destiny_stealer | 0e7aa42d81a35200a205b426dd88c0c487b785851a081bedd9978ced12fb09de

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
imgs.exe
Size 8.4MB
Sample260802-pppqvashnf
SHA256 0e7aa42d81a35200a205b426dd88c0c487b785851a081bedd9978ced12fb09de
MD5 ab3ecc662732ece57ff6d35440061c1a
SHA1 7f5e5e80a28d925bda4ebc6747959e261d287fd3
SHA512 b2c27b67fa39ca9f97b16452ca4f9cdb51b0cd68f59c26409a42a898992b8367050d6aad103a35d72e005294e1b7196431f25b40bd3436832babc9befeb02f0b
SSDEEP 196608:1hpJ6ghaKesWITQKhWlJm97IeswHgkOBI9c83L:1fIFX8TOvIswBAI913L
TLSH
T183963351B154EF62C38D527FC6CF942083E89D473573EB96AE8933268B423BB5C51AC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution destiny_stealer persistence stealer

Malware Config

Extracted

Family

destiny_stealer

86.54.42.197

Attributes

port
8888

Signatures

Family: Destiny Stealer
DestinyStealer is a stealer written in C#.
stealer destiny_stealer

Detected Nirsoft tools 18 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4216-55-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4216-56-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/6124-59-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral2/memory/6124-58-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral2/memory/5604-66-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/5604-67-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/4520-72-0x0000000000400000-0x0000000000445000-memory.dmp	Nirsoft
behavioral2/memory/4520-73-0x0000000000400000-0x0000000000445000-memory.dmp	Nirsoft
behavioral2/memory/1652-76-0x0000000000400000-0x00000000004A5000-memory.dmp	Nirsoft
behavioral2/memory/1652-77-0x0000000000400000-0x00000000004A5000-memory.dmp	Nirsoft
behavioral2/memory/4880-86-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/4880-87-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/1712-94-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral2/memory/1712-95-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral2/memory/2576-98-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral2/memory/2576-99-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral2/memory/5872-106-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft
behavioral2/memory/5872-107-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft

NirSoft EdgeCookiesView 2 IoCs

Password recovery tool for Microsoft Edge browser

resource	yara_rule
behavioral2/memory/4216-55-0x0000000000400000-0x000000000041C000-memory.dmp	EdgeCookiesView
behavioral2/memory/4216-56-0x0000000000400000-0x000000000041C000-memory.dmp	EdgeCookiesView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/5872-106-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView
behavioral2/memory/5872-107-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView

Uses browser remote debugging 2 TTPs 30 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5880	chrome.exe
1180	chrome.exe
2136	chrome.exe
2148	msedge.exe
5728	chrome.exe
4796	chrome.exe
3068	chrome.exe
2648	chrome.exe
2316	chrome.exe
4312	chrome.exe
5432	chrome.exe
1088	msedge.exe
3064	chrome.exe
4796	chrome.exe
6500	msedge.exe
3856	msedge.exe
5388	msedge.exe
7024	msedge.exe
7164	msedge.exe
6992	msedge.exe
5976	chrome.exe
4652	chrome.exe
5408	chrome.exe
2552	msedge.exe
4576	chrome.exe
3876	chrome.exe
3132	chrome.exe
3876	chrome.exe
3840	msedge.exe
2892	chrome.exe

Executes dropped EXE 5 IoCs

pid	Process
1688	WindowsDataC.exe
5780	WindowsDataC.exe
4752	ahC2p0sVNkxGSe7a.exe
352	RunIt.exe
2852	Rnts.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDataC.exe = "C:\\ProgramData\\WindowsDataC.exe"	imgs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rnts.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Rnts.exe"	RunIt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rnts.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Rnts.exe"	Rnts.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 4752 set thread context of 4216	4752	ahC2p0sVNkxGSe7a.exe	98
PID 4752 set thread context of 6124	4752	ahC2p0sVNkxGSe7a.exe	102
PID 4752 set thread context of 2000	4752	ahC2p0sVNkxGSe7a.exe	103
PID 4752 set thread context of 5604	4752	ahC2p0sVNkxGSe7a.exe	104
PID 4752 set thread context of 4520	4752	ahC2p0sVNkxGSe7a.exe	106
PID 4752 set thread context of 1652	4752	ahC2p0sVNkxGSe7a.exe	107
PID 4752 set thread context of 812	4752	ahC2p0sVNkxGSe7a.exe	108
PID 4752 set thread context of 4880	4752	ahC2p0sVNkxGSe7a.exe	109
PID 4752 set thread context of 2280	4752	ahC2p0sVNkxGSe7a.exe	110
PID 4752 set thread context of 1712	4752	ahC2p0sVNkxGSe7a.exe	111
PID 4752 set thread context of 2576	4752	ahC2p0sVNkxGSe7a.exe	113
PID 4752 set thread context of 4484	4752	ahC2p0sVNkxGSe7a.exe	114
PID 4752 set thread context of 5872	4752	ahC2p0sVNkxGSe7a.exe	116

