milleniumrat | 748a02784c8a04459884778a66b2dbb5156b01b324c7b73f06c8058596d1a030

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update1.exe
Size 2.6MB
Sample260724-an6weadh48
SHA256 748a02784c8a04459884778a66b2dbb5156b01b324c7b73f06c8058596d1a030
MD5 bdc7dc0d39258a4055a24db6eaabb54d
SHA1 2a48ac416efc98324f25301a32a03a5786b738f9
SHA512 7090879e2d5527e40425dce2e416a4593b8329fcb431038fd951d3be99dd4bc8c219f8bc200d56056dca1eb965a4c74820a1eba3fb3f755ed7bc371dedc45eee
SSDEEP 49152:j5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUL9KTnUVz:wTrVI4dGOgGpYHCO
TLSH
T15CD59D62F782D0B2E4D201B152BEABF74D787535537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery milleniumrat rat spyware stealer

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
behavioral2/files/0x002400000001c2fc-0.dat	family_milleniumrat

Uses browser remote debugging 2 TTPs 19 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4284	msedge.exe
796	chrome.exe
5832	chrome.exe
208	chrome.exe
1968	chrome.exe
4708	chrome.exe
1276	msedge.exe
5720	msedge.exe
5520	chrome.exe
5912	chrome.exe
484	chrome.exe
3288	msedge.exe
3396	chrome.exe
244	chrome.exe
6084	msedge.exe
5464	chrome.exe
2396	chrome.exe
4764	chrome.exe
3692	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
4992	svchost.exe
1840	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
6	raw.githubusercontent.com
46	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4264	chrome.exe
2876	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293264664180060"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4992	svchost.exe
4992	svchost.exe
4992	svchost.exe
4992	svchost.exe
4992	svchost.exe
4992	svchost.exe
5832	chrome.exe
5832	chrome.exe
4992	svchost.exe
4992	svchost.exe
4992	svchost.exe
4992	svchost.exe
4992	svchost.exe
4992	svchost.exe
4992	svchost.exe
4992	svchost.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
5832	chrome.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
5832	chrome.exe
5832	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	svchost.exe
Token: SeDebugPrivilege	4992	svchost.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeDebugPrivilege	4992	svchost.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe
Token: SeCreatePagefilePrivilege	5832	chrome.exe
Token: SeShutdownPrivilege	5832	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5832	chrome.exe
3288	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1840	svchost.exe
4992	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 4992	3008	update1.exe	89
PID 4992 wrote to memory of 5832	4992	svchost.exe	92
PID 5832 wrote to memory of 4348	5832	chrome.exe	93
PID 5832 wrote to memory of 2748	5832	chrome.exe	94
PID 5832 wrote to memory of 2748	5832	chrome.exe	94
PID 5832 wrote to memory of 4264	5832	chrome.exe	95
PID 5832 wrote to memory of 2040	5832	chrome.exe	96
PID 5832 wrote to memory of 2040	5832	chrome.exe	96
PID 5832 wrote to memory of 208	5832	chrome.exe	98
PID 5832 wrote to memory of 208	5832	chrome.exe	98
PID 5832 wrote to memory of 244	5832	chrome.exe	99
PID 5832 wrote to memory of 244	5832	chrome.exe	99
PID 5832 wrote to memory of 1968	5832	chrome.exe	100
PID 5832 wrote to memory of 1968	5832	chrome.exe	100
PID 5832 wrote to memory of 6096	5832	chrome.exe	101
PID 5832 wrote to memory of 6096	5832	chrome.exe	101
PID 5832 wrote to memory of 4892	5832	chrome.exe	102
PID 5832 wrote to memory of 5520	5832	chrome.exe	103
PID 5832 wrote to memory of 5520	5832	chrome.exe	103
PID 5832 wrote to memory of 5464	5832	chrome.exe	104
PID 5832 wrote to memory of 5464	5832	chrome.exe	104
PID 5832 wrote to memory of 4708	5832	chrome.exe	108
PID 5832 wrote to memory of 4708	5832	chrome.exe	108
PID 5832 wrote to memory of 2396	5832	chrome.exe	109
PID 5832 wrote to memory of 2396	5832	chrome.exe	109
