quasar | 4518753aea43be0fa3d6755f531d569a209b715616c076880b7cdd026eebf3d1

Analysis

user interaction
yes
max time kernel
599s
max time network
603s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-2.exe
Size 2.6MB
Sample260809-tf2q9shn7y
SHA256 4518753aea43be0fa3d6755f531d569a209b715616c076880b7cdd026eebf3d1
MD5 cc0f500f61bf89b2f8caf01a9243d9fa
SHA1 9b68c9f9977605b1bdb994ba2f6a6001d806b1a6
SHA512 f3cca742b5fd8e8c59df4d868cd4e8364fd68b1acfc8ba27575da693f235bc3506664d7eba38168df0877458a35da26c35029f995595e0847f2cc098a1ae6602
SSDEEP 49152:8Pu6NLPxi8/N+ZZXZQOLHM7wRPirm2NnPTKKm77LrwCB6uan/w:Mu6tpi8VIxpL7oZNn2Km77LrwkFW/
TLSH
T1D5C5F1107BFA8119F3BF1BB8ABB6544D1B77B903AA39D39F184840990FA33509E51763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 defense_evasion discovery execution quasar persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

1.6.6

Botnet

Office04

c6qitux5e.localto.net:2164

Mutex

b37c4cbf-68f4-4e7c-92ba-ac265729eb51

Attributes

encryption_key
7799F230382DEC15CFC54F1D560B5A8B875621D2
install_name
.exe
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/1152-1-0x000001E0634B0000-0x000001E06374E000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4276	powershell.exe
3016	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5784	Stager.exe
4772	FileCool.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
8	api.ipify.org
29	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png"	Client-2.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_193023401\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_193023401\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_61005872\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_1173834576\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_244_307964134\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_193023401\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_845422094\_locales\az\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
896	cmd.exe
2404	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3664	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5148	chrome.exe
2328	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
960	taskkill.exe
776	taskkill.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307650802905562"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{85941983-9FA5-4416-8FFF-B5DA88477870}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1152	Client-2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
1224	chrome.exe
1224	chrome.exe
5504	chrome.exe
5504	chrome.exe
5504	chrome.exe
5504	chrome.exe
4772	msedge.exe
4772	msedge.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
3016	powershell.exe
3016	powershell.exe
3016	powershell.exe
5784	Stager.exe
5784	Stager.exe
5488	svchost.exe
5488	svchost.exe
3900	svchost.exe
3900	svchost.exe
2732	svchost.exe
2732	svchost.exe
2140	svchost.exe
2140	svchost.exe
1320	svchost.exe
1320	svchost.exe
1320	svchost.exe
1320	svchost.exe
2732	svchost.exe
2732	svchost.exe
3900	svchost.exe
3900	svchost.exe
5488	svchost.exe
5488	svchost.exe
5488	svchost.exe
5488	svchost.exe
3900	svchost.exe
3900	svchost.exe
2732	svchost.exe
2732	svchost.exe
1320	svchost.exe
1320	svchost.exe
1320	svchost.exe
2732	svchost.exe
1320	svchost.exe
3900	svchost.exe
2732	svchost.exe
3900	svchost.exe
5488	svchost.exe
5488	svchost.exe
5488	svchost.exe
5488	svchost.exe
3900	svchost.exe
2732	svchost.exe
3900	svchost.exe
2732	svchost.exe
1320	svchost.exe
1320	svchost.exe
1320	svchost.exe
2732	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1152	Client-2.exe
1452	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	Client-2.exe
Token: SeDebugPrivilege	960	taskkill.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeCreatePagefilePrivilege	3040	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
244	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4112	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4520	1152	Client-2.exe	90
PID 1152 wrote to memory of 4548	1152	Client-2.exe	91
PID 4520 wrote to memory of 2404	4520	Conhost.exe	92
PID 2404 wrote to memory of 960	2404	cmd.exe	93
PID 4112 wrote to memory of 3040	4112	explorer.exe	96
PID 3040 wrote to memory of 5504	3040	chrome.exe	97
PID 3040 wrote to memory of 5148	3040	chrome.exe	98
PID 3040 wrote to memory of 3372	3040	chrome.exe	99
PID 3040 wrote to memory of 248	3040	chrome.exe	100
PID 3040 wrote to memory of 3372	3040	chrome.exe	99
PID 3040 wrote to memory of 248	3040	chrome.exe	100
PID 3040 wrote to memory of 3196	3040	chrome.exe	102
PID 3040 wrote to memory of 3196	3040	chrome.exe	102
PID 3040 wrote to memory of 5312	3040	chrome.exe	103
PID 3040 wrote to memory of 5312	3040	chrome.exe	103
PID 3040 wrote to memory of 5976	3040	chrome.exe	104
PID 3040 wrote to memory of 5976	3040	chrome.exe	104
PID 3040 wrote to memory of 2892	3040	chrome.exe	105
PID 3040 wrote to memory of 2892	3040	chrome.exe	105
PID 3040 wrote to memory of 4792	3040	chrome.exe	106
PID 3040 wrote to memory of 2148	3040	chrome.exe	107
PID 3040 wrote to memory of 1364	3040	chrome.exe	108
PID 3040 wrote to memory of 2148	3040	chrome.exe	107
PID 3040 wrote to memory of 1364	3040	chrome.exe	108
PID 3040 wrote to memory of 3052	3040	chrome.exe	111
PID 3040 wrote to memory of 6020	3040	chrome.exe	112
PID 3040 wrote to memory of 3052	3040	chrome.exe	111
PID 3040 wrote to memory of 6020	3040	chrome.exe	112
PID 3040 wrote to memory of 4724	3040	chrome.exe	113
PID 3040 wrote to memory of 4724	3040	chrome.exe	113
PID 3040 wrote to memory of 1796	3040	chrome.exe	114
PID 3040 wrote to memory of 1796	3040	chrome.exe	114
PID 3040 wrote to memory of 472	3040	chrome.exe	115
PID 3040 wrote to memory of 472	3040	chrome.exe	115
PID 3040 wrote to memory of 4248	3040	chrome.exe	116
PID 3040 wrote to memory of 4248	3040	chrome.exe	116
PID 3040 wrote to memory of 2856	3040	chrome.exe	117
PID 3040 wrote to memory of 2856	3040	chrome.exe	117
PID 3040 wrote to memory of 1904	3040	chrome.exe	118
PID 3040 wrote to memory of 1904	3040	chrome.exe	118
PID 3040 wrote to memory of 1240	3040	chrome.exe	119
PID 3040 wrote to memory of 1240	3040	chrome.exe	119
PID 3040 wrote to memory of 1548	3040	chrome.exe	120
PID 3040 wrote to memory of 3360	3040	chrome.exe	121
PID 3040 wrote to memory of 1548	3040	chrome.exe	120
PID 3040 wrote to memory of 3360	3040	chrome.exe	121
PID 3040 wrote to memory of 5200	3040	chrome.exe	122
PID 3040 wrote to memory of 1572	3040	chrome.exe	123
PID 3040 wrote to memory of 2420	3040	chrome.exe	124
PID 1152 wrote to memory of 2500	1152	Client-2.exe	125
PID 2500 wrote to memory of 896	2500	Conhost.exe	126
PID 896 wrote to memory of 776	896	cmd.exe	127
PID 1152 wrote to memory of 244	1152	Client-2.exe	128
PID 244 wrote to memory of 1980	244	msedge.exe	129
PID 244 wrote to memory of 5432	244	msedge.exe	131
PID 244 wrote to memory of 2328	244	msedge.exe	130
PID 244 wrote to memory of 5432	244	msedge.exe	131
PID 244 wrote to memory of 5432	244	msedge.exe	131
PID 244 wrote to memory of 2708	244	msedge.exe	134
PID 244 wrote to memory of 2708	244	msedge.exe	134
PID 244 wrote to memory of 4940	244	msedge.exe	135
PID 244 wrote to memory of 2708	244	msedge.exe	134
PID 244 wrote to memory of 4940	244	msedge.exe	135
PID 244 wrote to memory of 4940	244	msedge.exe	135