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2148_1306286551\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1978562710\_locales\sq\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
764	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4140	4216	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rnts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RunIt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ahC2p0sVNkxGSe7a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3256	chrome.exe
5312	msedge.exe
6872	msedge.exe
3360	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	ahC2p0sVNkxGSe7a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ahC2p0sVNkxGSe7a.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301474964331987"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{67553F6E-09C7-4AAB-8876-346DD840E24E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4752	ahC2p0sVNkxGSe7a.exe
4752	ahC2p0sVNkxGSe7a.exe
4216	grpconv.exe
4216	grpconv.exe
1652	grpconv.exe
1652	grpconv.exe
1652	grpconv.exe
1652	grpconv.exe
1652	grpconv.exe
1652	grpconv.exe
1652	grpconv.exe
1652	grpconv.exe
4880	grpconv.exe
4880	grpconv.exe
4752	ahC2p0sVNkxGSe7a.exe
4752	ahC2p0sVNkxGSe7a.exe
4752	ahC2p0sVNkxGSe7a.exe
4752	ahC2p0sVNkxGSe7a.exe
5872	grpconv.exe
5872	grpconv.exe
5872	grpconv.exe
5872	grpconv.exe
4752	ahC2p0sVNkxGSe7a.exe
4752	ahC2p0sVNkxGSe7a.exe
764	powershell.exe
764	powershell.exe
764	powershell.exe
764	powershell.exe
764	powershell.exe
764	powershell.exe
764	powershell.exe
5976	chrome.exe
5976	chrome.exe
764	powershell.exe
764	powershell.exe
764	powershell.exe
3132	chrome.exe
3132	chrome.exe
764	powershell.exe
764	powershell.exe
764	powershell.exe
764	powershell.exe
764	powershell.exe
764	powershell.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	4752	ahC2p0sVNkxGSe7a.exe
Token: SeDebugPrivilege	4880	grpconv.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	5976	chrome.exe
Token: SeCreatePagefilePrivilege	5976	chrome.exe
Token: SeShutdownPrivilege	3132	chrome.exe
Token: SeCreatePagefilePrivilege	3132	chrome.exe
Token: SeShutdownPrivilege	3132	chrome.exe
Token: SeCreatePagefilePrivilege	3132	chrome.exe
Token: SeShutdownPrivilege	3132	chrome.exe
Token: SeCreatePagefilePrivilege	3132	chrome.exe
Token: SeShutdownPrivilege	3132	chrome.exe
Token: SeCreatePagefilePrivilege	3132	chrome.exe
Token: SeShutdownPrivilege	3132	chrome.exe
Token: SeCreatePagefilePrivilege	3132	chrome.exe
Token: SeShutdownPrivilege	3132	chrome.exe
Token: SeCreatePagefilePrivilege	3132	chrome.exe
Token: SeShutdownPrivilege	3132	chrome.exe
Token: SeCreatePagefilePrivilege	3132	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5976	chrome.exe
3132	chrome.exe
2148	msedge.exe
6500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 1688	2748	imgs.exe	90
PID 2748 wrote to memory of 4752	2748	imgs.exe	92
PID 2748 wrote to memory of 352	2748	imgs.exe	93
PID 4752 wrote to memory of 1952	4752	ahC2p0sVNkxGSe7a.exe	97
PID 4752 wrote to memory of 4216	4752	ahC2p0sVNkxGSe7a.exe	98
PID 4752 wrote to memory of 4216	4752	ahC2p0sVNkxGSe7a.exe	98
PID 4752 wrote to memory of 4216	4752	ahC2p0sVNkxGSe7a.exe	98
PID 4752 wrote to memory of 4216	4752	ahC2p0sVNkxGSe7a.exe	98
PID 4752 wrote to memory of 4216	4752	ahC2p0sVNkxGSe7a.exe	98
PID 4752 wrote to memory of 4216	4752	ahC2p0sVNkxGSe7a.exe	98
PID 4752 wrote to memory of 6124	4752	ahC2p0sVNkxGSe7a.exe	102
PID 4752 wrote to memory of 6124	4752	ahC2p0sVNkxGSe7a.exe	102
PID 4752 wrote to memory of 6124	4752	ahC2p0sVNkxGSe7a.exe	102
PID 4752 wrote to memory of 6124	4752	ahC2p0sVNkxGSe7a.exe	102
PID 4752 wrote to memory of 6124	4752	ahC2p0sVNkxGSe7a.exe	102
PID 4752 wrote to memory of 6124	4752	ahC2p0sVNkxGSe7a.exe	102
PID 4752 wrote to memory of 2000	4752	ahC2p0sVNkxGSe7a.exe	103
PID 4752 wrote to memory of 2000	4752	ahC2p0sVNkxGSe7a.exe	103
PID 4752 wrote to memory of 2000	4752	ahC2p0sVNkxGSe7a.exe	103
PID 4752 wrote to memory of 2000	4752	ahC2p0sVNkxGSe7a.exe	103
PID 4752 wrote to memory of 2000	4752	ahC2p0sVNkxGSe7a.exe	103
PID 4752 wrote to memory of 2000	4752	ahC2p0sVNkxGSe7a.exe	103
PID 4752 wrote to memory of 5604	4752	ahC2p0sVNkxGSe7a.exe	104
PID 4752 wrote to memory of 5604	4752	ahC2p0sVNkxGSe7a.exe	104
PID 4752 wrote to memory of 5604	4752	ahC2p0sVNkxGSe7a.exe	104
PID 4752 wrote to memory of 5604	4752	ahC2p0sVNkxGSe7a.exe	104
PID 4752 wrote to memory of 5604	4752	ahC2p0sVNkxGSe7a.exe	104
PID 4752 wrote to memory of 5604	4752	ahC2p0sVNkxGSe7a.exe	104
PID 4752 wrote to memory of 4520	4752	ahC2p0sVNkxGSe7a.exe	106
PID 4752 wrote to memory of 4520	4752	ahC2p0sVNkxGSe7a.exe	106
PID 4752 wrote to memory of 4520	4752	ahC2p0sVNkxGSe7a.exe	106
PID 4752 wrote to memory of 4520	4752	ahC2p0sVNkxGSe7a.exe	106
PID 4752 wrote to memory of 4520	4752	ahC2p0sVNkxGSe7a.exe	106
PID 4752 wrote to memory of 4520	4752	ahC2p0sVNkxGSe7a.exe	106
PID 4752 wrote to memory of 1652	4752	ahC2p0sVNkxGSe7a.exe	107
PID 4752 wrote to memory of 1652	4752	ahC2p0sVNkxGSe7a.exe	107
PID 4752 wrote to memory of 1652	4752	ahC2p0sVNkxGSe7a.exe	107
PID 4752 wrote to memory of 1652	4752	ahC2p0sVNkxGSe7a.exe	107
PID 4752 wrote to memory of 1652	4752	ahC2p0sVNkxGSe7a.exe	107
PID 4752 wrote to memory of 1652	4752	ahC2p0sVNkxGSe7a.exe	107
PID 4752 wrote to memory of 812	4752	ahC2p0sVNkxGSe7a.exe	108
PID 4752 wrote to memory of 812	4752	ahC2p0sVNkxGSe7a.exe	108
PID 4752 wrote to memory of 812	4752	ahC2p0sVNkxGSe7a.exe	108
PID 4752 wrote to memory of 812	4752	ahC2p0sVNkxGSe7a.exe	108
PID 4752 wrote to memory of 812	4752	ahC2p0sVNkxGSe7a.exe	108
PID 4752 wrote to memory of 812	4752	ahC2p0sVNkxGSe7a.exe	108
PID 4752 wrote to memory of 4880	4752	ahC2p0sVNkxGSe7a.exe	109
PID 4752 wrote to memory of 4880	4752	ahC2p0sVNkxGSe7a.exe	109
PID 4752 wrote to memory of 4880	4752	ahC2p0sVNkxGSe7a.exe	109
PID 4752 wrote to memory of 4880	4752	ahC2p0sVNkxGSe7a.exe	109
PID 4752 wrote to memory of 4880	4752	ahC2p0sVNkxGSe7a.exe	109
PID 4752 wrote to memory of 4880	4752	ahC2p0sVNkxGSe7a.exe	109
PID 4752 wrote to memory of 2280	4752	ahC2p0sVNkxGSe7a.exe	110
PID 4752 wrote to memory of 2280	4752	ahC2p0sVNkxGSe7a.exe	110
PID 4752 wrote to memory of 2280	4752	ahC2p0sVNkxGSe7a.exe	110
PID 4752 wrote to memory of 2280	4752	ahC2p0sVNkxGSe7a.exe	110
PID 4752 wrote to memory of 2280	4752	ahC2p0sVNkxGSe7a.exe	110
PID 4752 wrote to memory of 2280	4752	ahC2p0sVNkxGSe7a.exe	110
PID 4752 wrote to memory of 1712	4752	ahC2p0sVNkxGSe7a.exe	111
PID 4752 wrote to memory of 1712	4752	ahC2p0sVNkxGSe7a.exe	111
PID 4752 wrote to memory of 1712	4752	ahC2p0sVNkxGSe7a.exe	111
PID 4752 wrote to memory of 1712	4752	ahC2p0sVNkxGSe7a.exe	111
PID 4752 wrote to memory of 1712	4752	ahC2p0sVNkxGSe7a.exe	111
PID 4752 wrote to memory of 1712	4752	ahC2p0sVNkxGSe7a.exe	111

