destiny_stealer | 0e7aa42d81a35200a205b426dd88c0c487b785851a081bedd9978ced12fb09de

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
imgs.exe
Size 8.4MB
Sample260802-pptpssshpe
SHA256 0e7aa42d81a35200a205b426dd88c0c487b785851a081bedd9978ced12fb09de
MD5 ab3ecc662732ece57ff6d35440061c1a
SHA1 7f5e5e80a28d925bda4ebc6747959e261d287fd3
SHA512 b2c27b67fa39ca9f97b16452ca4f9cdb51b0cd68f59c26409a42a898992b8367050d6aad103a35d72e005294e1b7196431f25b40bd3436832babc9befeb02f0b
SSDEEP 196608:1hpJ6ghaKesWITQKhWlJm97IeswHgkOBI9c83L:1fIFX8TOvIswBAI913L
TLSH
T183963351B154EF62C38D527FC6CF942083E89D473573EB96AE8933268B423BB5C51AC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution destiny_stealer persistence stealer

Malware Config

Extracted

Family

destiny_stealer

86.54.42.197

Attributes

port
8888

Signatures

Family: Destiny Stealer
DestinyStealer is a stealer written in C#.
stealer destiny_stealer

Detected Nirsoft tools 18 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2744-45-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/2744-46-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4692-52-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral2/memory/4692-53-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral2/memory/1512-59-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/1512-60-0x0000000000400000-0x0000000000414000-memory.dmp	Nirsoft
behavioral2/memory/4732-64-0x0000000000400000-0x0000000000445000-memory.dmp	Nirsoft
behavioral2/memory/4732-65-0x0000000000400000-0x0000000000445000-memory.dmp	Nirsoft
behavioral2/memory/3056-68-0x0000000000400000-0x00000000004A5000-memory.dmp	Nirsoft
behavioral2/memory/3056-69-0x0000000000400000-0x00000000004A5000-memory.dmp	Nirsoft
behavioral2/memory/4740-78-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/4740-79-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/940-86-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral2/memory/940-87-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft
behavioral2/memory/7056-90-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral2/memory/7056-91-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral2/memory/6936-98-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft
behavioral2/memory/6936-99-0x0000000000400000-0x0000000000482000-memory.dmp	Nirsoft

NirSoft EdgeCookiesView 2 IoCs

Password recovery tool for Microsoft Edge browser

resource	yara_rule
behavioral2/memory/2744-45-0x0000000000400000-0x000000000041C000-memory.dmp	EdgeCookiesView
behavioral2/memory/2744-46-0x0000000000400000-0x000000000041C000-memory.dmp	EdgeCookiesView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/6936-98-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView
behavioral2/memory/6936-99-0x0000000000400000-0x0000000000482000-memory.dmp	WebBrowserPassView

Uses browser remote debugging 2 TTPs 26 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5948	msedge.exe
2944	msedge.exe
5976	chrome.exe
5460	chrome.exe
1968	chrome.exe
3272	chrome.exe
5996	chrome.exe
3924	chrome.exe
5612	chrome.exe
4276	msedge.exe
6464	chrome.exe
6096	chrome.exe
4496	chrome.exe
6740	chrome.exe
6396	chrome.exe
2088	chrome.exe
6068	chrome.exe
6896	chrome.exe
1584	chrome.exe
4404	msedge.exe
1928	msedge.exe
1352	msedge.exe
5616	chrome.exe
6512	chrome.exe
2564	chrome.exe
5804	chrome.exe

Executes dropped EXE 5 IoCs

pid	Process
2456	WindowsDataC.exe
1800	WindowsDataC.exe
5400	RunIt.exe
4872	ahC2p0sVNkxGSe7a.exe
6364	Rnts.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDataC.exe = "C:\\ProgramData\\WindowsDataC.exe"	imgs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rnts.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Rnts.exe"	RunIt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rnts.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Rnts.exe"	Rnts.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 4872 set thread context of 2744	4872	ahC2p0sVNkxGSe7a.exe	97
PID 4872 set thread context of 4692	4872	ahC2p0sVNkxGSe7a.exe	98
PID 4872 set thread context of 6984	4872	ahC2p0sVNkxGSe7a.exe	100
PID 4872 set thread context of 1512	4872	ahC2p0sVNkxGSe7a.exe	101
PID 4872 set thread context of 4732	4872	ahC2p0sVNkxGSe7a.exe	103
PID 4872 set thread context of 3056	4872	ahC2p0sVNkxGSe7a.exe	104
PID 4872 set thread context of 5968	4872	ahC2p0sVNkxGSe7a.exe	105
PID 4872 set thread context of 4740	4872	ahC2p0sVNkxGSe7a.exe	107
PID 4872 set thread context of 5064	4872	ahC2p0sVNkxGSe7a.exe	108
PID 4872 set thread context of 940	4872	ahC2p0sVNkxGSe7a.exe	109
PID 4872 set thread context of 7056	4872	ahC2p0sVNkxGSe7a.exe	111
PID 4872 set thread context of 1168	4872	ahC2p0sVNkxGSe7a.exe	112
PID 4872 set thread context of 6936	4872	ahC2p0sVNkxGSe7a.exe	113