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:744
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:972
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1184

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:964

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d5f9f91f-a1d9-46d6-8dfa-8236b112b62c -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b00c3be8-5a52-47e1-86d9-4778342e1f38 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8218872c-966a-43eb-97fa-06026ba5c816 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-cce88671-4c5e-43ff-be81-ac7781e82410 -LifetimeId:5dec822e-2fe3-44d5-a35c-07aabe25d6b3 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1928
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5144
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Client-2.exe
      "C:\Users\Admin\AppData\Local\Temp\Client-2.exe"
      4⤵
      Sets desktop wallpaper using registry
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\Windows\SYSTEM32\Conhost.exe
        
        Conhost --headless cmd.exe /c taskkill /IM chrome.exe /F
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4520
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c taskkill /IM chrome.exe /F
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM chrome.exe /F
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:960
    - - C:\Windows\explorer.exe
        
        explorer C:\Program Files\Google\Chrome\Application\chrome.exe
        5⤵
        
        PID:4548
    - - C:\Windows\SYSTEM32\Conhost.exe
        
        Conhost --headless cmd.exe /c taskkill /IM msedge.exe /F
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2500
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c taskkill /IM msedge.exe /F
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:896
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM msedge.exe /F
        7⤵
        Kills process with taskkill
        
        PID:776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:244
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x348,0x7ffddf60c188,0x7ffddf60c194,0x7ffddf60c1a0
        6⤵
        
        PID:1980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,2111454546865938930,4252265445411744450,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:2328
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,21717680718365491,11438146977131714544,262144 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
        6⤵
        
        PID:5432
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,10300222364821713023,10238684272806611882,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:13
        6⤵
        
        PID:4960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,2185695815200290878,13931463507191569350,2097152 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        6⤵
        
        PID:2708
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,11068168111738333101,17404947528949434732,2097152 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
        6⤵
        
        PID:4940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,6540520143749899206,16488428753990121898,2097152 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
        6⤵
        
        PID:5352
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,1339493222792692837,3974829596488171004,2097152 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
        6⤵
        
        PID:4880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,7111863799169272598,2591359340529236236,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
        6⤵
        
        PID:5968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,3792383160881585297,11956485652501377733,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
        6⤵
        
        PID:472
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,6111390141334118521,8869491437032881711,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
        6⤵
        
        PID:1832
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,3107285504486681399,6138468266647783828,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
        6⤵
        
        PID:1772
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,3107285504486681399,6138468266647783828,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
        6⤵
        
        PID:4856
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,5407262065208764626,5934854476703069048,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
        6⤵
        
        PID:4672
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,15031018994462339291,10095482164264982755,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
        6⤵
        
        PID:5436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,7576767806497427728,2481415980579099824,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
        6⤵
        
        PID:1144
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,1505565951287094580,4163944173103094582,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
        6⤵
        
        PID:620
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,16803977830312069530,2568996775665814712,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
        6⤵
        
        PID:2664
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,14217651696842957021,16041252932151845988,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
        6⤵
        
        PID:6044
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,14004215624593309895,5374411286163212983,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
        6⤵
        
        PID:3468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,15733785402755254683,11395743109893866730,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
        6⤵
        
        PID:1044
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,12019649257396463535,15581470676343968499,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
        6⤵
        
        PID:4732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,4973904322210038331,14456440797227872518,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
        6⤵
        
        PID:5004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,15461942414412891187,1769194786038899225,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
        6⤵
        
        PID:5908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6232,i,7005954913176863931,15425108349834770249,262144 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:10
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4772
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,4698772854795350107,9948395240554874902,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
        6⤵
        
        PID:1224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,7792167761499528674,2821121024239958141,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:14
        6⤵
        
        PID:4176
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,2239543090269549779,6893805487677097858,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
        6⤵
        
        PID:628
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,10159184496948469292,14116264343905809947,524288 --field-trial-handle=2184,i,1252295279906311934,16526684157188379234,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:14
        6⤵
        
        PID:1352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -c Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3hsimgeh.ny0
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -c Add-MpPreference -ExclusionProcess Stager.exe
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\3hsimgeh.ny0\Stager.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3hsimgeh.ny0\Stager.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\FileCool.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FileCool.exe"
        5⤵
        Executes dropped EXE
        
        PID:4772
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4236
    - - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3664
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2632
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  PID:5100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2976

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3220

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:920

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4680

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4756

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5152

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2184

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2596

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdf819c728,0x7ffdf819c734,0x7ffdf819c740
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1440,i,16515600855597332016,17760165212271626912,524288 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,16503730231736059979,8872306894736694560,262144 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:3372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,7589180356226159732,7350894353947572296,524288 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:13
    3⤵
    PID:248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,7238783021682985190,16270483408650045772,2097152 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,12513133077990457139,9676513709925450320,2097152 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:5312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,1792641042595557615,677546221445848724,2097152 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
    3⤵
    PID:5976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4736,i,3884767638317628027,13632278255128047672,524288 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
    3⤵
    PID:2892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,14601180994100440556,5872884246205595047,524288 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:4792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5432,i,13189649341814216881,12097634458345284145,2097152 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:2148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5464,i,575352036904696498,12164812621503215818,2097152 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:1364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5496,i,12552230593432901434,613610320261344219,2097152 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:3052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,17836620552582694895,454715686247275839,524288 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:6020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5916,i,2496416614558385542,5845691558965150389,2097152 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
    3⤵
    PID:4724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6044,i,9414344798578410581,10761382410724596961,2097152 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:1796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5636,i,3302980520644669765,5778137577847721613,2097152 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
    3⤵
    PID:472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5692,i,9889853094347593879,11811121095779780950,2097152 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
    3⤵
    PID:4248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5948,i,14619053569672950718,5357113975477383009,2097152 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
    3⤵
    PID:2856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6560,i,4323801640713727565,8600629204194490959,524288 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:1904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,13303561089773785427,9058986218040007849,524288 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:1240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5344,i,4665240743604928856,4360998432123531744,2097152 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:9
    3⤵
    PID:1548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5448,i,6326395078011358061,167931464341374526,2097152 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
    3⤵
    PID:3360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,1824925466378285007,9307130391230672858,524288 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
    3⤵
    PID:5200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6740,i,13011894315477286881,2743751681713958240,524288 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:1572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6640,i,3006837783429260505,9273960822265731581,524288 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:2420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5436,i,1845505261189588069,10026902688122153761,262144 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,5831531769928555368,4817169480747709558,524288 --field-trial-handle=2088,i,11665780862478841553,5768378899849248903,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:14
    3⤵
    PID:5996