C:\Users\Admin\AppData\Local\Temp\imgs.exe
"C:\Users\Admin\AppData\Local\Temp\imgs.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2748
- C:\ProgramData\WindowsDataC.exe
  "C:\ProgramData\WindowsDataC.exe"
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe
  "C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20260802133041.txt"
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20260802133041.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4216
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 580
      4⤵
      Program crash
      PID:4140
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\FirefoxCookies-output_20260802133041.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6124
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260802133041.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2000
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /shtml "C:\Users\Admin\AppData\Roaming\watch-output_20260802133041.html"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5604
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ChromeV20-output_20260802133041.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\BrowserHistory-output_20260802133041.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1652
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\DefenderLogs-output_20260802133041.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:812
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20260802133041.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260802133041.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2280
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ProductKeys-output_20260802133041.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1712
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260802133041.txt"
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260802133041.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2576
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Autofill-output_20260802133041.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4484
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20260802133041.txt"
    3⤵
    PID:4420
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20260802133041.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5872
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CookieExtractor_462208e0\cookieextract.ps1" -Browser Both -OutputDir "C:\Users\Admin\AppData\Roaming"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:5976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc1763c728,0x7ffc1763c734,0x7ffc1763c740
        5⤵
        
        PID:5912
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
        5⤵
        
        PID:5400
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3360
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:13
        5⤵
        
        PID:4816
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2316
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2648
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3064
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:14
        5⤵
        
        PID:824
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
        5⤵
        
        PID:5044
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4576
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3876
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4312
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
        5⤵
        
        PID:252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5728
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
        5⤵
        
        PID:4256
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
        5⤵
        
        PID:844
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4652
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1944,i,12534690351902386552,13865870774941023561,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:5880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:3132
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ffc1763c728,0x7ffc1763c734,0x7ffc1763c740
        5⤵
        
        PID:3416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1928,i,2114770652928448966,887985160820349513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
        5⤵
        
        PID:3024
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1928,i,2114770652928448966,887985160820349513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3256
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1928,i,2114770652928448966,887985160820349513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:13
        5⤵
        
        PID:4576
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1928,i,2114770652928448966,887985160820349513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1180
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1928,i,2114770652928448966,887985160820349513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5408
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1928,i,2114770652928448966,887985160820349513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3876
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1928,i,2114770652928448966,887985160820349513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14
        5⤵
        
        PID:2120
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1928,i,2114770652928448966,887985160820349513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
        5⤵
        
        PID:5892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1928,i,2114770652928448966,887985160820349513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
        5⤵
        
        PID:124
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1928,i,2114770652928448966,887985160820349513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
        5⤵
        
        PID:1032
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1928,i,2114770652928448966,887985160820349513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
        5⤵
        
        PID:5300
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1928,i,2114770652928448966,887985160820349513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5432
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1928,i,2114770652928448966,887985160820349513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:2148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x278,0x27c,0x280,0x274,0x288,0x7ffc1761c188,0x7ffc1761c194,0x7ffc1761c1a0
        5⤵
        
        PID:5844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
        5⤵
        
        PID:3964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
        5⤵
        
        PID:2648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:3840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:14
        5⤵
        
        PID:2932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
        5⤵
        
        PID:2484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
        5⤵
        
        PID:3576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
        5⤵
        
        PID:3268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
        5⤵
        
        PID:4492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
        5⤵
        
        PID:5464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
        5⤵
        
        PID:7012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
        5⤵
        
        PID:5624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2356,i,18372569784201657601,3539643333258318148,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
        5⤵
        
        PID:6240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      PID:6500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x278,0x27c,0x280,0x274,0x340,0x7ffc1761c188,0x7ffc1761c194,0x7ffc1761c1a0
        5⤵
        
        PID:6548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2232,i,3383579968477309207,16958136970392618037,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
        5⤵
        
        PID:6772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2232,i,3383579968477309207,16958136970392618037,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2232,i,3383579968477309207,16958136970392618037,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
        5⤵
        
        PID:6892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2232,i,3383579968477309207,16958136970392618037,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2232,i,3383579968477309207,16958136970392618037,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:7024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2232,i,3383579968477309207,16958136970392618037,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2232,i,3383579968477309207,16958136970392618037,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:7164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2232,i,3383579968477309207,16958136970392618037,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
        5⤵
        
        PID:6344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2232,i,3383579968477309207,16958136970392618037,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
        5⤵
        
        PID:6032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2232,i,3383579968477309207,16958136970392618037,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
        5⤵
        
        PID:5652
- C:\Users\Admin\AppData\Local\Temp\RunIt.exe
  "C:\Users\Admin\AppData\Local\Temp\RunIt.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:352

C:\ProgramData\WindowsDataC.exe
C:\ProgramData\WindowsDataC.exe
1⤵
- Executes dropped EXE
PID:5780

C:\Users\Admin\AppData\Local\Temp\Rnts.exe
C:\Users\Admin\AppData\Local\Temp\Rnts.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4216 -ip 4216
1⤵
PID:4584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsDataC.exe

Path C:\ProgramData\WindowsDataC.exe
Size 8.4MB
SHA256 0e7aa42d81a35200a205b426dd88c0c487b785851a081bedd9978ced12fb09de
MD5 ab3ecc662732ece57ff6d35440061c1a
SHA1 7f5e5e80a28d925bda4ebc6747959e261d287fd3
SHA512 b2c27b67fa39ca9f97b16452ca4f9cdb51b0cd68f59c26409a42a898992b8367050d6aad103a35d72e005294e1b7196431f25b40bd3436832babc9befeb02f0b
SSDEEP 196608:1hpJ6ghaKesWITQKhWlJm97IeswHgkOBI9c83L:1fIFX8TOvIswBAI913L
TLSH
T183963351B154EF62C38D527FC6CF942083E89D473573EB96AE8933268B423BB5C51AC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 95cb62b42698e7f06379df40c942fe0fce2247fc09a055fbd4067a1415770e80
MD5 0aed033326e24dfd351e48d099e4af90
SHA1 e813b2ae43ac30d036c421e5f17ab707fbdd9f81
SHA512 fbb6f429690618fc3282cbe579539d91e3408878f2b220a977cdf48285600dfd42494ced9a6aecb4b17c0ab3df982d2fe7b4ccc0dc78b9523cf9eac0774198e8
MD5 SHA1 SHA512