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2520	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ahC2p0sVNkxGSe7a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rnts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RunIt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2704	chrome.exe
5008	msedge.exe
4636	msedge.exe
6164	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	ahC2p0sVNkxGSe7a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ahC2p0sVNkxGSe7a.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301475033928985"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2744	grpconv.exe
2744	grpconv.exe
4872	ahC2p0sVNkxGSe7a.exe
4872	ahC2p0sVNkxGSe7a.exe
4872	ahC2p0sVNkxGSe7a.exe
4872	ahC2p0sVNkxGSe7a.exe
3056	grpconv.exe
3056	grpconv.exe
3056	grpconv.exe
3056	grpconv.exe
3056	grpconv.exe
3056	grpconv.exe
3056	grpconv.exe
3056	grpconv.exe
4740	grpconv.exe
4740	grpconv.exe
4872	ahC2p0sVNkxGSe7a.exe
4872	ahC2p0sVNkxGSe7a.exe
6936	grpconv.exe
6936	grpconv.exe
6936	grpconv.exe
6936	grpconv.exe
4872	ahC2p0sVNkxGSe7a.exe
4872	ahC2p0sVNkxGSe7a.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
5460	chrome.exe
5460	chrome.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
6740	chrome.exe
6740	chrome.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	4872	ahC2p0sVNkxGSe7a.exe
Token: SeDebugPrivilege	4740	grpconv.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	5460	chrome.exe
Token: SeCreatePagefilePrivilege	5460	chrome.exe
Token: SeShutdownPrivilege	6740	chrome.exe
Token: SeCreatePagefilePrivilege	6740	chrome.exe
Token: SeShutdownPrivilege	6740	chrome.exe
Token: SeCreatePagefilePrivilege	6740	chrome.exe
Token: SeShutdownPrivilege	6740	chrome.exe
Token: SeCreatePagefilePrivilege	6740	chrome.exe
Token: SeShutdownPrivilege	6740	chrome.exe
Token: SeCreatePagefilePrivilege	6740	chrome.exe
Token: SeShutdownPrivilege	6740	chrome.exe
Token: SeCreatePagefilePrivilege	6740	chrome.exe
Token: SeShutdownPrivilege	6740	chrome.exe
Token: SeCreatePagefilePrivilege	6740	chrome.exe
Token: SeShutdownPrivilege	6740	chrome.exe
Token: SeCreatePagefilePrivilege	6740	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5460	chrome.exe
6740	chrome.exe
5948	msedge.exe
1352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 2456	3428	imgs.exe	90
PID 3428 wrote to memory of 5400	3428	imgs.exe	92
PID 3428 wrote to memory of 4872	3428	imgs.exe	93
PID 4872 wrote to memory of 2744	4872	ahC2p0sVNkxGSe7a.exe	97
PID 4872 wrote to memory of 2744	4872	ahC2p0sVNkxGSe7a.exe	97
PID 4872 wrote to memory of 2744	4872	ahC2p0sVNkxGSe7a.exe	97
PID 4872 wrote to memory of 2744	4872	ahC2p0sVNkxGSe7a.exe	97
PID 4872 wrote to memory of 2744	4872	ahC2p0sVNkxGSe7a.exe	97
PID 4872 wrote to memory of 2744	4872	ahC2p0sVNkxGSe7a.exe	97
PID 4872 wrote to memory of 4692	4872	ahC2p0sVNkxGSe7a.exe	98
PID 4872 wrote to memory of 4692	4872	ahC2p0sVNkxGSe7a.exe	98
PID 4872 wrote to memory of 4692	4872	ahC2p0sVNkxGSe7a.exe	98
PID 4872 wrote to memory of 4692	4872	ahC2p0sVNkxGSe7a.exe	98
PID 4872 wrote to memory of 4692	4872	ahC2p0sVNkxGSe7a.exe	98
PID 4872 wrote to memory of 4692	4872	ahC2p0sVNkxGSe7a.exe	98
PID 4872 wrote to memory of 6216	4872	ahC2p0sVNkxGSe7a.exe	99
PID 4872 wrote to memory of 6984	4872	ahC2p0sVNkxGSe7a.exe	100
PID 4872 wrote to memory of 6984	4872	ahC2p0sVNkxGSe7a.exe	100
PID 4872 wrote to memory of 6984	4872	ahC2p0sVNkxGSe7a.exe	100
PID 4872 wrote to memory of 6984	4872	ahC2p0sVNkxGSe7a.exe	100
PID 4872 wrote to memory of 6984	4872	ahC2p0sVNkxGSe7a.exe	100
PID 4872 wrote to memory of 6984	4872	ahC2p0sVNkxGSe7a.exe	100
PID 4872 wrote to memory of 1512	4872	ahC2p0sVNkxGSe7a.exe	101
PID 4872 wrote to memory of 1512	4872	ahC2p0sVNkxGSe7a.exe	101
PID 4872 wrote to memory of 1512	4872	ahC2p0sVNkxGSe7a.exe	101
PID 4872 wrote to memory of 1512	4872	ahC2p0sVNkxGSe7a.exe	101
PID 4872 wrote to memory of 1512	4872	ahC2p0sVNkxGSe7a.exe	101
PID 4872 wrote to memory of 1512	4872	ahC2p0sVNkxGSe7a.exe	101
PID 4872 wrote to memory of 4280	4872	ahC2p0sVNkxGSe7a.exe	102
PID 4872 wrote to memory of 4732	4872	ahC2p0sVNkxGSe7a.exe	103
PID 4872 wrote to memory of 4732	4872	ahC2p0sVNkxGSe7a.exe	103
PID 4872 wrote to memory of 4732	4872	ahC2p0sVNkxGSe7a.exe	103
PID 4872 wrote to memory of 4732	4872	ahC2p0sVNkxGSe7a.exe	103
PID 4872 wrote to memory of 4732	4872	ahC2p0sVNkxGSe7a.exe	103
PID 4872 wrote to memory of 4732	4872	ahC2p0sVNkxGSe7a.exe	103
PID 4872 wrote to memory of 3056	4872	ahC2p0sVNkxGSe7a.exe	104
PID 4872 wrote to memory of 3056	4872	ahC2p0sVNkxGSe7a.exe	104
PID 4872 wrote to memory of 3056	4872	ahC2p0sVNkxGSe7a.exe	104
PID 4872 wrote to memory of 3056	4872	ahC2p0sVNkxGSe7a.exe	104
PID 4872 wrote to memory of 3056	4872	ahC2p0sVNkxGSe7a.exe	104
PID 4872 wrote to memory of 3056	4872	ahC2p0sVNkxGSe7a.exe	104
PID 4872 wrote to memory of 5968	4872	ahC2p0sVNkxGSe7a.exe	105
PID 4872 wrote to memory of 5968	4872	ahC2p0sVNkxGSe7a.exe	105
PID 4872 wrote to memory of 5968	4872	ahC2p0sVNkxGSe7a.exe	105
PID 4872 wrote to memory of 5968	4872	ahC2p0sVNkxGSe7a.exe	105
PID 4872 wrote to memory of 5968	4872	ahC2p0sVNkxGSe7a.exe	105
PID 4872 wrote to memory of 5968	4872	ahC2p0sVNkxGSe7a.exe	105
PID 4872 wrote to memory of 4740	4872	ahC2p0sVNkxGSe7a.exe	107
PID 4872 wrote to memory of 4740	4872	ahC2p0sVNkxGSe7a.exe	107
PID 4872 wrote to memory of 4740	4872	ahC2p0sVNkxGSe7a.exe	107
PID 4872 wrote to memory of 4740	4872	ahC2p0sVNkxGSe7a.exe	107
PID 4872 wrote to memory of 4740	4872	ahC2p0sVNkxGSe7a.exe	107
PID 4872 wrote to memory of 4740	4872	ahC2p0sVNkxGSe7a.exe	107
PID 4872 wrote to memory of 5064	4872	ahC2p0sVNkxGSe7a.exe	108
PID 4872 wrote to memory of 5064	4872	ahC2p0sVNkxGSe7a.exe	108
PID 4872 wrote to memory of 5064	4872	ahC2p0sVNkxGSe7a.exe	108
PID 4872 wrote to memory of 5064	4872	ahC2p0sVNkxGSe7a.exe	108
PID 4872 wrote to memory of 5064	4872	ahC2p0sVNkxGSe7a.exe	108
PID 4872 wrote to memory of 5064	4872	ahC2p0sVNkxGSe7a.exe	108
PID 4872 wrote to memory of 940	4872	ahC2p0sVNkxGSe7a.exe	109
PID 4872 wrote to memory of 940	4872	ahC2p0sVNkxGSe7a.exe	109
PID 4872 wrote to memory of 940	4872	ahC2p0sVNkxGSe7a.exe	109
PID 4872 wrote to memory of 940	4872	ahC2p0sVNkxGSe7a.exe	109
PID 4872 wrote to memory of 940	4872	ahC2p0sVNkxGSe7a.exe	109