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:2688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1288

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:6124

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 b3640a0fbf727ccded0f13bf4bcf638b7a59787e97d9362d58aa539c96c2744e
MD5 90bda241bdd991a97d7632319488b19a
SHA1 761d8712c3d94e88c0463a0514d66aeb5f098cc2
SHA512 07f28b8ae4d46f7ae6898c4ed39fa8771b56057e38afcaa6afadbf9151891727d4c6e39afab833a7d9ea0a1c430082f7197a753a6c455327000441403ca50d2a
MD5 SHA1 SHA512

Submit Download

0be5d301-4cc0-43d8-afa2-370e32f46e98.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0be5d301-4cc0-43d8-afa2-370e32f46e98.tmp
Size 11KB
SHA256 42a236566a5d7b4a83109d5329815d5462000b5e2274376abc78d9dac41a5cef
MD5 c796058d0164f3f465c897cd39666298
SHA1 c0c02f48c1c8f7f51bb1a02a3f4c65c220ebf761
SHA512 e400e2aba8a7740e6ce66d9f05678d882508d1f1afd1e96df2967396b51bd7fc3ca6b5103f419214675b7c5c9a1d163a48a0d930388d7d5f720b87dd9aadf53f
SSDEEP 192:YRoFCLRv7hAPRp2l98Hsb+WNny50VM07kw5x8VyIsnAUge:YRoFGBAXauwc0Vl77Ye
TLSH
T10632962EBA547D7B6CCAD22AF9217753E7F5102261D42E84E7FC956C14E79CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 2373a81143d50cb64da3345d60b285f3a0e173f4990a8ac8bf0c63eb88f81cec
MD5 7cc2beb9f9208dfd9823e22c5693765f
SHA1 0f2f40c1222ad45ea0fb5282e140eb0fc195285c
SHA512 f3c8f9e06287f7e4cb1fa205caf34237b58af68730a6ba9784f4d1d51a42d2a59680aa5a9c8c3b72a8318f53c6f68beb535ae3418f8f0a0c9842cc5c85ffcee5
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBQNd5iBRc2+D1Gyhlo8ij:TeW9aw/aHLopFMavU1iBQNH0c90
TLSH
T17A92038E0F307211C4F48772E8C1499A2E7C211C53237ADAAE1454F39D964DBF1055A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 95c4b92fa8bd97188264750eeed15f16b4435a83a02e9fc8be292e40c55593ac
MD5 20840ac0aea91aed6dfbda674e8774d4
SHA1 744e8a6e722851885549ba44bb44a9432918c600
SHA512 495b5d51028e7731b5e8a1bdc7b8ffb2c7c53c4df71bfc5f15a5996027e1cc7fe221d233abe5fd679c0881f344d3c8344d06e42ae602d1a4f04152674fd403d4
TLSH
T1085179B7C3E48A7D851156E4DA21AE1FCD2D0A14021C3C66C9D8AE5B93E28B2D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3f2df6f009a54d029b2ec8d738f176834d1531bddc129d85ef3c7b127db5ebc0
MD5 42a9dbdc0d3ead8d74c326356942d310
SHA1 5c5c424986bdf4f3600de833e38e2f1b77cae61f
SHA512 d7a7a8a656d10a35fa84fae05087481682ddabd78d5c02503f0414b7eb92f03b15c2e56c21b1a10e1f8803e039835adba2fe2f6ddd3b6059d34cbd7ea6aa823a
SSDEEP 192:YRoFCxRv7hAPRp2l98Hsb+WNnx+Ie07kw568VyIsnAUgE:YRoFGBAXauw0IL70YE
TLSH
T14442972EBA147DBB6CCAD229F9217B53E7F5202261D42E84E7FC996C14E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 40eb4b3f84b53f90b980ed4d934c64062eb46095f6d944ca3b4c332d2d7121b1
MD5 a2526c54c1460f782cb89e9e90929aad
SHA1 42c224f1ab1f95a343c1f5f0a33e9859d750c288
SHA512 a46d01ff520f5e2c7077a65f7d46fb62fcfc65d048a38a5584eda1be0f8c687d19b7f70a3f106db8c07c1ace43e0e76efb58074ee1cfca07aa8fbc9942cf80d8
SSDEEP 192:YRoFCZRv7hwPRpal98Hsb+WNnGjg007kw5A8VyIsnAUgE:YRoFyBIXmuwQgd7qYE
TLSH
T1A842966EB9146D7B6CDAD22AF9217B53E3F5202261D02E44E7FC996C14E79CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 2074cb9a831d68f8a39c186c48b3e135edfee21deb234a6fd7318757e744f95a
MD5 c3b9a04de34df8f7d1c5902db1458fbf
SHA1 c5b76ef081d3fd71dcdb5bba93702f0046cee02b
SHA512 c58e1aa80766fd5e0b20d41f1e7bc8f570d3dcde4f2e7a2defe5e095ebf81e4e8b0b30206680c2c11673940ce31b1d864be9cd3306d6207281966f477c4f3b54
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2HfgslN1XODmd+ErU3BPHG8t2rxgF:MKm97KxkXqKf/pUZNCgVLH2HfgsLROqg
TLSH
T1CA52F867684D9A7B0FD8C98CDC276F8BACF601576278092456FB5D0803A5BCF114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 bc93d0241e99bf47df17b4d41bb675528078df25d2eb446dbd93b3b46473a52e
MD5 6c76ef7bdb35ffeb8eb01555b12bf22c
SHA1 ba343fe1aa1aa90462662f20cae1ea114f9a7c4d
SHA512 f3a8fe45ba9692610e4478a9eaa37b7240fa9dbf72a7ad51775b9492b52760717e60e34a6efd00db5ebc13ab43a1c57b752b4dea91e80a00ffbf2f0325e32ce6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 62978766afe21e5a8d20854d563e5b8cdefbe99238a706a5842eb98ee7ec2eef
MD5 0c8871e43d6158167587fddd900f22e9
SHA1 2de5c5e4af34b357462af24d69966bb86e97cda4
SHA512 072cfc2e2c41b241d3fd3c8bbc05cea09cb078baca6efc44945eeebb1e3b5f30aaa97d8d1b3c7925cb1cb23558f805a62230ba238e1bfd1882b54b00a855a538
TLSH
T151A0220000C000C0CC000330AA2000022282BA0F0202030320CA0C80CC0B0C00002000
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 2eff3206e039ae90e6f0674ebe545d8db91b083a15ce44e2bd6e7db1066fe948
MD5 85981a8b249699ad432b42a0ca298f42
SHA1 86d7c526df93d8d25d448c2abcbcd7bff2849313
SHA512 fb69608087698734bf0f63cece0b355c701c72687940364d92b6276fd8e04d861e35ac685c36bedbf27c462309983734b6119bffecaa4803bf7e4e1f6c5d865a
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OQJJPkVum8nX:1nbZeMrv/hGtQJVnX
TLSH
T13DD3864B3A747002EDE59A725CE050BF5E3CB16D8F5595D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 48193990bb31290f5d95062634e212b94744ce328eb9f5a1ab47c11cc470b363
MD5 1ffc66c4038e8488ddd534f2aebb2bb4
SHA1 e309abb7754e8f8dc224129d5abf115bb0a9e1b7