Submit Download

3d25adb9-ad35-4529-929c-78d56a2df73c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3d25adb9-ad35-4529-929c-78d56a2df73c.tmp
Size 414B
SHA256 7c3d30d7081a758d7adadec3b078e41351ca0759958f01188b3cbbfd7ba9c1d3
MD5 4ae9b47acc04049f220e30c6667de69c
SHA1 aaf8438314cca8b69fffafc9c5cf325496f2bdf2
SHA512 5a19fc785423bb6991eaad470ab852d69f26901f2fd5061182108e30d2b254f142cd20349cfe6df3f8904d66051849bc345692f728de650806f51a260072c801
TLSH
T19CE02BE5CC21AC2B09FC2B1850444747EB40032B2A81855B7B3DD108CFB473A0686C1C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 81ba6ae9e1625e35699ddeb865f077308ed2d01af018ca02c462c0ea74b8f0e3
MD5 4c109ea48c64677eb3e6db3bab82bfad
SHA1 3165d11bb4d0077b69fe338c59d41d02da2e2d10
SHA512 b9227b07cad35386e1ba00afb1615465ce77964c7e3a238daa775ff2854ce38c4e3ba05a7422bc64b3b4b3d6f13106e5e0559eb88ff2b4e90919174c3a6c23f2
TLSH
T14FE026142488C9AD45579827A76DA30C8FD03409AAC8F84A4B058860A186604B9F0A60
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_metadata\computed_hashes.json
Size 10KB
SHA256 965203d541e442c107dbc6d5b395168123d0397559774beae4e5b9abc44ef268
MD5 90f880064a42b29ccff51fe5425bf1a3
SHA1 6a3cae3996e9fff653a1ddf731ced32b2be2acbf
SHA512 d9cbfcd865356f19a57954f8fd952caf3d31b354112766c41892d1ef40bd2533682d4ec3f4da0e59a5397364f67a484b45091ba94e6c69ed18ab681403dfd3f3
SSDEEP 192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
TLSH
T13B327DA05F9EF1DB9F9873F82F132C12A8564B518A95E9647F90DBC5B38D20F520243E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_metadata\verified_contents.json
Size 7KB
SHA256 52a24fa2fb3bcb18d9d8571ae385c4a830ff98ce4c18384d40a84ea7f6ba7f69
MD5 0834821960cb5c6e9d477aef649cb2e4
SHA1 7d25f027d7cee9e94e9cbdee1f9220c8d20a1588
SHA512 9aeafc3ece295678242d81d71804e370900a6d4c6a618c5a81cacd869b84346feac92189e01718a7bb5c8226e9be88b063d2ece7cb0c84f17bb1af3c5b1a3fc4
SSDEEP 192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
TLSH
T1EBF1A568CC5D758CFC56B77987AA36768B48C5C9E14D3E2E12C30CA178F6A4888B30DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\images\icon_128.png
Size 4KB
SHA256 149fc2270389655ee20da9cebb31ffde75e16e3ad371b9b907f62013ed45e705
MD5 7424a1046f7a440dc5e43b9a3c5d791e
SHA1 0672cf5b67820e81beb23010f62123e0b362e3ab
SHA512 2836cb5b4d682bc70e74c88af21e0ce972679eb07e88aa0b80db5990a68453e1c9580e530eede390c743d7377ea8ff3df7b78a7c5ddbde124d7782c63cf329bb
SSDEEP 96:jzliICMC5QmAjL7eTu3Ay1Hnn5IlQRU19x0tfo4CPmukC0:jzQzAjLiTK1H5IlQW1Xbm7
TLSH
T1AF916BA01EB4FABCD449F179A423BA2CD4049904D83583278E1DBF7626247A633C94AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\images\icon_16.png
Size 582B
SHA256 15b1cc630202324ad6b3b142a22cb1a55de8d6d9a0bcab78d5b14cd997a5ddd5
MD5 b323815b176657da3933a39e5658177e
SHA1 27e230c6d7b1774a9cfdebd6271e781619e797eb
SHA512 c049c8c8ad36fef941ef3917fee911d632923f41e8d2b3caea8938c87dda229c0d632f8f07aa3334fe79a31de87e75bb73d45d4811f9e81e0f261238bc41014b
TLSH
T105F0E1E29628FDD8C20AC13E4619AD21BDB258D85BA04B380553ECB13DA9AA9C065195
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\manifest.json
Size 1KB
SHA256 f52714812d68c577a445169d11e84df6751c2d6886bc429643072bb5d61c6c27
MD5 01334fb9d092af2aa46c4185e405c627
SHA1 47ad3c0e82362ffe5b881df8d71d6f79ab7f5796
SHA512 888d96adb7a847abe472145258c8c46950eb2fa3ba7d596c2e90a17c8fb06fd0155c56cc8aba5d076d89368417464bcb2d236f9e40e53241950a01f9f8ed548f
TLSH
T1F721CAE72455C0BB16B0DBD9B8A8620BF733130E8490C6CF793C404DCFBA8E2524A668
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 d3d3a1a4a02a05b9a9e23cface158e882f4ee96671c8af689096a41d9236c923
MD5 b4a1a591b724733d2077a2e2285847a2
SHA1 ad1ef2e6dceffadadcd3d6d8b945e09dd8f14e77
SHA512 86078422c0ca51e0a25f032a3156e85a4fdbcea5e5e856b05b23814ca759853c82d98b46ef691465145fd491bc7cb2f2c9bd16bc209da039caf2d344f56f9660
TLSH
T1A0E0260029D8C9BD9897A01733A6E30CC7E4781BEBCCFD4AAF02C68011CAC0871D1671
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 bc7e499e8e69742aacce8469e83baa362a0264d81057c4008aaaed1d49bb5ff0
MD5 b708466b7b0a405a14fdc2679359166a
SHA1 fb8e85442cfa41a4f29888b7a7455a974616ece1
SHA512 464b245bc7fb1d368a2e84f18bd46caac5a2a75ab1f661984ab586d6b791d39f23c7039a1444a9b71df6fcd98047f16a644f8762af31c9593bdb0e1acf187abc
TLSH
T178E0DF2026D9CE6F3087A09B722AF30CC7E1740BEADDD45A6F04B08062CE40C72C2AA0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Size 2KB
SHA256 a70423c48119f29be0127edf68dbffe2a325b9955a3462f5d6224af84ac397ab
MD5 903e512bbf5604c333ba41266a37f2b2
SHA1 03e0040d85a348e1e8e5c1d0c2369ff26a2cdb8e
SHA512 7b6bb3a5296220d5dba5703c14b057335669de57967ab8ea9ce4116c7522f1097f8c990bd1bb4926350f2ac4203b71c2606c45d8709d32ee76a561ee05a874d4
TLSH
T1FE51D1F37D015435FD6398FA11EA385CCE6B930E18A8D3E5D3C65D31204395AB41F2A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 23baffb05d13e46a4348e9b3c94dba652eb7f099296006c49e50870c17cfcb46
MD5 02615dc1d4d79ee700f20930976eb206
SHA1 e085611e1017e6d59226355cccc67f7031b37059
SHA512 a3bc8fd128eaf85c88612bdf81ac3fcaf2dd0c1bcf3df4ab2c0f1536bcfef5ab9d2b34372877f5ac0adb7787417de68b9c55a96fedcd51122375cba008e67fa6
TLSH
T1D4E026B066D8CE7D9483D0CB62B4F70D87F0780AAFC9F58E8F085050618F40472E9AA0
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
Size 1KB
SHA256 97bbe02ee0327548d5b3bf2b6f00b507ca4425425e04f95e072b3617b3e4e6bd
MD5 398cdbfaa7de9f8a3931365e364d27f4