C:\Users\Admin\AppData\Local\Temp\imgs.exe
"C:\Users\Admin\AppData\Local\Temp\imgs.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3428
- C:\ProgramData\WindowsDataC.exe
  "C:\ProgramData\WindowsDataC.exe"
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Users\Admin\AppData\Local\Temp\RunIt.exe
  "C:\Users\Admin\AppData\Local\Temp\RunIt.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5400
- C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe
  "C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20260802133053.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2744
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\FirefoxCookies-output_20260802133053.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260802133053.txt"
    3⤵
    PID:6216
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260802133053.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6984
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /shtml "C:\Users\Admin\AppData\Roaming\watch-output_20260802133053.html"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1512
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ChromeV20-output_20260802133052.txt"
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ChromeV20-output_20260802133052.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4732
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\BrowserHistory-output_20260802133053.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3056
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\DefenderLogs-output_20260802133053.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5968
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20260802133053.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260802133053.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5064
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ProductKeys-output_20260802133053.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:940
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260802133053.txt"
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260802133053.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7056
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Autofill-output_20260802133053.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1168
- - C:\Windows\SysWOW64\grpconv.exe
    "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20260802133053.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6936
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CookieExtractor_fe3195bc\cookieextract.ps1" -Browser Both -OutputDir "C:\Users\Admin\AppData\Roaming"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:5460
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff8560dc728,0x7ff8560dc734,0x7ff8560dc740
        5⤵
        
        PID:1672
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
        5⤵
        
        PID:1356
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6164
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:13
        5⤵
        
        PID:4516
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2088
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1968
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3272
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:14
        5⤵
        
        PID:6344
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
        5⤵
        
        PID:6864
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5996
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6464
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5616
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6096
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
        5⤵
        
        PID:3520
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5612
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
        5⤵
        
        PID:7144
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
        5⤵
        
        PID:692
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6396
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1956,i,10997615734158713552,7600375120246107749,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:4496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:6740
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff8560dc728,0x7ff8560dc734,0x7ff8560dc740
        5⤵
        
        PID:4608
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1932,i,6573173186170920098,13195949974767597876,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
        5⤵
        
        PID:2024
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1932,i,6573173186170920098,13195949974767597876,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1932,i,6573173186170920098,13195949974767597876,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:13
        5⤵
        
        PID:7144
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1932,i,6573173186170920098,13195949974767597876,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2564
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1932,i,6573173186170920098,13195949974767597876,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:6512
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1932,i,6573173186170920098,13195949974767597876,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:14
        5⤵
        
        PID:6264
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1932,i,6573173186170920098,13195949974767597876,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5804
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1932,i,6573173186170920098,13195949974767597876,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
        5⤵
        
        PID:2720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1932,i,6573173186170920098,13195949974767597876,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
        5⤵
        
        PID:4180
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1932,i,6573173186170920098,13195949974767597876,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
        5⤵
        
        PID:1600
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1932,i,6573173186170920098,13195949974767597876,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
        5⤵
        
        PID:5824
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1932,i,6573173186170920098,13195949974767597876,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1584
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1932,i,6573173186170920098,13195949974767597876,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:9
        5⤵
        Uses browser remote debugging
        
        PID:6896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      PID:5948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x278,0x27c,0x280,0x274,0x288,0x7ff84f81c188,0x7ff84f81c194,0x7ff84f81c1a0
        5⤵
        
        PID:2868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2264,i,12257952410292605794,2169819679175949630,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
        5⤵
        
        PID:5808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2264,i,12257952410292605794,2169819679175949630,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2264,i,12257952410292605794,2169819679175949630,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:13
        5⤵
        
        PID:3312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2264,i,12257952410292605794,2169819679175949630,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2264,i,12257952410292605794,2169819679175949630,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      PID:1352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x278,0x27c,0x280,0x274,0x2e4,0x7ff84f81c188,0x7ff84f81c194,0x7ff84f81c1a0
        5⤵
        
        PID:2608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2452,i,8364332961958364625,15021645245192255869,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2
        5⤵
        
        PID:2652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2452,i,8364332961958364625,15021645245192255869,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2452,i,8364332961958364625,15021645245192255869,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
        5⤵
        
        PID:360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2452,i,8364332961958364625,15021645245192255869,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2452,i,8364332961958364625,15021645245192255869,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2944

C:\ProgramData\WindowsDataC.exe
C:\ProgramData\WindowsDataC.exe
1⤵
- Executes dropped EXE
PID:1800

C:\Users\Admin\AppData\Local\Temp\Rnts.exe
C:\Users\Admin\AppData\Local\Temp\Rnts.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:6364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsDataC.exe

Path C:\ProgramData\WindowsDataC.exe
Size 8.4MB
SHA256 0e7aa42d81a35200a205b426dd88c0c487b785851a081bedd9978ced12fb09de
MD5 ab3ecc662732ece57ff6d35440061c1a
SHA1 7f5e5e80a28d925bda4ebc6747959e261d287fd3
SHA512 b2c27b67fa39ca9f97b16452ca4f9cdb51b0cd68f59c26409a42a898992b8367050d6aad103a35d72e005294e1b7196431f25b40bd3436832babc9befeb02f0b
SSDEEP 196608:1hpJ6ghaKesWITQKhWlJm97IeswHgkOBI9c83L:1fIFX8TOvIswBAI913L
TLSH
T183963351B154EF62C38D527FC6CF942083E89D473573EB96AE8933268B423BB5C51AC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 19f7bcb6d46a5486d85a7f7555974fb784e6f76066521a18910988910a2a6a83
MD5 073c6d601b9d60bd7f0f1abeb39e8990
SHA1 4bdfe54850857ef74dc5eed74a79d67707b8d0f1
SHA512 0c1b7c34d016141b5eca2cb7db218bc983d6be484adb01db1fbf2a606531539010df3392b779a15dac7f123b60e1ca7140759b26c9f787321d677cac66f449b1
MD5 SHA1 SHA512

