873C7453C3F995D1D6889CC194016BBC5BBBA62A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 bafd5ef7f66b9204ed269bd4936e93a2b42edb6faadccb84e7484e12dc0c573e
MD5 eafe555c87a74f9c1126bcf0fb80284a
SHA1 058583710eeffe696f3b7184d59a677770e2e036
SHA512 7e959e3088d1829671f9fd503a4dce853b98f744bb611cd1697e18c350f2dac47bd7947f9738e691d528be917f2e534a43c5f6e881a14e80fc5d55b0d02ca842
TLSH
T1DB210D6803281ED7DFA555B2AFD1466E32F9AC6F12C72F901C45AD30ADF1F9450D1443
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a80ab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a80ab.TMP
Size 1KB
SHA256 0b886b31504663ba089ec2b973a7e89abb6fb3c8bbd30eb03972cf42333bf28a
MD5 79ee0d1fa13af5c9a49d29812f7c0254
SHA1 4b4bc38edf166c85150e96d1a4e56d2ca0ce384a
SHA512 76bc8d87d980c3c8650610ab8dec0302ac543fbeb4d0c3f1fc9841d78b9f458dccb52c64e15d6e0c64874ead94f5250f801a791608d4f215f67c5494eba29fd4
TLSH
T17D21EB6807281ED3DFA255B2AFE1466E32F8ACAF02C72F900C45AD31ADF1F94A0D1443
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 9c886a8436516817ea5513d50d78ab09e73a6307d32dc11a1037c5d15723f777
MD5 d18d671d58a37ae95001fe2a33c563ae
SHA1 b788318446d409d75e792356cf80226ee396b600
SHA512 40e9ef3ed8ef6479a58e05b4ce6bdeb3708634bd1dae22296516129f4ea214bdb63e68b1a7ce2dcfceae600d9663bb4e3362486e139503a528a1eb603dd428d3
TLSH
T1C7E026A814CBC1BD905CE8D7837D630C82D2350AE28839A2A75F9C847142A81A7AB281
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 15b0860516dfdcc222ca29f7560153e2eb9545d43ca4bf7259d042784f9bffe6
MD5 072538c7b45a02716a4bd6a8b4e41534
SHA1 ddc55965adaa15a4eab3a99c625aefe3c0302b28
SHA512 d763c17894805f5dd8e8dd7346d182bb7fd00f3d4432d6be0307b37b941785ee51c87e5052d3dea77ab0a94034b782f9160ebe135dbf95835a402bcdc499c1ed
SSDEEP 96:r2UkDOM/VtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/pErbbEOVpZf24JkMfXSq:r2RVKH+bF+UI3iWGVoWN3qL/y7VVV63
TLSH
T16624111E5F342722CDBD913668E744A35C7CF03F8B5366DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 849daf7bbb4f30479671aea747c55a622a7feba8370c7bb5053823b2e8252ea0
MD5 f86cefc5b84574d2585b9784a7d3c814
SHA1 1ed7703603a64d6f8d65dc2c00f6ff0d2a459044
SHA512 f216cc0aa947a74a639a77ea692bdceb6179bc47420c1748867b36ced648a1dd69a9197a5b078e4f9ad5ad9bb6eb2350b452fee4b2489a9789f02213c33a5575
TLSH
T15BE020F055DEC15E534860C7421D770CE3B1350AD6CA3F426B0D9865B507494E7A15C1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8b79a4024ca2bb22767728ab0ce89d5786c9123c499385f23304e56b76d23a5d
MD5 bc5f951fbe30cef7b1e0588dec26d879
SHA1 ec9d237871367ed25dd69c0339cd949f73c330e1
SHA512 f9ae2b815d383372a78b35fb9e6c72e8a061a0422974f9020538025812fce79a303d76eeddbcd0f3ff618fe6c272cb8d21e5741f3f5c65a73475fb21c3983348
TLSH
T196418CF3C3E8866D890155F0AA146E2BCE2D0955832C3D5AC9E4AF1B93E3471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 30198254dc76328e7a7d644c668f812204da7a8a58d13d4e536623daf0953e7c
MD5 df731f50f4f6614e7a82bb62cb547535
SHA1 35d7766d82e5f1aba2c5fb707504cc045096e9e0