SHA1 ed1a3d000aca1e13108f0c0dc68235e444126d5c
SHA512 998dc6d33b867dedf26dd9e773e37038c697407b5d0600e9fbff01a9d30e50c004b9ca00e5ff4f13a18bfe4cdd7669e23a28b8c547c8cfa2fff1fe323506f092
TLSH
T13F3107848DBA44924EC31A70239760AA3C18F91EE235D48A109ACF527B063099BDFE51
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
Size 2KB
SHA256 444572dc6fc2eb8f1a880711379a0ec4a80d041549fad959fb5678b4c0b08689
MD5 ae3b722b45c677f2b47afa1d9f0fc94f
SHA1 609c3dc27cb90e805157537c673e6b4e7a6c3d96
SHA512 7cd894c041a3c7530698931a93639ed7fd9131aaf1bfeaadc6d29867f5b0a49e101dd0b1572eb113a465d5adfc497f872617cc8c51270d08227f9981db71d19e
TLSH
T1F6516C2378FA9142C8345043D0EFADAD71FF52D3C74A451B31E64020ACAFAE121A139E
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png
Size 3KB
SHA256 bc6ae87a22ff2fe7feca2cb3f83aaebc8f02ad707cda77b51dab26bc9c5be710
MD5 ca441c15198089107955d8c8e5635b7d
SHA1 fc8403f74ead7b83017b9ef45c909576cacf2ddf
SHA512 2db07cb52541df66ebe059d1ada731315f87f0c46b553e72370c006ed313d8d754d8fd15ae317258fee0bc0bc13724219a5de9db8400e81193e4b4ffcfc01abe
TLSH
T158817B01730F99818D289BA9733E44F1526A3C04820775368035BAFA85D2DF618EFE03
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
MD5 520121a67f0bdc7a327bd49d50090dac
SHA1 648e3fbcbbffa431fd2480edf0a342b6920fb3b5
SHA512 36a89b73c4de9d9ef98becbbd31f286014163617063600ed22779e1e87ac35cbfb8341f9e4300994352570b1223719256c0d698dfa4aeb38e7d3907927a79a92
TLSH
T12D11E5B643275C67A2B3011708E03ABC8D605898F02B4A9C90148799360BBAAA4ED3DD
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 d391aac4c02071e055434b432f5fab0132d3bb74f6312f5d4a56f837a2735986
MD5 fa8cabc1f6a64e7c81f350c1c2924f8e
SHA1 fda1f50a62721b347f3838fedcecf6512b0d280d
SHA512 d5150561dea8cc3ae1741cbd1c1f0241527d826cf2c311b656fdb8f31ac8a09fba7d3449c3a69f5d77e2f73abeab26c8d542aed820a6aab050c5556a86212c1e
SSDEEP 3:ZQlll9HNllv/etXlFyvQl+/+qg/G9EZtaXM/RuWGJpDEJ7KgJpDEJ7HBQgKvspRI:ul/9SlsYzLWc/mLEJOgLEJL6iI
TLSH
T1ED02228CE0800008E435803DC7CFBA807A394E943F9A26D97AE000B83CDE0028234B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 ede4fec32d4520ef0ac7437a1760b5a827916c510e3ba68b3e7e7dbabf79dfc6
MD5 de906b6c98253f4d6682ca4eb89d6215
SHA1 69ac29b1efa53336d207bd9212296b8fc34445be
SHA512 5c60f5ba0a8a3c80e98cb345713becbb5aae5f8aba2eb83adc1634c62d40c1f83cf4f82a136cd2bc62db9ea84e793dc5945de100778da1bcdae8593890f9477c
TLSH
T15CE0260078E8CDEE6597900B31A9A30CCBC0390AEED8DC8E4F00C884E08A00476F0660
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 95747fdc4511dbf636c73e8801bf36b007d6f2a8e77d5a08791622a1f4085780
MD5 b061e8d11bb012c374eb05f6d7e0def1
SHA1 dbc4b10635766a8e49355300546a1ae0f7ed01f3
SHA512 59bf676d1ffaf6aded21d95b941f054b206aeb0bccce6af6acce832733ed9b78695dc6845b4c961be33112bc5baf006ff723e6d66079de688a04dfe757d1a100
TLSH
T164212855F730C209D249863A543EEB291734D462AFF8ED0F55F624786DB2A240D4B2D6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 689d718859cc24f7a52dd503a8a5dc0d8658d2afab4868b9ca315dbc640a0b93
MD5 311653d04b3cd4f0c4a7f333d00b4035
SHA1 89c1ee3417d873a3fc5d516c66b9a10e4b3f8e0e
SHA512 13f2c1a5f5e0eadbc3bc09f8218185cd8461071b24d8c3c6c4e026ac9d0839e43a7fc33253aee2903a2775d537b834731313732c9334ad7e3e82c5791e1206af
TLSH
T116E026007888CDEF419390172169E34C8BD0380AEED8EF4E4F04CC44E18A00476F9660
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e133d3f321506dc771a86021f75ee2802cae33671123e04b258860c0659352b7
MD5 a3fb57aa79a23737e5d17942c4c61051
SHA1 917d957a952cd7bc5a14b09cd3f9c26585dde7ec
SHA512 3173c3708403b3e191502ea0c77c3df8817e65c5d333efc88eb54bf52b9749b92d27cebbdd48cc5cd7e23a81ee6b41d5dd163cd2b8c40871b40b0e96d399e38a
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok51VDSB6JGyvTNm6zjO+PEhiv4a:mC0Nr7OJRPrL9/EtDUDDy9ImgjO+shM
TLSH
T112A10972647E5CB749B38549F5563B07CFA4B17B5A21EF4499DD2B0C10A70EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0aa22d79767ea9659c4d50fd382e1e7f6828f9be5949c4ffe8ec8e9a2b0ad5da
MD5 44164ce89eba2a4436312794392c9691
SHA1 818528afc6f119ac6a36a0e1b77ea64752b6e918
SHA512 4e9127e4b7e35c38059098c98936b1373b85f351dac39dd96d0d35331892557a55f9e9ab987af87ccff12bf0502ac54a6790c5bb7184bdeab44696a925060f81
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok51VDSB6JGyvTNm/zj/+PEhiW4a:mC0Nr7OJRPrL9/EtDUDDy9Im7j/+shT
TLSH
T19BA11972647E9CB74AB3854AF5563B07CFA4B17B5921EF44D9DD2B0C10A70EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
TLSH
T175A02407C473C00FFC144051C45C034134F4C047011DD4015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c2564e4d2170b86402b5bd56c2bb8504e7fab2b2f6d565bcdf645ec4e2ea0f41
MD5 e66050d34430f8e634d9deb7674739cf
SHA1 2cd84dea846506e13a2396a8b60f141d532071cf
SHA512 f934ab50ad1cabe8a333601337070286af9e21eb8de20ec03a54237c0ac5bb225fb24572e6495060831ac5bb2476112632f24abad71ae085a6406c699e41261f
TLSH
T126D012B4761A9601CA0A01714828A650222A852478DB576799A2740D9D6E801E39A2B6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 324f4611cebfae0a089c41d90923f4382fd2ed5649d06ccb55bd549a4935c7e7
MD5 7a8cc17485b829f2cc20919f5bd7d91d
SHA1 d5cdab40189c8aa88ae961c208c5d1a6428c0a25
SHA512 bcb87636999040fbd47aa6eec101cd606744b3eb42fee3487401e26dd4a312f5283c10e355117e899afda23335416daf4138335120eab885e22b5a4801cb2a39
TLSH
T1FCD080F4761A9505CF0E01714828A760321B853438DF5777D9E2740D9D7E801E39E2F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