Submit Download

03f3baa4-b10d-4449-9ccc-0785ebe643de.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\03f3baa4-b10d-4449-9ccc-0785ebe643de.tmp
Size 414B
SHA256 ad801cb2d654ad4fca13ef4e521db5648c3d9c08fb040c8f2b6bad5f5eda70f6
MD5 5bd857ee9385bb02a73b8ce7e071814c
SHA1 12f0f1d8d0be79428e1f3c6a43b54c5fc636947d
SHA512 f914aec22a18b4bb1ac0bd0b311a4596c2abb8033688058328bc989274a6c47cd6b0e96152fcbf2adfaa082cd6bc69b8c1beacbdd81b2b407d61472e9d370587
TLSH
T1BAE02BA9CD21BC2B0DFD07A910014A46EB4413672B91486B3A3C90184F70636019992C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_metadata\computed_hashes.json
Size 10KB
SHA256 965203d541e442c107dbc6d5b395168123d0397559774beae4e5b9abc44ef268
MD5 90f880064a42b29ccff51fe5425bf1a3
SHA1 6a3cae3996e9fff653a1ddf731ced32b2be2acbf
SHA512 d9cbfcd865356f19a57954f8fd952caf3d31b354112766c41892d1ef40bd2533682d4ec3f4da0e59a5397364f67a484b45091ba94e6c69ed18ab681403dfd3f3
SSDEEP 192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
TLSH
T13B327DA05F9EF1DB9F9873F82F132C12A8564B518A95E9647F90DBC5B38D20F520243E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_metadata\verified_contents.json
Size 7KB
SHA256 52a24fa2fb3bcb18d9d8571ae385c4a830ff98ce4c18384d40a84ea7f6ba7f69
MD5 0834821960cb5c6e9d477aef649cb2e4
SHA1 7d25f027d7cee9e94e9cbdee1f9220c8d20a1588
SHA512 9aeafc3ece295678242d81d71804e370900a6d4c6a618c5a81cacd869b84346feac92189e01718a7bb5c8226e9be88b063d2ece7cb0c84f17bb1af3c5b1a3fc4
SSDEEP 192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
TLSH
T1EBF1A568CC5D758CFC56B77987AA36768B48C5C9E14D3E2E12C30CA178F6A4888B30DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\images\icon_128.png
Size 4KB
SHA256 149fc2270389655ee20da9cebb31ffde75e16e3ad371b9b907f62013ed45e705
MD5 7424a1046f7a440dc5e43b9a3c5d791e
SHA1 0672cf5b67820e81beb23010f62123e0b362e3ab
SHA512 2836cb5b4d682bc70e74c88af21e0ce972679eb07e88aa0b80db5990a68453e1c9580e530eede390c743d7377ea8ff3df7b78a7c5ddbde124d7782c63cf329bb
SSDEEP 96:jzliICMC5QmAjL7eTu3Ay1Hnn5IlQRU19x0tfo4CPmukC0:jzQzAjLiTK1H5IlQW1Xbm7
TLSH
T1AF916BA01EB4FABCD449F179A423BA2CD4049904D83583278E1DBF7626247A633C94AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\images\icon_16.png
Size 582B
SHA256 15b1cc630202324ad6b3b142a22cb1a55de8d6d9a0bcab78d5b14cd997a5ddd5
MD5 b323815b176657da3933a39e5658177e
SHA1 27e230c6d7b1774a9cfdebd6271e781619e797eb
SHA512 c049c8c8ad36fef941ef3917fee911d632923f41e8d2b3caea8938c87dda229c0d632f8f07aa3334fe79a31de87e75bb73d45d4811f9e81e0f261238bc41014b
TLSH
T105F0E1E29628FDD8C20AC13E4619AD21BDB258D85BA04B380553ECB13DA9AA9C065195
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\manifest.json
Size 1KB
SHA256 f52714812d68c577a445169d11e84df6751c2d6886bc429643072bb5d61c6c27
MD5 01334fb9d092af2aa46c4185e405c627
SHA1 47ad3c0e82362ffe5b881df8d71d6f79ab7f5796
SHA512 888d96adb7a847abe472145258c8c46950eb2fa3ba7d596c2e90a17c8fb06fd0155c56cc8aba5d076d89368417464bcb2d236f9e40e53241950a01f9f8ed548f
TLSH
T1F721CAE72455C0BB16B0DBD9B8A8620BF733130E8490C6CF793C404DCFBA8E2524A668
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 8d3a32de6822c4422d8e9d006568dcc8769ac803f5c877f3f06a9fbd7b2df5b1
MD5 fecc9b37725ac491f5f78d3e3ee2c0ef
SHA1 e26d39f1d891d16842839ef3ddd1d52ec23b77ee
SHA512 6d5507b3089b3ca01325319aa6c03bcd94f049ca2e31db17e3c18812fd4cd3118942109d29d9e5284b8e807297b7f5b024052e76534be0ad00a5435e498d2af9
TLSH
T1B4E0206424EDC55D1957A02F7228BB0CC7F43408DEDEA94D0F05B480B1CC408F3C07A1
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 dd3a29b55f6263a280de09e325f87aaa1f8a0d4190eb42f5fd3ec3e9e6c99f91
MD5 2f97a098b3a301b44fe665ab131abc01
SHA1 beec6efacd00da4522034e6bd502698e1e5e040e
SHA512 b12aad4c9708a3a468bdbb11835dff11cdf363f42f9a3d3d30cd723de0fee320994e8718ab99b5c185113ad99c6f806a3ab16052a090bb0d610fcf833956774d
TLSH
T1B8E02C8125C8CAFE289B980B2238F30CCBE4781BDACCBC4A5F00C84821CA80870E1A70
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 289B
SHA256 0768e811c51ac61a8e573ac6b53f89dbb1d89eb2fcf62536a9a5f730329c584b
MD5 541c42f1c98b3e1b011d22eba854e707
SHA1 db30188de1f22e3077e7044be1386a5d0ecaed9d
SHA512 47828c1b40deb8d37d6ff4fc8f7673fbb59b40e07f54f0fa4121b91941160134c251e20f7f28f7ee5185f3c8aee2b7e95a1bef573bc64c68912016accbe90604
TLSH
T1B2D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 1636cf2946063497522235f07fa0190073523a7ecf87bcc60370bd4356c62cf1
MD5 1f9c309cf5f457e27de6223c195d9bbf
SHA1 83e13ac6fb2e72f8f3bbc29b26b4b0f9aad1a80d
SHA512 b394e7107eae4c5b4ee30a4db3e7567107dba793dcefc078c257199866e5bff62abbbf6672bc67e7c8f9217d4cdc95485b7fdfedff448ea69cdbffeb4d4bd6ba
TLSH
T1FFE0866524D9C57D1857A46F3274B70DC7E63409EBECA80A1B05E480728D80873E0AB4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 c6f3253b2fd1df82f0971d1c1322fd8da108add2b10b8c22b86b3766d78b3e0a
MD5 f4e08cfde4cad6069bc498e8ed9884c7
SHA1 c23743b0f6a9a938ee0d1d377cf55c4dfc041c87
SHA512 f9e4f1f0e914da76e7349b08bf19d6932370bba7b93bea6e816cc3fbaf65e9ea14062054efefc8ed58a74ddb3eaf57a07e89ac5a113fb506154f0c855ccc32ea
TLSH
T165E0D87025C98B7E149B905F7325F30CCFE2B40ADADD986A6F05A48052CB80471C1651
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Size 2KB
SHA256 a70423c48119f29be0127edf68dbffe2a325b9955a3462f5d6224af84ac397ab
MD5 903e512bbf5604c333ba41266a37f2b2
SHA1 03e0040d85a348e1e8e5c1d0c2369ff26a2cdb8e
SHA512 7b6bb3a5296220d5dba5703c14b057335669de57967ab8ea9ce4116c7522f1097f8c990bd1bb4926350f2ac4203b71c2606c45d8709d32ee76a561ee05a874d4
TLSH
T1FE51D1F37D015435FD6398FA11EA385CCE6B930E18A8D3E5D3C65D31204395AB41F2A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 0cdea4a274d024f99f501dfb7902d3516e6619d2101eadba25416118a735625b
MD5 ffb88402a1c05ccdaa13f09ab0089995
SHA1 cc903f6682ceff9d07a670860b2cef87ab44ea76
SHA512 e19916cd61dcf9337e019dd3820752935cc2ade9a474636ba03909fe5bf578b6764988c17024730f0ffe5d8fc922596d847dcfbeef637e90ea61a4510cfd71d6
TLSH
T10BE0207015C4CB7D1447D4875374F30E8BF07C4A9BDD754D9B05644055C940472E4550
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
MD5 520121a67f0bdc7a327bd49d50090dac
SHA1 648e3fbcbbffa431fd2480edf0a342b6920fb3b5
SHA512 36a89b73c4de9d9ef98becbbd31f286014163617063600ed22779e1e87ac35cbfb8341f9e4300994352570b1223719256c0d698dfa4aeb38e7d3907927a79a92
TLSH
T12D11E5B643275C67A2B3011708E03ABC8D605898F02B4A9C90148799360BBAAA4ED3DD
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 d086c9fcc26a39134cb3c49ae344ecb32ba700a4be7b92d97ea1ba5d1be4d292