PID 5832 wrote to memory of 484	5832	chrome.exe	110
PID 5832 wrote to memory of 484	5832	chrome.exe	110
PID 5832 wrote to memory of 5912	5832	chrome.exe	111
PID 5832 wrote to memory of 5912	5832	chrome.exe	111
PID 5832 wrote to memory of 3692	5832	chrome.exe	112
PID 5832 wrote to memory of 3692	5832	chrome.exe	112
PID 5832 wrote to memory of 4764	5832	chrome.exe	113
PID 5832 wrote to memory of 4764	5832	chrome.exe	113
PID 4992 wrote to memory of 3288	4992	svchost.exe	114
PID 3288 wrote to memory of 5828	3288	msedge.exe	115
PID 3288 wrote to memory of 2876	3288	msedge.exe	117
PID 3288 wrote to memory of 4412	3288	msedge.exe	118
PID 3288 wrote to memory of 4412	3288	msedge.exe	118
PID 3288 wrote to memory of 5296	3288	msedge.exe	119
PID 3288 wrote to memory of 5296	3288	msedge.exe	119
PID 3288 wrote to memory of 5296	3288	msedge.exe	119
PID 3288 wrote to memory of 6084	3288	msedge.exe	120
PID 3288 wrote to memory of 6084	3288	msedge.exe	120
PID 3288 wrote to memory of 6084	3288	msedge.exe	120
PID 3288 wrote to memory of 5720	3288	msedge.exe	121
PID 3288 wrote to memory of 5720	3288	msedge.exe	121
PID 3288 wrote to memory of 5720	3288	msedge.exe	121
PID 3288 wrote to memory of 4284	3288	msedge.exe	122
PID 3288 wrote to memory of 1276	3288	msedge.exe	123
PID 3288 wrote to memory of 4284	3288	msedge.exe	122
PID 3288 wrote to memory of 4284	3288	msedge.exe	122
PID 3288 wrote to memory of 1276	3288	msedge.exe	123
PID 3288 wrote to memory of 1276	3288	msedge.exe	123
PID 3288 wrote to memory of 796	3288	msedge.exe	125
PID 3288 wrote to memory of 796	3288	msedge.exe	125
PID 5832 wrote to memory of 5884	5832	chrome.exe	127
PID 5832 wrote to memory of 4520	5832	chrome.exe	128
PID 5832 wrote to memory of 1076	5832	chrome.exe	129
PID 5832 wrote to memory of 2112	5832	chrome.exe	130
PID 5832 wrote to memory of 2112	5832	chrome.exe	130
PID 5832 wrote to memory of 2288	5832	chrome.exe	131
PID 5832 wrote to memory of 2288	5832	chrome.exe	131
PID 5832 wrote to memory of 4852	5832	chrome.exe	132
PID 5832 wrote to memory of 4852	5832	chrome.exe	132

C:\Users\Admin\AppData\Local\Temp\update1.exe
"C:\Users\Admin\AppData\Local\Temp\update1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Roaming\jan8zT\svchost.exe
  "C:\Users\Admin\AppData\Roaming\jan8zT\svchost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5832
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0xa4,0x138,0x7ffab529c728,0x7ffab529c734,0x7ffab529c740
      4⤵
      PID:4348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
      4⤵
      PID:2748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:11
      4⤵
      System Time Discovery
      PID:4264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
      4⤵
      PID:2040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
      4⤵
      PID:6096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:4892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:4520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
      4⤵
      PID:1076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
      4⤵
      PID:2112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
      4⤵
      PID:2288
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
      4⤵
      PID:4852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=1812,i,6881282640316093931,15379319994648670441,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ffaafb5c188,0x7ffaafb5c194,0x7ffaafb5c1a0
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2656,i,6248225088956661703,2891606338433734057,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:11
      4⤵
      System Time Discovery
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2656,i,6248225088956661703,2891606338433734057,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:13