0142f488-66f5-48c5-8408-f5fa0b2ec0ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0142f488-66f5-48c5-8408-f5fa0b2ec0ef.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6ca5e3fa-f64f-4046-8cbe-cc17c8f0bfe7\index-dir\the-real-index
Size 1KB
SHA256 ff0f332d878c1d6fa7226dacfd80b93712fb5df7b2cb31b4675059a1576534a1
MD5 94a7af756365f196ce2b67c0cf21ffa9
SHA1 53f396d6c3317c16a0902c210138a82c0bf7a389
SHA512 977a20ae3203766833044c84a53bac0b4103eeb5345c4489b2d5d6db1ef024c74b6940dae16ae1d969846166fbfc49609a9c70f94a1341cbe34d43e0cdf381a9
TLSH
T16611410FCC829D67CDA718B71DBA2508B37311ED0209EA6F600EB4381D9BA262B44603
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6ca5e3fa-f64f-4046-8cbe-cc17c8f0bfe7\index-dir\the-real-index
Size 360B
SHA256 1f05638316bd534f255099fe193332028f803160dd2da3a444362626cbb476e9
MD5 e982ae8c1233bfccfefca31ef7c0c553
SHA1 bd43884377e74c62f923ee59d18ef74d23303a48
SHA512 cf3d62fc8ff8bd3907939182039128f3bd5ba62a7db852d5c1e9207434c70b177c1a0cee26c98c4541388e3b1f16d34287e4a6d7d15d455f0e25bcd8e40e6fce
TLSH
T1C5E02BCFCCA24993CF3225760573512E333B17EE2506AA2B10AD341DBA57A3CA541A06
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a91b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6ca5e3fa-f64f-4046-8cbe-cc17c8f0bfe7\index-dir\the-real-index~RFe5a91b2.TMP
Size 360B
SHA256 a05eb065077d14056354d8ac3fe993ebd970f36f2b3897c7b1d1ea53bc0a2c66
MD5 dbbf36609a89c38eb2f894002f331c64
SHA1 739bce596b34897d85e4b0037944cabfc000db08
SHA512 05752c263cde54c6bdef5d047414d1c23e17b7c17405e4e9b5148f4bf8233086d568e8ac0f297724ab0b7af3b2c331bee97c42ad45ac1d4b7c495f99f254b5ad
TLSH
T1F2E095CF40D15D62DD2669351503911F333F0C343505D61B20DE985F59217FC8585E0F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ab509.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6ca5e3fa-f64f-4046-8cbe-cc17c8f0bfe7\index-dir\the-real-index~RFe5ab509.TMP
Size 1KB
SHA256 9b9a83a784e19b03cb944c59db11022a245078d88d11014b6ecc09f222417ba5
MD5 d0e27d305dbfbd860374ab9a9fb4a34e
SHA1 1e6b5180da41d6c1829b06e9dc2f10657a9500af
SHA512 12757214c01539042f6d99c96b72ea2f0286dc07a5d234575a2af6f517ba1720ab1812423396b690013ac040cf1ec6c3a935d824e696644f7ca8b70117287379
TLSH
T17811659F49A2ADF7DD6318765612411933BB54216319E75FB00EE8380D937240794A03
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0f78f95002fc9f3ce5c8a8b548ce4601284fc786d2a3d286c23079052c53fe0d
MD5 1b4adbf44545a8a6c356eb94ead0baa8
SHA1 a0ad1d896803699a13088446636ebe7960b721a5
SHA512 a22fba0ca91eac2dadd998c419e9f64e4313d1dbb0a598676d78fcc95094803957497c705fe1d7753240621a6790582a5b603530472d83caaf6fd7a805b2fe06
SSDEEP 768:xGrv+4UNbdS351JlYyr77Hucys6BRvi82oP4/z6himo+w2bwn+h:xGbsbw35q3imOz6Imon0w+
TLSH
T12303C031E4549D33DCE7C288B1467A973FF4522345C91AC0E6DE6B0E029BAAE131BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08dd9257-bc60-47d1-9da2-66c4393dbbd1.tmp

Path C:\Users\Admin\AppData\Local\Temp\08dd9257-bc60-47d1-9da2-66c4393dbbd1.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookieextract.ps1

Path C:\Users\Admin\AppData\Local\Temp\CookieExtractor_462208e0\cookieextract.ps1
Size 9KB
SHA256 7d1c93f66ce2582570e64695da5ed92fba44f6a916efda4a417478ca7952c2fb
MD5 efb5f106eee5ab6f38797adb2de2f822
SHA1 cfc7a8c241c7f37faabe27084a30c629317d3f71
SHA512 0cbced89acf86c82f58fba9a1aeaccd611f8136c6e03e64ca868c6f3523ffb42c6af9a74345d03c5255706d1ee35844ebb61631fea8ffac42649dc087a2fa712
SSDEEP 192:uEQ3KqHzxZS6dHBdN6UyrpCcANLLtSa8Yr8+nlisBssqPjxX92:hEHDS6d/oUyru8YUsBRqPjxX92
TLSH
T1AB129319790D911D56F3A7B67681A406FB06102F129D4C0478ED96E81FB0A8BCEE8F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RunIt.exe