MD5 da8c9a95d4f41697ff65823e859ca6f7
SHA1 04b0949e4b312765a5501ad512eaed13af54e7b6
SHA512 e61ab15ccbd93d61a42cbad7ad705359d8bec6f09e201394e669e2d972cf85fc9808d6f04bdb158385c3b6f2bf29686583bac7c9119a1d4389e14f15e38d9ce9
SSDEEP 3:rllNllv/etXl4yLsll+qg/G9EZtaXM/RuWGJpDEJ7KgJpDEJ7HBQ0TihN:ul4yLslMLWc/mLEJOgLEJL7i/
TLSH
T1DE02228AB098444DC470403CCBCEA4C83A2ACDA43FA7222930D082BA7CAC40B4834BC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 25KB
SHA256 47dd182e00f349dfa402485cd3f262b2639a93cde292a1a1b14633733d74b257
MD5 d36e173765ed560df7ddda7c5109a81c
SHA1 2072c4bede610c4d50c8362e56cfa9e5a5879b26
SHA512 71d798c399260aca7a63daccacfbc1946a04b62712a5dc5116183f74a95eb1180f579736d4bd7c7caebd710187ee5b6e4d262758adeb5afa50c7f0030be59643
SSDEEP 384:kWvQsdGtaTMq26Mx8sdG2Aj/3sdGYRCQMIIITbTMIMSBu8sdGTdGbq+NnMsdGTdw:81B9RCQSqj0
TLSH
T184C2E757E3B01BA1DCDF97FBBC559C2E0B72DC8942960041A49A97BE3C63E074881BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 03273675e5990de6b6f9adcf65ef78a2cd6cdf69491e4e1e9ac2b9ef82a5092e
MD5 3753a37a5e914a86c5dffb0b5f2345ad
SHA1 b0b3ff1147aa0fd8bd52efe73404d86541f61b03
SHA512 4500db15767fe6d67192c7350a1aa47511845a508c159830407cdc1517e2f54265fcfc37e68fa308ff426c49b363cac2f5d8338a037b585d68de12129fc0c6bd
TLSH
T14EE0260078C8C5EE781BA88F7234E38E97C53819EFFD940E1F02E044508C40476C9A60
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 7b8ac8e9e5113f2327af7562898aeff703edb0b78d84d642366f7db5c78f0fa9
MD5 8b7f5b1eb135501e3f9b5ac8fe96feb1
SHA1 60d0be30e6717bc854b3dcaa2e3d49543b34b492
SHA512 f363b8bfdd1b66fbbe21c45ccff91c9e63d11486868fa9c7be1ccd7b15b3ac031638cd025e39929b1523f3212054d2f5a2a14ba054ca65d82d5869244126320f
TLSH
T17321D855F330C205D249873A117EAB151734D8535FF8ED0F01B625782EB2F551D4B2EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 94566c81e23701d8e4cfb03d05ef2e45bf5ac000abf42d5ab55877e2da2e388b
MD5 2db406fff8bc6840858deee4eba55184
SHA1 1177392195b305a89baade9f49ee6c06dbcec0d7
SHA512 e16dc6883a4e38ed761a30fc9108748639f3a38e1f351cad300b9e04432f633baac5c7c953738e421dac7ef34e56f497dbc63cd26b7a0f9626f7ea8c4cb2716d
TLSH
T176E0260078CCC5AF7813A8DB2174F38E97D53868EFFDAE0E0F02E844658C64476C9A60
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f5635a8c28182d838b3cf6c5379a39eaa19723630ddc21848fc3d396d8d60e41
MD5 b6db1aa6f6d32d291b62b2a643c77cfd
SHA1 b3e6b12370de248c9ea6dc6d60e2782b65c42f2e
SHA512 bf49133f078a675ca20e52156f63d698288eab2053675f037c1a60d5cf9b893b09eb851be09b51daae75aba43a122e94bddce2d0851501f86701c3610822fde1
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5oVDZB6xGyv1T5aqbKv4a:MkC01N2c6AGDDUD0/1U5aqbU
TLSH
T14CA1F872582D9C7788B2C949B5522F43DEB8612BF922AF94E6ED5B0C11B70FC1381917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 2ef98fee7ea310004d68f786535f612ad06ad11924a690abb28a3feb02145875
MD5 504a3362d23ba0043c299391013513f4
SHA1 c699fa0159ad7caf86ee5a1ca4cb442728d82df2
SHA512 8a912d2b7ee0d3974de0c9f5b03bc9245e9fcaa0c3569b1c0d973ae6dfa94af7eeae371556d482a2e9b8f61d96e5178e75dc38df8f553610960dbfc1d5fe70b4
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5oVDZB6xGyv1U5xUqbKW4a:MkC01N2c6AGDDUD0/1T5iqb7
TLSH
T1B2A10932582D9C7788B2C949B5522F43DEB8A12BF922AF94E6ED5B0C11B70FC1381917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe85d0dd848cfe827056d1eadaed9981b652c485cb4532487f20098aa24cad65
MD5 ab72f473efcd7cef2882baa80351277b
SHA1 f66dd38831750e8881ff95fd5053407bd63d5ced
SHA512 ca8496778b957d401fcdd21e101f16fea0cf4c5c76a324baeb5150617c4430213ebf3be50ac9e9f065bc884d3b476559eb5de392eb4887dff4ad7965e6181f0e
TLSH
T1FAD08070B7286847D5551931D422CB417A57542365BAD50251A0410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0822343c-5608-4107-a010-3a21c4683408\index-dir\the-real-index
Size 2KB
SHA256 de6edb8cb0b34d550276fe9716547fccb27ce2ea9f536e0f686e3abf42b34e83
MD5 7ae0830c0a15ed96701e68f27f622473
SHA1 027f7618817df3dfda0b5221470c7031a9752ff4
SHA512 b9dfbae861497f9b7ed64c4988f9b26c285bb9fdda9a1b28ade34b13d308f9703b4fa6b90d72b385a87ca7fa72cf9baa1e2fe00fb52f9a6bba9ccab085f87780
TLSH
T17441941B8CD1994BDDAA28722A7A119D373580EE4349EA4B941CB4347C823391B69105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0822343c-5608-4107-a010-3a21c4683408\index-dir\the-real-index
Size 1KB
SHA256 e096c5f4f54532bfddc990ff47dc9cac975a9d4580dfd673db07ca4a8f90b17b
MD5 969f920bd3b63515917c0eed4d16067e
SHA1 18c79d7f6019eb307976d071c4fd91e3b9e1dc9b
SHA512 fea3f2ae1810ecd4b3f1d62cafd7027a8b9c76f9a22951f08851d155a484776c6577673482cbabe0f09d82d39a0f35f750d1730e72b9a84f6553507654ffd3c2
TLSH
T10E31B457CCC2A84BEC7668B22239219E3B3D91DD0255DE4B402C70387D8A3380A96209
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a786d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0822343c-5608-4107-a010-3a21c4683408\index-dir\the-real-index~RFe5a786d.TMP
Size 1KB
SHA256 e1cb24397ab1be95a7a9ce055ae09ed2dfa9a6a28c2d753140e2c982178fa137
MD5 0c504f072c522ade43b9c7bfb2908592
SHA1 386d07bbab85c044d89912e6978cd98700ccc8ba
SHA512 94be0bb9588e059f7c5cf1974a23d4c9f631f4c1c3bfc195ca7f6ea85df07f00021c88886d878205657e270fd05fb13f15494faeb5942e29e8208a214fc1cb6f
TLSH
T1BD3193238081EE1BD83910B1625D009E733FE4741396DB4B506EE8387C927385EE4995
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a9b18.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0822343c-5608-4107-a010-3a21c4683408\index-dir\the-real-index~RFe5a9b18.TMP
Size 2KB
SHA256 8c278a3c7200060ef152aa7853ca096a0281260588fc8f7a89d7f187265852f9
MD5 cdadc45649b05091816cb1ac02a34652
SHA1 ec09b7b9341fc58cc6aa9e7d172f5d593d29568e
SHA512 b1c307a7fe492651a169a0894676486464eb980f97231cf707f9db07e847b38317107d3adfe2140941a0482a3f5ab07c5b01bde69c7c580244b363c4f5f13ffc
TLSH
T1FA4195178591EE37DDB900B266AA005E333BE0725355FB1FA11DE8383C933382AA8915
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f876c07185fff4520786990efc6f8e0b04ce22057db8122caa8dbe632e436ac0
MD5 dd057616b4d29993155dbc986cedc2b5
SHA1 b5e414699957bdb7f214c3930bedf602ff7d2e60
SHA512 54d63289831313449d7878ad2ef257b3771b755e1989d188647316aec5749df36e4be9e87661fbace23dd6e50ffeb276d3dbd0e1e3dd6595dd7501cedf35b020
SSDEEP 384:n3iF1tNn/s3n9Sn8Ngo8TUNTUlIRiPvuTuPREqfbzGYrUCzVSxLROObjI9G6w70S:yF1j+9SXowgUuYXGoFzVStR29M0S
TLSH
T1A8C25B32DC55CEB7EDE64FD8B74A3A56EEE0126785DC5AC4DAC85E4C00C729D430781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookieextract.ps1