SHA512 f1448a05d4663e21416d440f69fc5a2622f8aa4312a113cf201d2b10dc9f7e593c02632a749600127d59195daca0fd81b87263a1ec6bb6f34048c8115e3cde6c
SSDEEP 3072:k3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8Gk:XX4NwhgqKR4ILo59R57lOYo8B
TLSH
T1A5C312F1E5361BEC6C7A9DEE30142EA1CEE1F18FABDCB505C9917A5A210D49C430993E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 d759dcb9f3efe188a9381f10ce3afa74db3f878fe1d4aeac8984042ca07df1e8
MD5 b2a82f1dff339d93a01d6e65f8168d2b
SHA1 272c278501686a2d5b4b33b60b5bca8169a1378f
SHA512 0f3c54f37ac6d263b74edf1a97b939187d9d88dd111b6609c7ae1d5fcd2d7cbbe01f1bd85c5b1ae2998fc0ddb4bab97c5a7b615030524ffffee76446d254b537
SSDEEP 3072:x3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8Gk:IX4NwhgqKR4ILo59R57lOYo8B
TLSH
T16BC312F0E5361BE86C7A9AFF30142AA1CFF1F18DA6DCB541CAD17969320E498530953E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e1cbafe14c1cd5e05ebeca03c92f3a448e4cb0d9cb88354db11edef9b6f9dcfd
MD5 39f1637d361772ed64784943ad51e723
SHA1 a16e01d56118e2234942905a3b0634fa96f7e656
SHA512 13dff8de4906077b6c270d3f80c76cf43d9c9c60589fb0a9d9d722ad5c08bae973278d4778e45563df34d94f2d9ed0bb6e1954b5d7693c797a802b5b6ceecea3
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5gHDdB6eGyvkon6ob1v4a:MC0HJm5FHuPgXDUDCDW8n6obZ
TLSH
T145A12CB1A4B94CB769B7D345F8833A83DEA4A2276991EF80D9DD1E0C01F31D81342527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 054be2322893203a0000438e777e7b54136e005cd800bc754b7a9dd9a25aa8ed
MD5 796e9687151eff43129a52372613e7a7
SHA1 d9464c7568c7c03921638b7c805fbe270acf4ccf
SHA512 4c68b434a03e52ec1cafc33d25c32184f67f4f58aa15688eb5e719b0a2f260081a82ea8739b31b9798a764aa7cb3ba574ee19569a4bd752386b61e4f7ac9ed43
SSDEEP 3072:A3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8Gk:rX4NwhgqKR4ILo59R57lOYo8B
TLSH
T194C312F0E5361BE85C7ADAFF30142AA1CFF1F18DA6DCA541CAD17969320E898530953E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 7ef615ed242eb800a72617e8648b8c7c29202c4deda58e1bab5d6f3a2ca028c4
MD5 f2788b293bb5bf998e3d4aa746df87d7
SHA1 5a8f61c4d02a6997e277a8ad0ccc4d1ff67ed08f
SHA512 5401c46a67b129aef990b822523370a7143db4947861d7559f32a74a6fde9a7a71f75f28056aad07c836e7d292c8f216374757fcdb90b9ff5c8a61e0598750b0
SSDEEP 3072:A3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8Gk:rX4NwhgqKR4ILo59R57lOYo8B
TLSH
T15AC312F1E5361BEC5C7A9DEF30042EA1CEE1F18FABDCB505C9917A5A210E498430993E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9a39a6a1cbb27e919f4041dcc74b86db2113f3fb64cc475b9545cd40304e18c9
MD5 a66baade69fa5ad6bed69f29c57a8c6d
SHA1 0fd53c4e40b22229efc603f87dc22983b55c486d
SHA512 b6987c94b1abddb4982ea405012cd65769ffb4755875b3adabe36301d59f446f279e35b962e4f2ba8a3562d028744ee8e2362915b311d45ddd9479011cf8594d
TLSH
T11A819A84B3F750ACCFD151B9B767EC0462E140EBA8435B76840E1DBC2C83790E0E15A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e5b6c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5e5b6c.TMP
Size 2KB
SHA256 ec0f4a3803134398ffa5a9ad04c034a5c432bd2aa4276b51829193f43fb456ae
MD5 b0f774d445f83f3fa65583ce6135ff06
SHA1 4d8d4c5e3aab8f3db32afa8438c273e211f3906b
SHA512 17e6f39c54757789e087bf43fb492c8367c67b7a2692a80411f69bedfa318f3fa0b795a89e866b1c6126f0e88892b306eecc0e8844e06d5b71b6a233edaf5965
TLSH
T10941B90CC36F14DCC725847EB3E98569363A92F8C183EEB8A0A065756807760E1F04B0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 28KB
SHA256 faca1d6a0d70858b90f268a7ccfa088d3ecd3bcded8c36241f6a8e9660b3c527
MD5 04406b5ac4c4299d4c2e12e8260f25cc
SHA1 1802515367f7e39b3bf0cc73dbeab599af966151
SHA512 7e10e9e56bc893f160cedb60028cd90e581061b2e292d8afa92857d055b5db4c3cf9b5c8d7dac32b99bf44fd11a5e44fa81e45b94ce7cd416c78f5326f89c180
SSDEEP 192:NDLaTa+Gcv0Ld1ulFkMLcRTnFcbs0qQBNqp44VquAEbC/3tK4cM:hinD0LdMl2MwRTngsIi69kM
TLSH
T140D2F7BFED80070EC1C7A2766AB66C06387128864A03E5FBD1FD6161BD317A3BA37451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1caa79ba3998ec106c76d1c2b63a6aa97dd4e91a7cd17b74e28538de1a15d662
MD5 79cc3b5d177f35330c67bc4e3bb4558e
SHA1 29f1e6fa5a5da5a334ddc205b38fbf77b0350c79
SHA512 5d46731f5adb63e022dc23714a5e7ad4374d8526eafcf1e1b247c93bcf4b5caa615e0191ff6d01599d8b0f0e7e2ce5cd8f7e18c48c5e60ad106217d308be6059
SSDEEP 48:YALlNQOCDnCDYXCDhaVCCjhhnONzsNQzsxzEsOfoKsLC7CnOCKC+s4gmgCIwBCYv:DiOodcaVZjhrPzisGGO51itwBHzUVG0k
TLSH
T12091A9F7C3E5826DDA0195F0AE146F1BCE2D0856436C3C5A89E4AE1BA3B2471E151B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 945041ad19c30946b1dc05cc2b0e55431dac9e86bcade39da35df00cbc03a37e
MD5 59f2b859eb9483c98797fce8d7b29aaf
SHA1 1d6272f77c85d7501e2674804227046359fedc19
SHA512 bedb57958e21d9ce64f83c01a8c7f4dabd778ed636b065adacbf9f200c04083776dcf6f7ca331a4393a50d964404345b4cd121344ebfdcb86c8b85a90ab9f653
SSDEEP 192:sxRjrWRbxT/fdsVHKyGZilKfb5QioD8pJe/g6+WNPA8/YCGluOBGtIgDrlVNJ:sxR3WrT/fdslKywMwQ/5f/Ge/
TLSH
T14352D70669245C3B9CCBE25DFA15BF53E6F9603294D06E58A6FC9A1C04FB7CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4e16ab9188cfdf9bd376a3ac3191673c6bb6ba38d8bca6f921f33319fa319a7f
MD5 efda3fe94ff2b0ad7e3d9513ee3fa69b