Path C:\Users\Admin\AppData\Local\Temp\RunIt.exe
Size 143KB
SHA256 9770561d2a27dbc16c230fe88af51f718d7d6274fcd63a3f109c381be848b4a9
MD5 d067619856f7f3079375960f62b99369
SHA1 964d548557dec3aa8e851526b71adca4b4ddbfd5
SHA512 1ec891082ac133833217ce8314f6d163451c5554b789cbf8a5ff0d5ebd0b55a7ec49ea5c408bf784e6952a37526de9e77e6c39b9a4ea3b950c3fda44e7f973b8
SSDEEP 3072:iRjfP1ppKWaZK0fr1klb4lrpTP/NaLz+pMuWDxCcfguuy8:GjP/MWafrhrpTP/NaLz+pMuWFCuKy
TLSH
T1D2E35B387E87AE93C3094FF39A83A122873990917D5BD683FCD20FDE1A46BD500696D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0360fa6-582f-41f5-b782-97cb8e96f3a5.tmp

Path C:\Users\Admin\AppData\Local\Temp\a0360fa6-582f-41f5-b782-97cb8e96f3a5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ahC2p0sVNkxGSe7a.exe

Path C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe
Size 10.7MB
SHA256 9e682875b5c9c2ee3e13713d136bba9d54f2446ed6d734c33877ae02c9187f79
MD5 819cfca487cdec8f921a475c8afe8b60
SHA1 42573be23c233fdcd6aa06a007e07497649a8218
SHA512 a101b3a14c8e5faca2c7bba6cd531055e4ded42125f2398b4df96c8274f10f4f07fa34b593ca720bb5288c827d23852dd4e881bc9b12bab7af75155df17711f9
SSDEEP 49152:SOdpj5ULc3g4k2vX9OLQTM+acHEGSEGGVjb03xFKj0ia+CtbQuIrYIvVhARgzD1n:
TLSH
T1E1B6382439FA501AB173EFAA8BE479EADA6FB7733B07645D105003864723981DEC153E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bhv10AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\bhv10AB.tmp
Size 14.0MB
SHA256 7be11a618800edea742b35b609be0d8eeb49735c4fa5ef80d9f82a289e5f2839
MD5 4a5bbd35f213a92feec28df293bcb88c
SHA1 00f24e4a58cd19621fee6fa80bf8698029129c3d
SHA512 99fd908ce45b8ebb99597a1a58b16f0d19387578d6edcb2cbc2f402d8520f7e03253b49aba76756d76868ea37e49cb6e814490c4feb4ad7ce0d5e91288d67008
SSDEEP 3072:jbxS+MCHDvOHpFlmAtJp/NBBy40ACSh0c7M0/PppcbxS+MCHDvOHpFSpPJF+5rW6:7yCyASny2yKSrSaQy5dild7pb6k
TLSH
T1E7E6F7CF86D30A03FB321631B0F297532B7799D253428B966979F5A75E4A393BB02305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1c5943e-d85e-47a5-8ff1-b23499a507ee.tmp

Path C:\Users\Admin\AppData\Local\Temp\c1c5943e-d85e-47a5-8ff1-b23499a507ee.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2148_891123506\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3132_606123029\CRX_INSTALL\images\icon_128.png
Size 3KB
SHA256 4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4
MD5 30899b6c4e4a757b8ec6dd2208acdfb4
SHA1 f2c5880a724c6d75cce1b5191e0d82c3bc7de768
SHA512 58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee
TLSH
T1B3617D3A733F1E1EA655403843096A51F0C1A62454A9C0C56BE3FCF90D02E086C29B28
MD5 SHA1 SHA512 TLSH

Submit Download

icon_16.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3132_606123029\CRX_INSTALL\images\icon_16.png
Size 531B
SHA256 0a4bd08db6422f8e7a8a218ef39c1b99a5a675f12697f26be88f9afc2e1f9378
MD5 344554d96e418120bd80ef5de5194697
SHA1 23e141c3a6ce368acc1c299f062ab85914bcb17e
SHA512 7ae38853e5acca479d7fd81d48bb88c671cf4dce63342209bcff045ac581a04b7b0ed48f6c58253db950935c0522caaa4fbc6cf5a25151a8960ba56fc804569e
TLSH
T171F075CE17705C76514D0763D5E535B278614AC642C76AA1500F1A54793BC1D8DC13B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3132_606123029\CRX_INSTALL\manifest.json
Size 1KB
SHA256 49d9de983f7436ba786e6e04a5a20c10f41687ae06b266b1b6553f696719563d
MD5 6ca25f3ef585b63f01bcdf8635120704
SHA1 00c063811e31ea5f9a00f175a71ea25e7821f621
SHA512 566bfd9badbd8951ee52e5911eb68b51e86286989096d32de6e32a2523761b0e0afca251ef3bea36b5d51fb8354a5fca567772a02c3f3b9d8dfe529609fa0430
TLSH
T1CA118CD3A458C9732280D6D468A8B30BF372154F8C95BDDA777D000C5F8D4EB027A2AC
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5976_1163426241\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Bookmarks-output_20260802133041.txt

Path C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260802133041.txt
Size 4KB
SHA256 0bcefaf2e6efa9b1d8d2f8954028416b45913c08a6d9e3b3c5dac4d4d5a93572
MD5 03990d5ac62f7319925a6e6aa9f4cd72
SHA1 80af8dd3f31efa353cac59c03141df0e4733930e
SHA512 f2dc8c2f843b46cce6eb4c6aaa3c5879eb048e138687f63009c6ca13a3938eeb2b2f28228aafbd4e6cc9b0a495ab83f70c722b732d3dcbee6cc0c61693216ff0
SSDEEP 96:eVukk+A9fmnT6cQYGTVMk+wyfD4VNkKfFAVvdCfm:eVunHZ7YGTVMkjysVN/iVvUe
TLSH
T139A1B5131BF90145F2F3AA66EEB620766737394A5D79840D61DCA2CA07F3924C6D3B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChromeV20-output_20260802133041.txt

Path C:\Users\Admin\AppData\Roaming\ChromeV20-output_20260802133041.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

ExtensionsView-output_20260802133041.txt

Path C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260802133041.txt
Size 33KB
SHA256 500a25abf2f38c4e285f1cd50f2be2ad2a607b18365e4b5bbb8b00962cf6992c
MD5 79b5b0e102f0cb656555951fcffedd91
SHA1 9a3eb7eb94513b78834a0ddbcae6392421469dd5
SHA512 fca5d36d7c8779be44362baec190ba4f233b44139e0b0ccb1dc7242d8e12d10058fa1d91e99b76d5d917f336c290de3ec0c572b668961bd0faec65184739649e
SSDEEP 768:mhzgzzXzhzfzbnTz6zczjnTzTnaz/knuzZnTznHmr6Hj0aHzck1crkmqVwOCR2eO:mh8HX9j3nTeAfnTPnaAnu1nTrHA6HoaH
TLSH
T127E2AD5316FD8104F1F37A52EAB6417967B778699878C40C21DC92C90BF3A14A6E37E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstalledApps-output_20260802133041.txt