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2656,i,6248225088956661703,2891606338433734057,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:2
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2656,i,6248225088956661703,2891606338433734057,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2656,i,6248225088956661703,2891606338433734057,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2656,i,6248225088956661703,2891606338433734057,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2656,i,6248225088956661703,2891606338433734057,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2656,i,6248225088956661703,2891606338433734057,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:796

C:\Users\Admin\AppData\Roaming\jan8zT\svchost.exe
C:\Users\Admin\AppData\Roaming\jan8zT\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8812d9cd6fce61eb61ed07f66a5efc9d4f92b07b0c4b9a4384ecfbc6bae254ca
MD5 000167747e468b600a3c9941e39743c5
SHA1 098aacd354451b7cd79c2dd8f33ba9c27b21638b
SHA512 730fbcd6d36a241ec9d30aabf5d23ca694e389c6f8fa56994fc3fa294d2c71749d943946c18172b7a08a382627b97ee8da148b83842a9f0414cd17b9a84de9af
TLSH
T14B417BF7C7D8993D891556F4E7157E1BCE290E18432D3D26C8D4AE1F97E2872D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9f8ffb7bf05685551bb4b7302a6961c0caf7754c5c8d5957fcc744a29cf81188
MD5 f184fcb04e30602ee7b20bcbb588bf8d
SHA1 1340efbe163425d5d2c617009e1c20b50d462885
SHA512 8624f7dac275e69a1821cc43ad872429e1be602505f230a01c05740a181f3e7aeefa30e9f972a9b3731fefd3b10790717f327fc55b38f8bf25932a9427026f89
SSDEEP 192:cRz2aIFv7pAPRp2o9XxHsb+WNnF60Cf2H4kwqVyIsnAUge:cRz2J1AXjfwo0Y2YKe
TLSH
T16832853EFE14693B6DCAC22DFA65B753D7F6102161942E84E6FC8A2C15DB5CC622700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 bb3a4b13bc94cc65fbef96e2af0f8e88d9fd535f4db4e283a0e1ea2a082d1be6
MD5 4238455865b03d13547ecaff2fc3f43d
SHA1 bb36b902484fe8805c0473a98d4f5d8e371c7037
SHA512 8ef12551246033c758920df56223a22825088c52a6108fb72171524e43601886dfee71df90a6e69930a8481456572775bcfa2e3dd93e52f042db5064f4b66d00
SSDEEP 192:cRz2aIFv7puPRppo9XxHsb+WNnF60Tf2H4kwyVyIsnAUgE:cRz2J1GX+fwo0b2YSE
TLSH
T1B542953EFD14693B6DCAD22DFA65BB53D7F5102161A02E84E6FC8A2C11EB5CC621700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f5ab6412d6d0aaacbc979f7cca7c4920b59a69b2fcc931fe09e072f77ca9f1b0
MD5 0927624f02800352506bc2d2dca3ac94
SHA1 76f090bb67ce5215b9165853e97ed0c88ac3d475
SHA512 e242e4d066df23fe3c03ff49698cb30a25aefd7a46242f038deea678dbfa257cd6eb5f4440fd35cc894a6029025023210fe003fceae57037cdc97f73adca23cb
TLSH
T107A0027051E47512CD19D77474E3298B7252C8385952430765A764449A9B1C14261505
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1399.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a1399.TMP
Size 48B
SHA256 c3adeb07b30b06a5d2ec51ec1631163c1852e0faaf57f199019fcc5c991b3385
MD5 90cf636d6f10509187294db16935de8a
SHA1 d5039b779352963559f87750896364f5ce9e0e26
SHA512 cea9f9536d8e5b50245a612d68e2bcda08b0361539f79fe51a285d31f6a529767285b0dd15ac5a23dc8c5d9b6c9e897d941b8d968a234589c64789486727ed09
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 a6901047d0c87a45ca7fe22b68da1f864001057f3d9d32f366ef35680998f37b
MD5 73708568754b51b28821460f2b731e5b
SHA1 c5c08ba27001165601e4461c95131f5c812e4344
SHA512 0efb995700ea891e341aec0e06f74851fa5cb159f52ed2df86590584909744bb87c411ef29c886883c9948ef5249b897558adc5dc7e6150daf589b459ffaaefb
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Oa16hVumSVn+a:1nbZeMrv/hGta16sn+a
TLSH
T140D3984B3A747102EDE59A722CE0517F5E3CB16D8F1595D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 1bf62c723ff88e1942d975a476bfbc865c90688eeb6ae54c8dd516643d367e68
MD5 5fdf517bc936bb638e30d0459e2f35b6
SHA1 fa9b22ee7332ae6a3999bb7d8554af2586a4de77
SHA512 92930c2c7a7e9a9e18250fdf5cc87e38c95fcab8c8d670f4901c8e913bf8cb40273ce23ea160362a9e1013159cc6ae84b03fca8b1d338a6b456e10e64d06b78e