SHA512 99c678b73f17ff719fae2723e31bbf64437d1c243df651505f87f8e7099e7a8f34a9ac494b3d237046fbab0ce66e88ba9c26bcd42089e98a75be02ba60594629
SSDEEP 192:sxR8RcyM/jK1Ml8zCI/fIseWpVRVpq1zOIzoD8p4R/g6+WNIYKj+M7g2IgVOGnJ:sxR8y7I/fIseWvRV4qYg/5Ib33
TLSH
T1EF62C815AA349977DCCBD20DFA557F53D6F91433A2915E449AFCCA0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7102c16942e02f40b5e5b28e817b9486a2822e78da7671e777c85ad7089f5ea2
MD5 c0ea01e9b18da6db16de86cf166ace45
SHA1 d32adc51154c692ba246b3d30ad5724c34862834
SHA512 d94a89221b63b7d4cbfc1b645d47fe9b482ee6e53a6d86c220b406804b4e3dd7ddf92bf2c146e0937de1a67ad44d6d356f03cb95971be0f4d51b86768dbd8d8e
SSDEEP 192:sxR/RcyM/jK1Ml8zCI/fIs0WpVXVpq1zOIzoD8p4R/g6+WNIYKj+MJG2IgVOGnJ:sxR/y7I/fIs0WvXV4qYg/5Ib33
TLSH
T18C62C819AA34997BDCCBD20DFA557F53D6F91533A2911E449AFCCA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9801225a31b9d4466b21ea1e40bf39649031eb4432cdab39730d8a45a3daf011
MD5 fd07407356bb27946208d0565420a5b0
SHA1 7bee040d414e96958eea144e20ee2052f396277c
SHA512 8797e41ef4dc9b38101049a672e57c005b61dfc1d3de70bdc8b01daef81ff305d3fcb489a650df58be7babc65a496617f94b82d2a9c4dc900bbcb448183db14a
SSDEEP 768:UtiiY77pLuLfKNWgv7fgJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPpN01roYRF:UtiiYNEfKNWgv7fgJu1jaCf0OUF
TLSH
T1C1E20D7B640CCB7E4F804A9DEC29BD9B6DD801CB5AD8CD9447EA880C03C67EB551A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 31c802171ca3ab84942f1cc1eb3cdc28bb8a208ea31f6673c9874cdc41dc900e
MD5 9074845ac2d6aa8b6dc4f639bbd95877
SHA1 0b570a802fa1d6c39d0b1dbca4fd5e7255a6a2d3
SHA512 57cd3c3cd2a6fb6029c950e5d32db172ade23e5b0f28776112ffca107d577fe6b539b17537170922e81542e348f09c93532d498208d8d83c779ec6d3d76cae95
TLSH
T103E0D86026CBC23F618D60C7432AF70CC1A27806D6CD69617B0DA6D06207584BB97540
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 8ee86854abe5a8b01bc96d0218f23d0f5b3e6bfcc9c27222663b9aac771edd2c
MD5 aef8e5d577cce68c37d0fa40e8ed3189
SHA1 c8724718bef5f709d7ca1e85fa4c6a400cef609d
SHA512 cba60871a5dd90ab04497c13c40e19982c6e0a747154b52dc20592c0a74db01f9937563e9366a597c03fdef2fc215577100cc708e84ffb9ead9c6e0ac42beaab
TLSH
T1AAE086F466DBC23E5188A0C34269EB1DC2F0784797C93AD6A70D55A1A503584B7BA5C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d4f82756ea0b8681cc2fa09cdbb2cc2d059be1266f0dfff9f82c739e5435de4b
MD5 eaa15ef5fd3503dd6ab05b2354a67e14
SHA1 aa2fa48be747bcaea773faed03e121eee36d0399
SHA512 df27e2dc1955e1526569cd90c91c49c65090c5819951c2a6ded1f553820b695241475d34ee70eb01702257a369fd22479f8cf12c01271e166fbe82e3a6b86e78
SSDEEP 192:Cm7KmgIIJ4tWGm7g09OGlkEfEIEtEpEfEdE9EcEJEmEtERE7E4gE/EeEnEvEOERR:MUg1b
TLSH
T1ACD11945713F0291393EAA0991B98C2FD2C174A7306CA46B7BA911751F6BF03ADFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 a16aecef7e5f11a5d412e04ffda93e91f06a8854e96748104a3e1b0fd6d03650
MD5 421061003b91e3005f9fa394b14932ef
SHA1 b6fd6d2f688331373a3b61fe9cbeb17b58519407
SHA512 c027509f245c21439ab1737a789ff673b843248f7be8f359d62a459069428d6abc937e538aacb295ab9bf9539f196d1225604586e3512fbf5831139d253313b5