SHA1 59e1fe920659ffee0cdae17ad50205073205445e
SHA512 96f526168b5dd7500f0711b72b04fc29286f5c40a6a518da150be1a6d646d54792d70a15d221caf3146d0acb901afc148d4fbbeeda8abba288ee742240ea4651
SSDEEP 192:sxRj6WRbxT/fdsnHKADde5lSTKfb5QioD8pJe/g6+WNPA8/YCzPuOBGtIgVRJ:sxR2WrT/fdsHKAc5liwQ/5f/Ted
TLSH
T1F452C70569285C3B9CC7E259FA19BF53D6F92032A5D06E58E6FC9A1C04EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 de362989468a24981924fb76b11a8e0d67ce44cddeeb07969c2b165acd529bdc
MD5 84bd4d960d402602ec7e124ddf823477
SHA1 333f8f5e0c5e2ef48a19cad7f79d844027c22179
SHA512 937174e8c60448f4c79a38a8f6e30886c8f4d9e11f27bb5788cc49414f25142f1f176a1a2e6d6a108a8d82d50c4afcacfa93b03dede61ffa4b298aa794eeeb24
SSDEEP 192:sxRjrWRbxT/fdsVHKAGZilKfb5QioD8pJe/g6+WNPA8/YCzPuOBGtIgDBlVNJ:sxR3WrT/fdslKAwMwQ/5f/Te5
TLSH
T11D52D7066A245C3B9CCBD25DFA25BF53D6F9603294D06E58A6FC9A1C04FB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7a85647c783a27fff6f464e30c89c02c084327620018fc6bcb5707fb36e08f6d
MD5 035b2bfbb78422cfd7d8eca2dc3965b5
SHA1 bfb2f41a95511dc26b13d886bb9ee54c2007a0ab
SHA512 37a913aff67c026a08e636162f5caacf270201297ee39f430e6e524247416e3e6d6296abcdd7388b0237cfca373b51a4a7803bebc19f25c75f51185124cfd94e
SSDEEP 768:jC+vAN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpQqcTroZu:jC+vA7E7JQWgQ+f4+u1jaWVcgM
TLSH
T153C2FA7B640CCF7F4F800ADDAD197E9B6DA802CB5698CD8047FED41C02C6BEA52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2b8a8971-8ce4-4da7-88ca-5318202bd42c\index-dir\the-real-index
Size 3KB
SHA256 aeb52d8b9456c1a2b11c81e8711a71131d84960d33751c952a892823ddd622fb
MD5 11e3f8214127b4212ea09d24c7f6ed69
SHA1 9a5c42ebb08834e59695162cddda0c970798280d
SHA512 3b28ed04e24eb0210974a426b466fa1eb52d5def5bcef8722f573cd851f1a49ed1bcd6e0ea10355608c534c448375803ea6bf55ab25ba18b9dfcbabd3ebc33f0
TLSH
T17D51F88E4C076F65CD9D24F318F71852733634FEA2854B079A9CEC343CC32291C6A629
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2b8a8971-8ce4-4da7-88ca-5318202bd42c\index-dir\the-real-index
Size 72B
SHA256 9c50a914828bb91b971bf7948c6131820eb90765698c26e47fe6ba579d7a4eb2
MD5 ecdef932c64182ebb051de06c9a9d4f5
SHA1 a0d6e09e1be5e48ea19d827b4af2373ac67b3272
SHA512 e60d7f4495b42175bcd20b8238a79c8c30a06792fadd97c8c7a1d532951fb064322a5266827a96f3c6f3de74e7fdb342b1af9e800c4b4f8735ca36dd8dc4214b
TLSH
T1F3A0022106D5489ACD45557017DB614C2A5248B948208B4360EC5469C8B6144E1A3404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ded12.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2b8a8971-8ce4-4da7-88ca-5318202bd42c\index-dir\the-real-index~RFe5ded12.TMP
Size 72B
SHA256 6c19142923b63aa6556b8323997dade34f8c1c68789ba174d4c3d720fbe2b110
MD5 f4e2e10d8b4512e21384aa4bb8f14fcb
SHA1 b1b4f4ed9936314ace3c412d36e25b3b0e703b65
SHA512 3a5460570773aed962d5ba49347d1b99e0405502a740a42cbdfb75c76e60d49211afd73ae0a0fa4db765a37cc64ab974d4ef8d7a5ae0a6b1f6d71696b4ff3ae5
TLSH
T1C9A0022107D15C92CC45D1B06743938822C28C544010C34B71D85599CCA35406682118
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bbe3f389-cc3d-4371-80c5-2560d882296c\index-dir\the-real-index
Size 72B
SHA256 e1020967ef4be2b4f09f1b8d4b8b59ce5a5c487bdab32f0e75dec6a0e04b2703
MD5 3c0edf5c1d5236c3d32099089778207d
SHA1 1626415888e42ddc7afa09daba20fa5321e627b1
SHA512 aa0eb2f8c99bd751c7685a2e80b47ed2ecfdfb16185d6d66264af0ce646cf2b7a862e8886fc06706bd8c801fdb0ef0d7fd3be8dd2cac78625d3424a10e2149c5
TLSH
T14DA0021007D12527C01E12B116D34261260098A0F300160680A10244CC90570458340C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bbe3f389-cc3d-4371-80c5-2560d882296c\index-dir\the-real-index
Size 72B
SHA256 39ad0900608fb992db972479f64254101d1b8d6ee62abbe88b31bbd61d12449f
MD5 8ae086a7177cb2cadcbc5e9a6b144061
SHA1 856e958e495f5f22b95981a66acdd08da1eea9b0
SHA512 ffc501fddbf07f787fbaf522be25bb111f53249f7401a1d9ba72984d0933edf90374a09468a4fd818cb608ac67abfe12ce3da987275c76c36acdfa44f560e94e
TLSH
T1A3A0022843E09681C08312B065B6C5A232E059154606275F61DC804AC8B05C5499101C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 af9a6bc3ec12cd37dea82a56e3815412f638bf02797313b91ae91480e1860c88
MD5 be8eea9a6f38d6ce20540ae6ff8ad33d
SHA1 dc764be17e9ab3feddacd7d36e5bc94d447b4039
SHA512 e7932dc457661101f9ee056573fa8cae8a93528ba832bc234a05529373e5e9762bd713d36c05ba89814a4cb9c36ece842ccceb561811e92291ae9c1431fb8345
TLSH
T1CAE0C0F73EF72C14EEFB83E6283152A845C2B454C998EC8F206562C740753032066C15
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 02604726080b6fb822f904ecc5a4ea8db88c4fa1d2a20b1e8de154cc8b6582a2
MD5 a4404ca0a85505cce1f3a7710acbab1b
SHA1 3e64bd3a35235d6b0689a74cd64bf8e859165b9b
SHA512 f0d2885c70d2986b2e9e3d80c7113ea3e7198e514e49ae0e442495d7112a2ca5b84ae1342c0f66205fe097712f3b848b7b7e21918e57756eaebdab740f699fcc
TLSH
T101A0026C8F9DD005C8464670156A52697B908C99020613118C9CFCAC8CAF18052C5161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e40a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e40a1.TMP
Size 48B
SHA256 3cb4e7cdaaaa7d4be5aafa4bcdd8670fb780f7dc09a3c64f3f5ab33014484eee
MD5 69c763126a639e7453510330419e148b