SSDEEP 3072:+3cY1ZR7XTEmLmDbMpemMjTKO1TboksEO:+MqsIp3MjuO1Pokm
TLSH
T1E5C312A2B75CAE6AACFF5312610F3F245C60FA15AA03D9F4F35C8E0695B35905329D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a0f11fba97d5560f7b66485dfb17b526cc601c17c2164fbbad592bc08d4a999b
MD5 18842e600133bf4aa8562171f0ac012c
SHA1 97f221220dc7b2cc518b23bd224d4ee24eb56cdf
SHA512 908207747b7e619df202fb5d953c014abd9dfd2649f2fab263fed0c5672915c7d57fda73b083533f8128e7867d6303ca6e1b36df68fa59c946092e7b36237dc5
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5RmDOB6nGyvn0b4T8nybJv4a:xC0ITo+TQ0InDUD6uPPb4T8nybl
TLSH
T158A10936E0284D774476D44AF1626A43CEB9B067E9B2AF90EADD0F0D14F70EC1341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 cd241bf9a138804868f8da7dedb8839f7a937dec37c1d0c63eb34c6430ede31e
MD5 6d69d2be1c8a38d3ad736f19ac15f033
SHA1 b0454c8c95d7c8e993bd6dac803f7c99898f4f6e
SHA512 3566c0c82631e5bbd54f96eec67bc79a6dccc02afecc3bdbfc37a11219f88e5bce2c967028442b3499686233feebfd4487866b58a0a3b0898f3e6b89c8134fda
SSDEEP 3072:b3cY1ZR7XTEmLmDbMpemMjTKO1TboksEO:bMqsIp3MjuO1Pokm
TLSH
T1DFC312A2B75CAE6AECFF5312610B3F245C60FA15AA03D9F4F35C8E0A94B35905329D03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 a5b98de72bfebef8f7b2bc79bf21848c49266a4fa0acb5e8a29f0f284dae7d55
MD5 61685c534e22224c111415d68b1dfdd0
SHA1 8b0b58b1e01f977a5e08bf7af588d18477bd6386
SHA512 c44425138b9afe4fca0cea686ccd7415acf016b2242b113275892c2ea699b8303aaf40e651c366d803f7f45a24b4e4137a81a604478f18e100af8b03406b406f
SSDEEP 3072:gKcY1ZR7XTEmLmDbMpemMjTKO1TboksEO:gPqsIp3MjuO1Pokm
TLSH
T1F7C302B2F759AEA6ACFF4312710B2F245CB0FA57A903D9E4E31C4E05A1B3594972DD02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\66a9f588-b79e-4619-9376-970054fbc4ba\index-dir\the-real-index
Size 528B
SHA256 3ac027092ea7c8d5c5268bc1ed5e4373e44e6fc920e470b0946315be6d1c87c2
MD5 b10cbc7c7d94ef15d1b8457ceab0cef1
SHA1 82e48376f9aac96752da170211d1051b38bbdc9d
SHA512 c0d591d4f16e974f302d5f945e94fe66bb4bc68e342b18b352106872717c979f3be7a692c72a41ed4304643657aa4d234ae7b36dc354abb9220297c53c482d97
TLSH
T1E0F0F1DBCCA6B443D923F4BB16765559333A00FD6211AD87105C302EA92263C8351349
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59796c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\66a9f588-b79e-4619-9376-970054fbc4ba\index-dir\the-real-index~RFe59796c.TMP
Size 528B
SHA256 cdd357a1860dc1ef94005c28db1f221e278c5e217744e9ee74883b47262e5f88
MD5 2e4ba45a5078d8cb40cb29c762fc5726
SHA1 95d3de140bd7e35d79c3d597f8b8f53d840090da
SHA512 de31e0db678c2e50a109e06a812e64b61325f9d804ebd94758d3865693127764e2c5763f712f2a6438bffe021206d1dde38e0ed81726d93f9b9dd75efdaf6771
TLSH
T132F0CAE74091FC51D916F5F555455016733F0C303135D55FA09B341E593177C8641B45
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ecddf8a17466f3afac5a646be07309e8cc098e1e34cc44ca2ac60f338cf68830
MD5 2f3a6ea55bcdbdc4dcf1f94b2bcfdbc2
SHA1 63f4c34c18617a8aeb3d1c891d04e0cbf8921c12
SHA512 dab4485c8723b8b8bd9a4cc507c6f125089d99616593e92a9e38661a9b1b92432d67dd1347f5381c59918520772878b1969201630652de34bf15f995e83b4ca4
SSDEEP 768:hrv+4UNbdz3EP/TBOWdYNtI6ONXyer1IRCzniB3eVH1SK7:hbsbV30nV6SIqnEEH1l
TLSH
T16C03BF36E4A89E338DE2A3D6B14772037FB86057C6840790EDEE1F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5832_1707377825\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\jan8zT\svchost.exe
Size 2.6MB
SHA256 748a02784c8a04459884778a66b2dbb5156b01b324c7b73f06c8058596d1a030
MD5 bdc7dc0d39258a4055a24db6eaabb54d
SHA1 2a48ac416efc98324f25301a32a03a5786b738f9
SHA512 7090879e2d5527e40425dce2e416a4593b8329fcb431038fd951d3be99dd4bc8c219f8bc200d56056dca1eb965a4c74820a1eba3fb3f755ed7bc371dedc45eee
SSDEEP 49152:j5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUL9KTnUVz:wTrVI4dGOgGpYHCO
TLSH
T15CD59D62F782D0B2E4D201B152BEABF74D787535537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download