Path C:\Users\Admin\AppData\Local\Temp\CookieExtractor_fe3195bc\cookieextract.ps1
Size 9KB
SHA256 7d1c93f66ce2582570e64695da5ed92fba44f6a916efda4a417478ca7952c2fb
MD5 efb5f106eee5ab6f38797adb2de2f822
SHA1 cfc7a8c241c7f37faabe27084a30c629317d3f71
SHA512 0cbced89acf86c82f58fba9a1aeaccd611f8136c6e03e64ca868c6f3523ffb42c6af9a74345d03c5255706d1ee35844ebb61631fea8ffac42649dc087a2fa712
SSDEEP 192:uEQ3KqHzxZS6dHBdN6UyrpCcANLLtSa8Yr8+nlisBssqPjxX92:hEHDS6d/oUyru8YUsBRqPjxX92
TLSH
T1AB129319790D911D56F3A7B67681A406FB06102F129D4C0478ED96E81FB0A8BCEE8F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RunIt.exe

Path C:\Users\Admin\AppData\Local\Temp\RunIt.exe
Size 143KB
SHA256 9770561d2a27dbc16c230fe88af51f718d7d6274fcd63a3f109c381be848b4a9
MD5 d067619856f7f3079375960f62b99369
SHA1 964d548557dec3aa8e851526b71adca4b4ddbfd5
SHA512 1ec891082ac133833217ce8314f6d163451c5554b789cbf8a5ff0d5ebd0b55a7ec49ea5c408bf784e6952a37526de9e77e6c39b9a4ea3b950c3fda44e7f973b8
SSDEEP 3072:iRjfP1ppKWaZK0fr1klb4lrpTP/NaLz+pMuWDxCcfguuy8:GjP/MWafrhrpTP/NaLz+pMuWFCuKy
TLSH
T1D2E35B387E87AE93C3094FF39A83A122873990917D5BD683FCD20FDE1A46BD500696D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ahC2p0sVNkxGSe7a.exe