SHA1 7e696ea421cd4bf489f2f3eb13be310d46117e43
SHA512 7abf3194c3fe945d60bc65eaa2882fa0877f9a024ba2c57dc8c3745352f8ce7318bd31bd8aafc07eafaf7d570259fccb57a570fead271a5a9ec6b4bb32ad9a6b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 bee5008f550b39bb932d4fbb2ef01f6d39dac6c7bf3e3f5b4657f29f11ca5386
MD5 f1ecffea51d36159b0d0fc74356b75bb
SHA1 807cae4dceeeb29319035fa62d2fe5980bbcd87f
SHA512 c342b150c1e99da40afaa7cf5eb31d7ee42c3cab38057f4ce5725aa1ce4900424a171cc0c8f6f2ac0a3f55995ee581c590d52169168ced72ce3d0090e3457321
SSDEEP 384:DNrRZyCSDnxTICoMEhIKyll7svbFKfk7:xFZJSDni4yI1l7svbF9
TLSH
T10844750A7B747001EDE6D9725CB080771E3CB16E8F22A6D15DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79d703b4-2cb4-4c0c-9f3f-34087ae32389.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\79d703b4-2cb4-4c0c-9f3f-34087ae32389.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 581a76daffa19b460a5de131c2f827a251ec8cd039da777bb56c40c3ef967df7
MD5 474dee3baf4f50b2af206a40a7cceffb
SHA1 5413601ed395fb3525363ce4bc3624ebe6f5202b
SHA512 44c8fea02800b08597aecd34553d519955d847ecec14d42f478f8d1832d6e717ccd4b6b54613628cce9b48d3f029e1c9a4f6eb63e6636fff4e4c3d290780b738
SSDEEP 768:UFQE3Owgwemap8+p3bd66j+4BRv86aLIWI2ewBKZOFWp:3E3a8+p3Z6n4ye2evZGM
TLSH
T1D2039DB2D8A8DE77ACE6D785B74676439EF410B3C9C45DE8D9CCAE09009319E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6c84ce201bbca938d46832362a1fb101bb13a1d64e33b79b8f3f48d527b39691
MD5 ca8133dfd229c2e95c208d4fc24d1470
SHA1 3ac51b14948ca99a53c316ce20870cf58d87cd73
SHA512 09a4edd670e65ddff53c93746a5fe5242a280468bb908dc62038f2b6ed9cdd0adf00fad6d0d4a9ff97a331bc1cb917f3e91389bbbe928f346003db64072ede06
SSDEEP 768:Qc3v5PHpp8+p3bd66j+4BRv86aLIWI2ewBKZOFWp:Qc3RX8+p3Z6n4ye2evZGM
TLSH
T11FF2AEB1E8699D739CEAE645B24677436EF42173A9C01EA8D8DDBB0D005325D2B0BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9f5aa8a44accebf4efd3f37020ed8162d2056c90263dbeafc28e52c8621f08ce
MD5 5a11220d731da96cee1684ce2106aa48
SHA1 2eeec28b1ec538fe583caaa781d7a05f28bcde1a
SHA512 ff9b6ee373f99f24de6d35a0dffe74054df046c826fd470ef085a1c1a0aff1a0a82372f0703b4ab5e2a33e11278af4d58836d2bb57ba6da9a3082ec4922318d1
SSDEEP 768:hc3s5PHpp8+p3bd66j+4BRv86aLIWI2ewBKZOFWp:hc3UX8+p3Z6n4ye2evZGM
TLSH
T1D2F2AFB1E8699D739CEAE745B24673436EF42173A9C01EA8D8DDBB0D005325D270BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 24c7fb810d35d0567e645ee67af0c7af6d7750d7853928218d58fb9de950fb33
MD5 c3c6901294aa33d8602b67b1067523ac
SHA1 e047de18c23216974b02759a963da12f5f16fe11
SHA512 fff509fa5e7e65e2f907783d0f9b47c29e121e9380d6d7e90fea4df2df7b1203b12fbc9eda3a717e60a9353e83db8cdc56047e615da4eecf4bbb71be1ec27675
SSDEEP 768:Lrv+4UNbdD3+5PHRp8+p3bd66j+4BRv86aLIWIoX:Lbsbp3OP8+p3Z6n4yeoX
TLSH
T13F03BE72E8A9DD739CF6D204B24677837FF420A399C01EA4D4D96B4E419719E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e2a19d8bebf9bdca79de1f893231d16f84a94d9e80b99b8f6cef8146ec16db7c
MD5 f55eefd89d6372e5adaa31f289f5d706
SHA1 3384320daeeb319a88cdd580eb1107aa511d5746
SHA512 c88a29f5f7a4d5362024c7ab5685b2c9339ee07ad7c76ee6dcf526dbc0fc247bf193cf0abf8453b73aeb09e47a235bdd4d492bda541a46cba30879cf79823f5d
SSDEEP 768:UFQE3VwgmgmPp8+p3bd66j+4BRv86aLIWI2ewBKZOFWp:3E3q8+p3Z6n4ye2evZGM
TLSH
T1BA039D72D8A8DE77ACE69B85B34676439EF411A3C5C45DE8E9CCAE0D009319E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c101eb4f291d45ebfe1e9b6d1c192dbc7d935b726a572e8235f3c5344093986f
MD5 30dcf5120eca048f3e2d12f0b5060c4f
SHA1 43ce51119cf99c307db2fd0dae585de027725f9e
SHA512 6f530067e0e704f30179ca38497acffc199c3c1c36a97624531c3ae479a3fe9bb18d2685f5f829eafd998d73b2a4a85d0bc40b6702db17f209500be2024518f0
SSDEEP 768:Irv+4UNbdD3qcPZNp8+p3bd66j+4BRv86aLIiS2bwCl1:Ibsbp3vL8+p3Z6n4yE0ww
TLSH
T12B03BE32E9A899739CF6C644B24677437FF851A396C10EC0E4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c9ad4fefefe9cea82b04e1d05bcdcf8bba33bdb4c233b303a1b4417680991b4c
MD5 4569b48e3b3df191cc6422bc67a1559e
SHA1 22a187988b87dcaa199c3e8684d249a5c1677b3e
SHA512 987e6ee7fa8a0143976315e4d77c6833e7e44f3dc6322f2762ff9d5041a838a1aa90ad2cbcb88fbb11cef4a0271e22c2f7a1b88f02467cea97fb93fe7a192d1a
SSDEEP 768:2rv+4UNbdD3WTPHNp8+p3bd66j+4BRv86aLITI2bwCl1:2bsbp3sL8+p3Z6n4yF0ww
TLSH
T17F03BE72E4A9DD339CE6C644B24677837FB821A399C10ED4E9D96B4E005B19E270FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e0b1bf5-316b-4d0c-b86b-9e3879b5421d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2e0b1bf5-316b-4d0c-b86b-9e3879b5421d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5e0221.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5e0221.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b699e97f0868b0b8ae799388aa2d95ea7363a34f2e9cf5a6685ff4d17df64f11
MD5 683c586de389277568abf3b07f6b5a9a
SHA1 9e6659e78a58e5ccfb2dbf5bc9cc8df2ebc2aed2
SHA512 de7dc73a47ed9d41d93b33b4deb4d111c1d75b94e2ba016cb4413f5e0694f57ca1b71045c594acb5aaebbec072f339ec070b6f428840abe4a2560917ba487fd2
TLSH
T1D1216837B3DC8611C89A413A10CDAC1036B6C7DB80DECFAB7B85E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