Path C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260802133041.txt
Size 119KB
SHA256 ad107f68d3e2a1879c3e961934b0e7e62d117c32b3cdedd35d51d9d522a22f7c
MD5 5f5b398a14e68f356eccef24083a59a0
SHA1 fc50e126ea9da9b22382be7b0db1a915c02e0e67
SHA512 c8738c39fe302e8a6b21e0abf418b442dd80323694ddd0eb924b634e233e675d497d06415df37301931930af10e73d5dac93ca38b30e6780c20f2426dec8d3c7
SSDEEP 1536:Oy+y6ykyryTiyZye5yY/yvuy9ycgy6ynyXy8y1yZy3ynJjyazKn83EOyoyFvyMyi:PyA
TLSH
T158C315165BF50218F1F3AF85E9F154635E37BCA58D34D68C119942CE0AB3A04E8E3B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductKeys-output_20260802133041.txt

Path C:\Users\Admin\AppData\Roaming\ProductKeys-output_20260802133041.txt
Size 786B
SHA256 00bbb38876c85d980b94637b68090f2e4ab75c57d91c7d48e181fc72a2ef6683
MD5 f50cfaa8020f55aecb47297df3f0f804
SHA1 fdf4af6eca25cf03fc05c250c60a80889030a056
SHA512 32d8b0e97b068635182c38ab3d039e974161f36d9909d91e4e3f4ba39b0838c8c5441e58b2d325c35ead6a2d89d8e973b7d045b348ebfd5b07e14235a5e47d64
TLSH
T1E501C2A3D0D9018370C5127207757AF0BD8C3DC29DE2222871DED69D1B6670EB36800F
MD5 SHA1 SHA512 TLSH

Submit Download

WorkingTasks-output_20260802133041.txt

Path C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20260802133041.txt
Size 13KB
SHA256 bac19dc984ef0d63feae26e34be2ade63b14930f5b25da29448228eb833fdef1
MD5 370ca58f037577d2c714482a0f043bda
SHA1 35c4c57407e8906b6f74d82c190decdda9756198
SHA512 ea0c08bf91326b3a0f2940dee53eac528524b80b93bc8f97d2f1205e6ab2e9c46f804759b83621418a09bcdc7c7d6a2f44603cceed4e493de244b76b86d1d41e
SSDEEP 384:1HU15QWXtwX15QWX9d215QWXPJZ14QWXnhY14QWXE5k1tQWXLZu14QWXDJk1tQWx:1MRXtwRX90RXPVeXnaeXEuNXLQeXD+Nx
TLSH
T18E52161352F95044A2B3BA82EAF6547707B778699D7C801E61CC83D50BE3E40D6E3BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watch-output_20260802133041.html

Path C:\Users\Admin\AppData\Roaming\watch-output_20260802133041.html
Size 3KB
SHA256 f495f4630af2343bf44ca4b28cafdfe9ae6d2c973b157d6faf6108aa932de1ca
MD5 eb065976737b4081d80f90a3c1e0b566
SHA1 7eebdd011ff305163ef682536f98f61b7f34ab96
SHA512 0e4e3a0f9931ed6820baa519437fcc31f1f9f0e54956c29a3fb30fbe069cd7e0b3b223c8a03eccb1d48f9b837fe574643c78fad090cbe8f4ad681529eb2679f3
TLSH
T11F71FE92F1597DBA9CAB40CC4002F86FB7146C9231510EFE2B1FF5CBF681866C6929D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/352-48-0x0000000004B20000-0x0000000004B2A000-memory.dmp

Download

memory/352-44-0x0000000004C50000-0x0000000004CEC000-memory.dmp

Download

memory/352-43-0x0000000004BB0000-0x0000000004C42000-memory.dmp

Download

memory/352-41-0x0000000000330000-0x000000000035A000-memory.dmp

Download

memory/764-131-0x0000000006DB0000-0x0000000006E46000-memory.dmp

Download

memory/764-126-0x0000000005B30000-0x0000000005B4E000-memory.dmp

Download

memory/764-1213-0x0000000008AA0000-0x0000000008FCC000-memory.dmp

Download

memory/764-1195-0x0000000007C40000-0x0000000007E02000-memory.dmp

Download

memory/764-119-0x0000000002320000-0x0000000002356000-memory.dmp

Download

memory/764-120-0x0000000004E00000-0x000000000544A000-memory.dmp

Download

memory/764-121-0x0000000004D50000-0x0000000004D72000-memory.dmp

Download

memory/764-122-0x0000000005540000-0x00000000055A6000-memory.dmp

Download

memory/764-125-0x0000000005620000-0x000000000597B000-memory.dmp

Download

memory/764-132-0x0000000006D40000-0x0000000006D62000-memory.dmp

Download

memory/764-127-0x0000000005B80000-0x0000000005BCC000-memory.dmp

Download

memory/764-130-0x00000000060D0000-0x00000000060EA000-memory.dmp

Download

memory/764-129-0x0000000007370000-0x00000000079EC000-memory.dmp

Download

memory/812-83-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/812-82-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1652-76-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/1652-77-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/1688-24-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/1688-31-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/1688-29-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/1688-64-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/1688-30-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/1688-23-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/1712-94-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1712-95-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2000-62-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2000-61-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2280-90-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/2280-91-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/2576-98-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/2576-99-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/2748-60-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/2748-0-0x00007FFC1C67F000-0x00007FFC1C680000-memory.dmp

Download

memory/2748-9-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/2748-10-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/2748-11-0x000000001F280000-0x000000001FD62000-memory.dmp

Download

memory/2748-8-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/2748-7-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/2748-6-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/2748-5-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/2748-4-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/2748-3-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/2748-2-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/2748-1-0x0000000000280000-0x0000000000AEA000-memory.dmp

Download

memory/2852-53-0x0000000000660000-0x000000000068A000-memory.dmp

Download

memory/4216-56-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4216-55-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4484-103-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/4484-102-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/4520-72-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4520-73-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4752-54-0x0000000005F50000-0x0000000005F5A000-memory.dmp

Download

memory/4752-1603-0x0000000005FB0000-0x0000000005FC2000-memory.dmp

Download

memory/4752-32-0x0000000000660000-0x000000000111E000-memory.dmp

Download

memory/4752-33-0x0000000005FD0000-0x000000000658A000-memory.dmp

Download

memory/4752-35-0x0000000005AD0000-0x0000000005B36000-memory.dmp

Download

memory/4880-87-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4880-86-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5604-67-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5604-66-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5780-42-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/5780-45-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/5780-51-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/5780-50-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/5780-49-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/5780-47-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/5780-46-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/5780-34-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/5780-69-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/5780-40-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/5780-36-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/5872-106-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5872-107-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/6124-59-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/6124-58-0x0000000000400000-0x0000000000416000-memory.dmp

Download