Path C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe
Size 10.7MB
SHA256 9e682875b5c9c2ee3e13713d136bba9d54f2446ed6d734c33877ae02c9187f79
MD5 819cfca487cdec8f921a475c8afe8b60
SHA1 42573be23c233fdcd6aa06a007e07497649a8218
SHA512 a101b3a14c8e5faca2c7bba6cd531055e4ded42125f2398b4df96c8274f10f4f07fa34b593ca720bb5288c827d23852dd4e881bc9b12bab7af75155df17711f9
SSDEEP 49152:SOdpj5ULc3g4k2vX9OLQTM+acHEGSEGGVjb03xFKj0ia+CtbQuIrYIvVhARgzD1n:
TLSH
T1E1B6382439FA501AB173EFAA8BE479EADA6FB7733B07645D105003864723981DEC153E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9d6b5e5-e519-442d-9f49-000468eced6a.tmp

Path C:\Users\Admin\AppData\Local\Temp\b9d6b5e5-e519-442d-9f49-000468eced6a.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bhvF6AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\bhvF6AB.tmp
Size 14.0MB
SHA256 d8a458a97dd6c59d77dc110dd0158bf370de6b19e09b50dd82926b43c3031921
MD5 6c65f023eca61f8f7289f4c5fde0a94a
SHA1 94580ee8540e252da4a80dde8a563d80774add08
SHA512 950bb65223a17c8ae096265a46c5e539a26a29a554b13c2ffa065c5eade7319f8c1c3ed21f8a567865e7a6aad3eb1eb827271718f59c42aa17ac115560ca9944
SSDEEP 3072:ZblS+MCHDvOHpFpmAtJp/NBBy40ACSh0c7M0/PppvblS+MCHDvOHpFCsp1FCy5ds:BLCLAA6L2LKAFAagLzoKCoPtPWEgr
TLSH
T197E618CF46D70A03FB225A30B0F297522B77D9D11346879669B8F4A75F4A393BB12309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5460_115930767\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

icon_128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6740_516696387\CRX_INSTALL\images\icon_128.png
Size 3KB
SHA256 4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4
MD5 30899b6c4e4a757b8ec6dd2208acdfb4
SHA1 f2c5880a724c6d75cce1b5191e0d82c3bc7de768
SHA512 58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee
TLSH
T1B3617D3A733F1E1EA655403843096A51F0C1A62454A9C0C56BE3FCF90D02E086C29B28
MD5 SHA1 SHA512 TLSH

Submit Download

icon_16.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6740_516696387\CRX_INSTALL\images\icon_16.png
Size 531B
SHA256 0a4bd08db6422f8e7a8a218ef39c1b99a5a675f12697f26be88f9afc2e1f9378
MD5 344554d96e418120bd80ef5de5194697
SHA1 23e141c3a6ce368acc1c299f062ab85914bcb17e
SHA512 7ae38853e5acca479d7fd81d48bb88c671cf4dce63342209bcff045ac581a04b7b0ed48f6c58253db950935c0522caaa4fbc6cf5a25151a8960ba56fc804569e
TLSH
T171F075CE17705C76514D0763D5E535B278614AC642C76AA1500F1A54793BC1D8DC13B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6740_516696387\CRX_INSTALL\manifest.json
Size 1KB
SHA256 49d9de983f7436ba786e6e04a5a20c10f41687ae06b266b1b6553f696719563d
MD5 6ca25f3ef585b63f01bcdf8635120704
SHA1 00c063811e31ea5f9a00f175a71ea25e7821f621
SHA512 566bfd9badbd8951ee52e5911eb68b51e86286989096d32de6e32a2523761b0e0afca251ef3bea36b5d51fb8354a5fca567772a02c3f3b9d8dfe529609fa0430
TLSH
T1CA118CD3A458C9732280D6D468A8B30BF372154F8C95BDDA777D000C5F8D4EB027A2AC
MD5 SHA1 SHA512 TLSH

Submit Download

AlternativeEdgeCookies-output_20260802133053.txt

Path C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20260802133053.txt
Size 6KB
SHA256 84d49d0fe608383f99bcec85ab038ca9e1066f7e36598faba7ef4a8344042691
MD5 869b3c7e0cb2162ee8890622e2280d8d
SHA1 ecc335969f412264ad514e136f85dc9c2a7db975
SHA512 6f9bf6a5c96c7f5e539fd2a486051363dc0d6373f44953ef7f2b1dde924adb6c9e225f3c0679deb19caeaca04ed8fcd167bda3360d48b5131e88fb1e090576bc
SSDEEP 192:AXIGf4siXIGfagiXDfliXDfoMiXDfU+IlOZ+ZNm:ABfxiBfdiTfliTfDiTfUN+eNm
TLSH
T1E4D1392B05E40449A1B7B157DAB340BA9733386A85BD800C71EDD3DA07E78046BCB7EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bookmarks-output_20260802133053.txt

Path C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260802133053.txt
Size 4KB
SHA256 3b7f04a9619bc8fba3bf0845eea181106d91a435702d4ba2ac6f32fe1dfedcef
MD5 68ef2afc51a6ffa79c4322783306c612
SHA1 dfba0744b70e4374342a559ab9ad83566308e8a6
SHA512 b7f63e905c63b262843cbc19fc06120954cc35149e421cf3141ae2c13ee03717b33b2d2f7591724714e06a971ecae6ceae76d1fe000959b9d76256601d63f9ff
SSDEEP 96:eV9Yx+HcmnT6cQYGTVPYx++EcD4V2YxetMcFAVkYx3/cm:eV9Yxka7YGTVPYx+nfV2YxF5VkYxvz
TLSH
T1DDA1C6531BF90144F2F7AA66EAB610767737794A5D39840C22DCA2CA07F3924C6D3B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChromeV20-output_20260802133052.txt

Path C:\Users\Admin\AppData\Roaming\ChromeV20-output_20260802133052.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

ExtensionsView-output_20260802133053.txt

Path C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260802133053.txt
Size 35KB
SHA256 dbdb9c58ad36cb76edc22b9f6d81b1765f95d962c3e1cebfa9cad9c818272dba
MD5 17432e299b1c7fee5ab83e8c59f942b4
SHA1 99feda11ff7a626d9f099ece376f4cc97882f2ae
SHA512 ebdf510de5aed3ad5da524fcbb1d6ce710b0b70605a634c89bb1bfb9ec348676a42c2bf8cc5c511af483005d833ec36bad79123d868a8010a8a693611e9dec53
SSDEEP 768:mozSzoTzszGzOnTznzczpUUnTzmnazyknuzYnTzaHQr6H10asQc0FcvImqVwOCRu:moW8TwiqnTLAltnTinaZnu0nTeHy6HKi
TLSH
T11CF29D5316FD8108F1F37A52EAB64178677778699878C40C21DC92C90BF3A14A6E37E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstalledApps-output_20260802133053.txt