Stager.exe

Path C:\Users\Admin\AppData\Local\Temp\3hsimgeh.ny0\Stager.exe
Size 156KB
SHA256 8352abee40e1ed386796a8a95d69f19e973dbe98f6a5010c000044b165047abd
MD5 c4a7c43949ddde75916644d5176c3d59
SHA1 e366922b08b6cf61039f741d1ae08b6c0a9e6f77
SHA512 39e310422f306be86b4b8ff708cb309ac6502935b53e86a4c9d5437474fe9a98c005b73b1fb3fe47fc715dfca2ac8e9374648712ca750c94ef0cb88c886517f5
SSDEEP 3072:ATL3BocXZIkvleefCb4Q6dOht2SBnMoj+3BuTtVFPnDnA1yMetzUF:A3B1GsIv6uBMoj+REjp70JSz
TLSH
T12CF3124A6698A4BEED4804FD043A9B13677CF1C9D769070FDCFA8274531B1ED1360A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileCool.exe

Path C:\Users\Admin\AppData\Local\Temp\FileCool.exe
Size 10KB
SHA256 129727c8b611c037f91dee0a1cb076deb7ef12ea749cd14a3c150662778e19fb
MD5 da78393f40632d9d1397b13310a84228
SHA1 91c87a95a9d889cf79a4e1d8e638853c46190ba4
SHA512 e9b02cbb6d7918428b4b456160fa4cf2e7fc53194374d750eb068055ffb034f643fd4677bfadb63a94849cd1e6d99cba87ac6ac6b9f2fd382f4b133726863c7f
SSDEEP 192:DW59wWu581h1tRy60hLJ1wvKIRECkloTf8CoBeBWqsHmGC4KXdQY9Bt:qSWua1KhhLfwCIRBkloTf8CkeB4ZKtQW
TLSH
T1D7220945A3E8C525D8FE1B722CF257100370EB058C27DB6E49E9A0671E67B508B633F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Token.txt

Path C:\Users\Admin\AppData\Local\Temp\Token.txt
Size 131B
SHA256 5c7be3f6973b68d00d2718206d75a36c401f7134e3eb1ca8b110653d6354abd5
MD5 e2254a54b54ba92a51a094bfa8756312
SHA1 42f4e49952df08cae31674b0e6f6f5ce3155d562
SHA512 2ad25f2e065091675d49d798e839cc894481bddb511f932666dbafe948d0d48fb284d68eda0d6a7541d59659807b8c5a12466816b6f3760d229435a8038f130e
TLSH
T142C02BAFF2155FA944F00321822881253B122782437F0250811C00CC0C00134B2BBC92
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_11dizrfn.kry.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_11dizrfn.kry.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a06529b1-5009-4bb1-82ce-23fbfddffdf3.tmp

Path C:\Users\Admin\AppData\Local\Temp\a06529b1-5009-4bb1-82ce-23fbfddffdf3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir244_1315974943\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3040_1599786370\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

wallpaper.png

Path C:\Users\Admin\AppData\Local\Temp\wallpaper.png
Size 12KB
SHA256 2d93f11833a50628feae8971c2c4b6a156b11ad01ef9a3d945979c4ba06863ec
MD5 347d264a2b5f4c2d2e0528278f9693e6
SHA1 88df3d0512c5d65d4b50aaee8d0416cb7caaa150
SHA512 94f0f34d3adacf49e55c71bbe47c5317550bf72153315848ec9c28be3bc737c8c6c74dfd606276441a46d6eb2222fc444216d0f2e27a59d977f2c633dc3782fe
SSDEEP 384:Y7dOwHYoqOBjsG3I5fJ2sfIkgCAJU6YKfccAh9hcPCXA1:wcwHY12jsG3LsfIfCAqtjiCo
TLSH
T15C429E7EFB5D572AA738FB82C0A6C939745AF23C1A12BDC5E08F18040F61B6494366D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TranscodedWallpaper

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
Size 15KB
SHA256 3efdcc48bc7d40c84ea18bc18a0ecf406b019e4c6c8bd5a0552447a3d5343bb4
MD5 e7ae9f2bb10934b115cd771ccd0c09d9
SHA1 841231122d06eb0b2ce5ec2233a11aa0a09f2a4a
SHA512 2aa4fe96f7deafde178d5f82a5dc0e058f36d72283bc9de30902de1f94d1b08df2fc3ae6d0ded1a7045519bc0c31eb12779ef43fb0694e4ce7e910aa6c52a864
SSDEEP 384:yuOZUd3ALV1064KOZyn9jBLMb2A342Ipe5n71i7z3y:yuakALcKOZyXm267j
TLSH
T1A672B07C894787E543C0B809A3D4661990CB32DD3190BFBA66644EDC965ABCB0C6F2D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/744-1977-0x0000025A56270000-0x0000025A5629B000-memory.dmp

Download

memory/744-1987-0x00007FFDCB960000-0x00007FFDCB970000-memory.dmp

Download

memory/744-1986-0x0000025A56270000-0x0000025A5629B000-memory.dmp

Download

memory/744-1985-0x0000025A56270000-0x0000025A5629B000-memory.dmp

Download

memory/744-1984-0x0000025A56270000-0x0000025A5629B000-memory.dmp

Download

memory/744-1983-0x0000025A56270000-0x0000025A5629B000-memory.dmp

Download

memory/744-1982-0x0000025A56270000-0x0000025A5629B000-memory.dmp

Download

memory/744-1976-0x0000025A56270000-0x0000025A5629B000-memory.dmp

Download

memory/964-2044-0x0000020DD31B0000-0x0000020DD31DB000-memory.dmp

Download

memory/964-2047-0x00007FFDCB960000-0x00007FFDCB970000-memory.dmp

Download

memory/964-2037-0x0000020DD31B0000-0x0000020DD31DB000-memory.dmp

Download

memory/964-2042-0x0000020DD31B0000-0x0000020DD31DB000-memory.dmp

Download

memory/964-2043-0x0000020DD31B0000-0x0000020DD31DB000-memory.dmp

Download

memory/964-2045-0x0000020DD31B0000-0x0000020DD31DB000-memory.dmp

Download

memory/964-2046-0x0000020DD31B0000-0x0000020DD31DB000-memory.dmp

Download

memory/972-2051-0x000001D494CF0000-0x000001D494D1B000-memory.dmp

Download

memory/972-2056-0x000001D494CF0000-0x000001D494D1B000-memory.dmp

Download

memory/972-2057-0x000001D494CF0000-0x000001D494D1B000-memory.dmp

Download

memory/972-2058-0x000001D494CF0000-0x000001D494D1B000-memory.dmp

Download

memory/1152-4-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1152-7-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1152-13-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1152-14-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1152-15-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1152-3-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1152-24-0x000001E000050000-0x000001E00009A000-memory.dmp