SSDEEP 384:DNrRZyCSDnxTICx5CMEhIKyll7svbFKfk7:xFZJSDniOyI1l7svbF9
TLSH
T10F44850A7B747001EDE6D9725CB080771E3CB16D8F22E6916DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebf86fce-610c-4da5-bec1-945aef3af744.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ebf86fce-610c-4da5-bec1-945aef3af744.tmp
Size 414B
SHA256 b7a27e38668874ba32f6c28b7924d2318a759119d6f53191feb2c557daa4b4d9
MD5 088549c8bddf12197b6e28713265f4e1
SHA1 423c4b008b07b41da487d10004457632a95c441c
SHA512 41db8cc7ad50cd0f539d0c390bd32805fceb7a73a4c5a2b15682f41e616cb2e10e15fadf71600c40d5655938c1bb895926f32e61d9dea3583b834007c22a7b37
TLSH
T124E02BAAC8719D3B1CFC0719A0544787F74513473A81855F7A3CD20C8FB0677424687C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 03f6fe423da85e20abc58e9d3fbe1c2c4130b53876c4ad0ca74c977e551debb5
MD5 b97030a48ed614af6ff4d6e9fcf686a4
SHA1 942ffd91aeefc0faadc0fc59ca447d7e3ff7a732
SHA512 eabfa4938b638e21391ae55d222d275d678f955e9adb4989b4ca579327f3b57f62925d49a17ca89ed83db37cc4e416f5b91052cedb4e5560220c8b124f3a6bcb
SSDEEP 192:WbnOz6ZAsOlrq8ssipy95QkIIIbbLMIMNsYcY:BzTsM0srQkIIIbbLMIM2B
TLSH
T11E42736B26051B77C09E5F76136786409BE888814072B16D7392AD5F8EF3EB783C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 281f09993061920ffe60e3763ce42781cc69de16d560ed63d5216cd2c4fe2859
MD5 f7656e2c34c09bf973c42eb5d31c9b9e
SHA1 32ec3c7149b6d481768e563e4aa48365b915f626
SHA512 f82fc1a2358c82b59ebb597a0937b382b6e20171bf288f625797c65c5de7f7b0776e98601c78d0de19b093ebcd4902c6efedbac258eef947e699058a29fca8e1
TLSH
T1F1E0206074C7C1BF605D70CB0179530C82813407EB842959AF0DCD4475425447F5B542
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 a88e2ca6d3a0bee742763ad369234d4effba82c7d6b50588a2b54b33afa163c1
MD5 dd073c3c742a4fa77ae13b433a12584d
SHA1 753db00707bb2f75191518246ab7337ad5000745
SHA512 eb9a7638eda141824caf2534d03f37bed52a94926229e27fe39c5add54070864c2b758aae8e1d7d0e4f8bd6332f167b04bdc76e4dedd5c1c90c0d1ebdd5c3f2c
TLSH
T107210456F330C148E15A867E907F9B361738D8168FBCDC0F40BA20346E76B040E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 5f96c054d5ed43d994739886de2e8a70d4146e9133fb99b7dd020fe8d646eb20
MD5 d699e4fe220f8698cd41364e37a34623
SHA1 1e9746c215731dd3eef2451c24df784f65214b69
SHA512 693b9f87a22a8ce68c004372a4788d81ed523e8ab4aead1121d7c7916d951abc9ceb421f42ab951ef1cfd1991ec23f80a4d1c50fd58df0e745569ef31afa7dc3
TLSH
T137E02694B8CBC1FF905930C301BAE34C82D13C03EB892F42AF0DCD84A502981BBEE181
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b2f0e4108833c0333b828de3878fc651d69b8e3d3afcb126eba4f6bc1fff0414
MD5 1f708d796e62b593e340148008f3d2f4
SHA1 bb90475a782f85aa32b582c926a0bd36207e4289
SHA512 777640b89ba316db50944d29dcf9a2ae7a11ebb118958b2829c3e68044e34c9661047cec954b7874296bcdfcb77210435d6a5d21a4fc5d9c9a14954e247f498a
SSDEEP 3:MsEllllkEthXllkl2zEfl4hqlt:/M/xT02zVhql
TLSH
T1364404147FC0040DD5003030F055C3501371D410051157C334D744335CDFD504F10404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 aef8800d1ebd44f3ee83c011666936eca065db1bfa65a6f307c4d122f08d37d1