Path C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260802133053.txt
Size 119KB
SHA256 8d0e41d056bf6a2e866386567e890affe805c8ebcb416be6ae4f539c42823bb6
MD5 d8016668800a4f01829190c82fed0f68
SHA1 9e16f882e7ecbb29750d626a1d0cf08ebe8a954d
SHA512 b20c2d69ed5e8fbbbc4ed7936647657cf2c17423475e343c7970eaaba3bf2fc045292a9d121f28f10a9e79dcb5c83fa827c4b72532709e3fef2418493e409b70
SSDEEP 1536:IyOyoyNyIyyiypynWyNiyvRy9y4Ay0ytydyCyMywy9ym+pyazKn83EIyuyPpyGyT:k3Z
TLSH
T158C315165BF50218F1F3AF85E9F154635E37BCA58D34D68C119942CE0AB3A04E8E3B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductKeys-output_20260802133053.txt

Path C:\Users\Admin\AppData\Roaming\ProductKeys-output_20260802133053.txt
Size 786B
SHA256 d0925c4676db5c517bd13619a659c939d7592d6b8c6385f7682773441b011b67
MD5 bdeabcda1972ea46a4823a40f8fb2321
SHA1 620941729ad216127309fafa27375ecb53750662
SHA512 210c94bf0ca02bc36438490cf8a46c6cc209ae65dfa256dec2bcc34b68f80507c65bb4d5018f71248a8afddcd852c3ca699886bab87fe4c9247f19aea85bc582
TLSH
T14901F6A2E0D94183B0D5517207217AF0FD8D3DC18D92221871DDDADA5B6670EB36804F
MD5 SHA1 SHA512 TLSH

Submit Download

WorkingTasks-output_20260802133053.txt

Path C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20260802133053.txt
Size 14KB
SHA256 2378dd128d5b05a90f443d823b58ae5ad1a702723a21f6fb9b27f33d5e348dcc
MD5 53edf688489e0f360caf282894f11a46
SHA1 e6e30f20175463064b07ea673533231b714e04ba
SHA512 aaad70b8279fd28843315412701eb2b86fb8e5eef98b3fb6815721b8f008dd35d3084f82a092eff243482c3a466284286bfc68bdc62f15982e722ad529c19e33
SSDEEP 384:uH/15iWXZ5w14iWXbw115iWXBJd1tiWXXdE15iWXm5+14iWXVhW1tiWXmR114iWx:uNbXZqIXbWbXBZXXXKbXmQIXVAXXmJIx
TLSH
T1D852241316F95044A2B3BA82EAF6547717B7785A9D7C801D61CC83D80BE3E40D6E3BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watch-output_20260802133053.html

Path C:\Users\Admin\AppData\Roaming\watch-output_20260802133053.html
Size 3KB
SHA256 372ea28f0062fb6842e6f468b6d36bba34d1cab08261f0585a3a603c9cb34b53
MD5 40baedadedfb582b4a4d5802b1e81f13
SHA1 aa764a196619e32179985689ef9ebc172b274a29
SHA512 cd4213b12c87084d5a404bd7fd57f2ddb2dc0e6ce33d7f960b30f8b3ad4fef4a7fb1a30b20b26fbebce88b8ec186c75756b2d2021814f07dbedd782afc08d67f
TLSH
T1E1711E92F1097DBA9CAB11CC4102F86FB7156C9231510EFE2B1FF1CBF681862C6929C6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/940-86-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/940-87-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1168-94-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/1168-95-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/1512-59-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1512-60-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2456-57-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/2456-22-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/2456-23-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/2456-24-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/2456-25-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/2456-26-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/2456-27-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/2520-119-0x0000000005F90000-0x0000000005FDC000-memory.dmp

Download

memory/2520-113-0x0000000005870000-0x0000000005892000-memory.dmp

Download

memory/2520-123-0x0000000007150000-0x00000000071E6000-memory.dmp

Download

memory/2520-124-0x00000000070E0000-0x0000000007102000-memory.dmp

Download

memory/2520-1073-0x0000000008E60000-0x000000000938C000-memory.dmp

Download

memory/2520-1064-0x0000000008000000-0x00000000081C2000-memory.dmp

Download

memory/2520-121-0x0000000007730000-0x0000000007DAC000-memory.dmp

Download

memory/2520-112-0x00000000051F0000-0x000000000583A000-memory.dmp

Download

memory/2520-122-0x0000000006480000-0x000000000649A000-memory.dmp

Download

memory/2520-111-0x0000000002690000-0x00000000026C6000-memory.dmp

Download

memory/2520-118-0x0000000005B50000-0x0000000005B6E000-memory.dmp

Download

memory/2520-117-0x0000000005BC0000-0x0000000005F1B000-memory.dmp

Download

memory/2520-114-0x0000000005910000-0x0000000005976000-memory.dmp

Download

memory/2744-45-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2744-46-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3056-69-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/3056-68-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/3428-50-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/3428-0-0x00007FF85487F000-0x00007FF854880000-memory.dmp

Download

memory/3428-9-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/3428-2-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/3428-1-0x0000000000D80000-0x00000000015EA000-memory.dmp

Download

memory/3428-10-0x000000001FCB0000-0x0000000020792000-memory.dmp

Download

memory/3428-7-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/3428-6-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/3428-8-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/3428-3-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/3428-4-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/3428-5-0x00007FF8546F0000-0x00007FF855094000-memory.dmp

Download

memory/4692-52-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4692-53-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4732-64-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4732-65-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/4740-78-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4740-79-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4872-44-0x00000000063C0000-0x00000000063CA000-memory.dmp

Download

memory/4872-40-0x00000000039F0000-0x0000000003A56000-memory.dmp

Download

memory/4872-36-0x00000000009D0000-0x000000000148E000-memory.dmp

Download

memory/4872-1330-0x0000000006E40000-0x0000000006E52000-memory.dmp

Download

memory/5064-82-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/5064-83-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/5400-41-0x0000000005850000-0x000000000585A000-memory.dmp

Download

memory/5400-39-0x0000000005990000-0x0000000005A2C000-memory.dmp

Download

memory/5400-38-0x00000000058C0000-0x0000000005952000-memory.dmp

Download

memory/5400-35-0x00000000002C0000-0x00000000002EA000-memory.dmp

Download

memory/5400-37-0x0000000005F50000-0x000000000650A000-memory.dmp

Download

memory/5968-74-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5968-75-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/6364-43-0x0000000000A60000-0x0000000000A8A000-memory.dmp

Download

memory/6936-99-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/6936-98-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/6984-54-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/6984-55-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/7056-90-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/7056-91-0x0000000000400000-0x0000000000455000-memory.dmp

Download