Download

memory/1152-5-0x000001E063BD0000-0x000001E063BEE000-memory.dmp

Download

memory/1152-23-0x000001E000000000-0x000001E00004C000-memory.dmp

Download

memory/1152-22-0x000001E07DE30000-0x000001E07DE64000-memory.dmp

Download

memory/1152-21-0x000001E07DD50000-0x000001E07DD76000-memory.dmp

Download

memory/1152-3090-0x000001E07ED10000-0x000001E07ED86000-memory.dmp

Download

memory/1152-3089-0x000001E07EEE0000-0x000001E07F0A2000-memory.dmp

Download

memory/1152-26-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1152-25-0x000001E0000A0000-0x000001E0000CA000-memory.dmp

Download

memory/1152-2991-0x000001E07EB90000-0x000001E07EBA2000-memory.dmp

Download

memory/1152-20-0x000001E07DDE0000-0x000001E07DE2E000-memory.dmp

Download

memory/1152-19-0x000001E07DD00000-0x000001E07DD4A000-memory.dmp

Download

memory/1152-18-0x000001E07EC50000-0x000001E07ED02000-memory.dmp

Download

memory/1152-1-0x000001E0634B0000-0x000001E06374E000-memory.dmp

Download

memory/1152-27-0x000001E000250000-0x000001E00025A000-memory.dmp

Download

memory/1152-28-0x000001E000270000-0x000001E000278000-memory.dmp

Download

memory/1152-16-0x000001E07DCC0000-0x000001E07DCFA000-memory.dmp

Download

memory/1152-12-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1152-0-0x00007FFDE8B7F000-0x00007FFDE8B80000-memory.dmp

Download

memory/1152-11-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1152-6-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1152-2-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1152-10-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1152-8-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1152-17-0x000001E07DD90000-0x000001E07DDE0000-memory.dmp

Download

memory/1152-9-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/1320-1968-0x000002624B8E0000-0x000002624B8E9000-memory.dmp

Download

memory/1320-1969-0x000002624B8E0000-0x000002624B8E9000-memory.dmp

Download

memory/1320-1970-0x000002624B8E0000-0x000002624B8E9000-memory.dmp

Download

memory/1320-1931-0x000002624B8E0000-0x000002624B8E9000-memory.dmp

Download

memory/1320-2025-0x000002624B920000-0x000002624B94B000-memory.dmp

Download

memory/1320-1930-0x000002624B8E0000-0x000002624B8E9000-memory.dmp

Download

memory/1320-1925-0x000002624B8D0000-0x000002624B8D5000-memory.dmp

Download

memory/1320-2033-0x000002624B920000-0x000002624B94B000-memory.dmp

Download

memory/1320-2032-0x000002624B920000-0x000002624B94B000-memory.dmp

Download

memory/1320-2031-0x000002624B920000-0x000002624B94B000-memory.dmp

Download

memory/1320-2030-0x000002624B920000-0x000002624B94B000-memory.dmp

Download

memory/2140-1966-0x0000029B08ED0000-0x0000029B08ED9000-memory.dmp

Download

memory/2140-1967-0x0000029B08ED0000-0x0000029B08ED9000-memory.dmp

Download

memory/2140-1965-0x0000029B08ED0000-0x0000029B08ED9000-memory.dmp

Download

memory/2732-1963-0x000001CE1A5E0000-0x000001CE1A5E9000-memory.dmp

Download

memory/2732-1962-0x000001CE1A5E0000-0x000001CE1A5E9000-memory.dmp

Download

memory/2732-1961-0x000001CE1A5E0000-0x000001CE1A5E9000-memory.dmp

Download

memory/2732-2022-0x000001CE1A960000-0x000001CE1A98B000-memory.dmp

Download

memory/2732-2019-0x000001CE1A960000-0x000001CE1A98B000-memory.dmp

Download

memory/2732-2020-0x000001CE1A960000-0x000001CE1A98B000-memory.dmp

Download

memory/2732-2015-0x000001CE1A960000-0x000001CE1A98B000-memory.dmp

Download

memory/2732-2021-0x000001CE1A960000-0x000001CE1A98B000-memory.dmp

Download

memory/3900-2011-0x000002A04C7A0000-0x000002A04C7CB000-memory.dmp

Download

memory/3900-1950-0x00007FFE0B820000-0x00007FFE0BA83000-memory.dmp

Download

memory/3900-1956-0x00007FFE09860000-0x00007FFE09927000-memory.dmp

Download

memory/3900-1951-0x00007FFE092F0000-0x00007FFE09691000-memory.dmp

Download

memory/3900-2010-0x000002A04C7A0000-0x000002A04C7CB000-memory.dmp

Download

memory/3900-1957-0x000002A04AFA0000-0x000002A04AFA9000-memory.dmp

Download

memory/3900-2003-0x000002A04C7A0000-0x000002A04C7CB000-memory.dmp

Download

memory/3900-2008-0x000002A04C7A0000-0x000002A04C7CB000-memory.dmp

Download

memory/3900-2009-0x000002A04C7A0000-0x000002A04C7CB000-memory.dmp

Download

memory/3900-1959-0x000002A04AFA0000-0x000002A04AFA9000-memory.dmp

Download

memory/3900-1958-0x000002A04AFA0000-0x000002A04AFA9000-memory.dmp

Download

memory/4276-1900-0x00000269F7D20000-0x00000269F7D42000-memory.dmp

Download

memory/4276-1903-0x00000269F8080000-0x00000269F809E000-memory.dmp

Download

memory/4276-1904-0x00000269F80A0000-0x00000269F8152000-memory.dmp

Download

memory/4276-1905-0x00000269F7DA0000-0x00000269F7DAA000-memory.dmp

Download

memory/4772-3015-0x0000025A36BE0000-0x0000025A36BE8000-memory.dmp

Download

memory/5488-1954-0x000002407B650000-0x000002407B659000-memory.dmp

Download

memory/5488-1998-0x000002407B690000-0x000002407B6BB000-memory.dmp

Download

memory/5488-2000-0x000002407B690000-0x000002407B6BB000-memory.dmp

Download

memory/5488-1999-0x000002407B690000-0x000002407B6BB000-memory.dmp

Download

memory/5488-1952-0x000002407B650000-0x000002407B659000-memory.dmp

Download

memory/5488-1972-0x000002407B660000-0x000002407B686000-memory.dmp

Download

memory/5488-1992-0x000002407B690000-0x000002407B6BB000-memory.dmp

Download

memory/5488-1997-0x000002407B690000-0x000002407B6BB000-memory.dmp

Download

memory/5488-1953-0x000002407B650000-0x000002407B659000-memory.dmp

Download

memory/5784-1923-0x00007FFE092F0000-0x00007FFE09691000-memory.dmp

Download

memory/5784-1924-0x00007FFE09860000-0x00007FFE09927000-memory.dmp

Download

memory/5784-1922-0x00007FFE0B820000-0x00007FFE0BA83000-memory.dmp

Download

memory/5784-1921-0x000002639E070000-0x000002639E09C000-memory.dmp

Download