MD5 c84ec50a8bc41a3ee5060e79ca6ad202
SHA1 e0f0bd1132db957568889821668c492e7de83fa2
SHA512 1b94b543754f5990367dfb4d8947c978e7fc880e97030805119fe75aebc44a3ceca35465dea31e2df2487ef76163edb370d840b2f9b5cb509cd7fa2dc46d68a1
SSDEEP 3:MsEllllkEthXllkl2zEflEUt:/M/xT02zM
TLSH
T1704404147FC0040DD54010304051C3701370D410057157C73CD154335CC7D404D04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 988cc3ef70486df7d2667ea2104f3583b4bb400f2d26d7c9aa93b10ab75d7cbe
MD5 bd238a1f413ca6928e9eb79b2a605dac
SHA1 a2041c8188b3084df66f9cc0d58401ddb6757945
SHA512 8201fee964ff6e26f6809983ab34e87712331b9e8c1a67b4868a4fcaa2a5060562882c028be6f98e10480a5a0c7d4f9de3cf57068a1b8b04bfd0f574d2d6e37a
SSDEEP 768:hfD325OWlYy7xA7Hucys6BRvi82oP4/z6himoxxb9MJp:hfD3SxV3imOz6ImoPb+f
TLSH
T1CBF2BF34AC658E72DCEF9255B1893B937FE0623786CC0DC4E5E9DB0D1583A6D070B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 461dca66e090ca2e286088f603560f772d03c7d89572f6185d8f8af6a8ba0ee3
MD5 83ec32d1eea6c43cc760e9f4139a1838
SHA1 bdb1e22206d53fcec63aea5e74ea65e3b8db1147
SHA512 b728cdf94675c1ff6687c163c1df27417c3b9ed60ed1ae605b3a8897f445b4e7a00ee06ef9bb8d75a617ce94f42240000d6710d2a633d52e7fd5c067e9fca812
SSDEEP 768:xGrv+4UNbdS38oPlYy7x87Hucys6BRvi82oP4/z6himo+H2bwn+h:xGbsbw38Ix53imOz6Imos0w+
TLSH
T1CF03C035F4549972ECEB8188B40A7B533FF8522346C91AD0E6DD5F0E029BA5E630BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 efef1b44a2165512dc018a64d992a36cbd8f6d3ff3a925dbac9811c81c2937a8
MD5 2e8640be8c74750c44739c09241f0131
SHA1 083ef5e014378d9bf07642054db6a9ca2a7bfc0f
SHA512 78f44f0922da3eeed1f08d5eaf514e1a351abdcc874621cdd0edb8775248c1c8097d7802f0d792565d063ba47ff09d1eee9a31664ed4265d37f5656ec676a72b
SSDEEP 768:Pkrv+4UNbd2343WWlYy7xj7Hucys6BRvi82oP4/z6himo6OJSMU8:PkbsbM3uxK3imOz6ImoFJSMv
TLSH
T1AC03BF31B8699D33DDFB8188F0467B937FE4222385C81D94E6E59B4D06C76AE130B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 491e0409e45c914a3ea8793e7cdd19c257976efc414432c0eef2341b855887b7
MD5 81dbbd7b1c474ba7773601d75d31fddf
SHA1 7f113d05635991651290227e9d14c91b8c84e43e
SHA512 05e8ed4241c42c50017ed719abfeea1f199bf47f020035a9cc274ab0131f9db31eefb15f7bbca1b8b4a6047e465d65619f4abdf1ff20419b87aa5bb7a10d2920
SSDEEP 768:PfD3v5iWlYy7xj7Hucys6BRvi82oP4/z6himo6dsb2Fb9MJ/:PfD3BxK3imOz6ImoU+2Fb+p
TLSH
T1B8139D3CDC518D3E88AEB349718D3A622DE41237C6BC4998E7E59B0DE57396CF706821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 2e561e7ff03ca49ef502e29b6a598c362477aff611277c244960345e3d0ffa07
MD5 cfe8314e7c99e8dbd2263f7db00b3917
SHA1 d578dc07b9957a3d692767faba32db0024333db6
SHA512 73d45a21d14bfff4ca105f46e34598850a9646d0ec1d5a8e4266c6adb3425092fef909e2778a6e4f09ad0174e3205875afd8c4a867ed505bf8dcb492768f420e
SSDEEP 3:MsEllllkEthXllkl2zEfl3eWKll/:/M/xT02zT/
TLSH
T1F84404147FC00C0DD51030344071C3D01371D4100511774335D104335CD7D400C05440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

Midnigh.exe

Path C:\Users\Admin\Downloads\Midnigh-cs2\Midnigh.exe
Size 3.4MB
SHA256 76ffdb6f4a21c7a0b983b641eeaae0e5312efa43ecacd1a1c156fc77973ba063
MD5 53d23aaa9fa6d7ab51cf25292c16a895
SHA1 2ae6c08c2d94d97a81da0fcebc7ffb177b6872e1
SHA512 956e0ca39e12e7a93e3a1cc9e139479a8271e9994e7ac339e80e212570f508786788da9d3c523d944bd5bac4d834127302f69b55198c4677bac7b11fbe7e0521
SSDEEP 98304:EFvs3RiauwC7UX4l6Go63qMN+m1xiqmG+Eiyl6:YvRT+4wUdvdl
TLSH
T194F5331ECAFF99E5FD6FC8FC23269A6BBD532D15F59CAC25200630504E86E563C60B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1656-1258-0x0000000006A00000-0x0000000006A1E000-memory.dmp

Download

memory/1656-1311-0x0000000007E70000-0x0000000007E7A000-memory.dmp

Download

memory/1656-1314-0x00000000090F0000-0x00000000096AA000-memory.dmp

Download

memory/1656-1313-0x0000000008B00000-0x0000000008B22000-memory.dmp

Download

memory/1656-1302-0x0000000007C70000-0x0000000007CA6000-memory.dmp

Download

memory/1656-1303-0x0000000070D90000-0x0000000070DDC000-memory.dmp

Download

memory/1656-1304-0x0000000070FA0000-0x00000000712FB000-memory.dmp

Download

memory/1656-1307-0x0000000007CB0000-0x0000000007CD0000-memory.dmp

Download

memory/1656-1308-0x0000000007CE0000-0x0000000007D83000-memory.dmp

Download

memory/1656-1309-0x0000000008450000-0x0000000008ACC000-memory.dmp

Download

memory/1656-1310-0x0000000007E10000-0x0000000007E2A000-memory.dmp

Download

memory/1656-1312-0x0000000008070000-0x0000000008106000-memory.dmp

Download

memory/1656-1259-0x0000000006A60000-0x0000000006AAC000-memory.dmp

Download

memory/1656-1257-0x00000000065F0000-0x000000000694B000-memory.dmp

Download

memory/1656-1254-0x0000000005C40000-0x0000000005CA6000-memory.dmp

Download

memory/1656-1252-0x0000000005B30000-0x0000000005B52000-memory.dmp

Download

memory/1656-1253-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Download

memory/1656-1248-0x00000000031B0000-0x00000000031E6000-memory.dmp

Download

memory/1656-1250-0x0000000005FA0000-0x00000000065EA000-memory.dmp

Download

memory/1828-1166-0x00000000003E0000-0x0000000001036000-memory.dmp

Download

memory/1828-1163-0x00000000003E0000-0x0000000001036000-memory.dmp

Download

memory/2296-551-0x00000000003E0000-0x0000000001036000-memory.dmp

Download

memory/2296-1223-0x00000000003E0000-0x0000000001036000-memory.dmp

Download

memory/2296-1157-0x00000000003E0000-0x0000000001036000-memory.dmp

Download

memory/2296-1233-0x00000000003E0000-0x0000000001036000-memory.dmp

Download

memory/2960-1251-0x0000000000AA0000-0x00000000016F6000-memory.dmp

Download

memory/2960-1261-0x0000000000AA0000-0x00000000016F6000-memory.dmp

Download

memory/4468-1244-0x0000000000C60000-0x00000000018B6000-memory.dmp

Download

memory/4468-1315-0x0000000000C60000-0x00000000018B6000-memory.dmp

Download

memory/4468-1243-0x0000000000C60000-0x00000000018B6000-memory.dmp

Download

memory/4468-1234-0x0000000000C60000-0x00000000018B6000-memory.dmp

Download

memory/4468-1245-0x0000000000C60000-0x00000000018B6000-memory.dmp

Download

memory/5032-1283-0x0000000000DA0000-0x00000000019F6000-memory.dmp

Download

memory/5032-1281-0x0000000000DA0000-0x00000000019F6000-memory.dmp

Download

memory/6028-1172-0x0000022A1CB40000-0x0000022A1CB41000-memory.dmp

Download

memory/6028-1178-0x0000022A1CB40000-0x0000022A1CB41000-memory.dmp

Download

memory/6028-1180-0x0000022A1CB40000-0x0000022A1CB41000-memory.dmp

Download

memory/6028-1181-0x0000022A1CB40000-0x0000022A1CB41000-memory.dmp

Download

memory/6028-1182-0x0000022A1CB40000-0x0000022A1CB41000-memory.dmp

Download

memory/6028-1183-0x0000022A1CB40000-0x0000022A1CB41000-memory.dmp

Download

memory/6028-1179-0x0000022A1CB40000-0x0000022A1CB41000-memory.dmp

Download

memory/6028-1174-0x0000022A1CB40000-0x0000022A1CB41000-memory.dmp

Download