milleniumrat | 36d3044a939b82e7456063d74f6f2395dea60ab0f63f04dde9dcc99eca4ba291

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_02975ba0a046872e7b67c60406d74b43_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 2.6MB
Sample260814-2bpj5sshjh
SHA256 36d3044a939b82e7456063d74f6f2395dea60ab0f63f04dde9dcc99eca4ba291
MD5 02975ba0a046872e7b67c60406d74b43
SHA1 f02c1991523e6e79b5933779e14547b55f8babad
SHA512 c67312bc56825e5815d529d8b945b4f577332f18f3aa68d499a324661da18e0ce28e0a61763a5c7150a9f1ccc7a754c2ffc7eb89853cda83c1c556adda576329
SSDEEP 49152:d5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUx9KTnUVz:STrVI4dGOgGpYHC4
TLSH
T1F1D59D62F782D0B2E4D201B156BEABF74D787535537584CBE3C01E6A49206C2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery milleniumrat rat spyware stealer

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3f-0.dat	family_milleniumrat

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3f-0.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3f-0.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3f-0.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3f-0.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3f-0.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox analysis VM names 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3f-0.dat	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3f-0.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Uses browser remote debugging 2 TTPs 19 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3148	chrome.exe
2360	chrome.exe
3868	chrome.exe
4100	msedge.exe
6108	chrome.exe
1828	chrome.exe
2608	msedge.exe
264	msedge.exe
5500	msedge.exe
4092	chrome.exe
5868	chrome.exe
1124	chrome.exe
4396	chrome.exe
4920	chrome.exe
992	chrome.exe
2496	chrome.exe
3680	chrome.exe
4468	chrome.exe
3496	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
1544	svchost.exe
1348	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
1	raw.githubusercontent.com
8	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_02975ba0a046872e7b67c60406d74b43_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4360	msedge.exe
3276	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312198925575055"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1544	svchost.exe
1544	svchost.exe
1348	svchost.exe
1348	svchost.exe
1544	svchost.exe
1544	svchost.exe
1544	svchost.exe
1544	svchost.exe
1544	svchost.exe
1544	svchost.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
1348	svchost.exe
1348	svchost.exe
1544	svchost.exe
1544	svchost.exe
1544	svchost.exe
1544	svchost.exe
1348	svchost.exe
1348	svchost.exe
1544	svchost.exe
1348	svchost.exe
1544	svchost.exe
1348	svchost.exe
1544	svchost.exe
1544	svchost.exe
1348	svchost.exe
1348	svchost.exe
1544	svchost.exe
1544	svchost.exe
1348	svchost.exe
1348	svchost.exe
1544	svchost.exe
1348	svchost.exe
1544	svchost.exe
1348	svchost.exe
1544	svchost.exe
1348	svchost.exe
1348	svchost.exe
1544	svchost.exe
1544	svchost.exe
1348	svchost.exe
1544	svchost.exe
1348	svchost.exe
1544	svchost.exe
1348	svchost.exe
1348	svchost.exe
1544	svchost.exe
1544	svchost.exe
1348	svchost.exe
1544	svchost.exe
1348	svchost.exe
1348	svchost.exe
1544	svchost.exe
1348	svchost.exe
1544	svchost.exe
1544	svchost.exe
1544	svchost.exe
1544	svchost.exe
1544	svchost.exe
1544	svchost.exe
1544	svchost.exe
1348	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	svchost.exe
Token: SeDebugPrivilege	1544	svchost.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeDebugPrivilege	1544	svchost.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3148	chrome.exe
2608	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1348	svchost.exe
1544	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 1544	4688	2026-08-14_02975ba0a046872e7b67c60406d74b43_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe	89
PID 1544 wrote to memory of 3148	1544	svchost.exe	92
PID 3148 wrote to memory of 2296	3148	chrome.exe	93
PID 3148 wrote to memory of 3084	3148	chrome.exe	94
PID 3148 wrote to memory of 3276	3148	chrome.exe	95
PID 3148 wrote to memory of 3084	3148	chrome.exe	94
PID 3148 wrote to memory of 2584	3148	chrome.exe	96
PID 3148 wrote to memory of 2584	3148	chrome.exe	96
PID 3148 wrote to memory of 6108	3148	chrome.exe	99
PID 3148 wrote to memory of 4920	3148	chrome.exe	98
PID 3148 wrote to memory of 6108	3148	chrome.exe	99
PID 3148 wrote to memory of 4920	3148	chrome.exe	98
PID 3148 wrote to memory of 1828	3148	chrome.exe	100
PID 3148 wrote to memory of 1828	3148	chrome.exe	100
PID 3148 wrote to memory of 3120	3148	chrome.exe	101
PID 3148 wrote to memory of 3120	3148	chrome.exe	101
PID 3148 wrote to memory of 4368	3148	chrome.exe	102
PID 3148 wrote to memory of 4092	3148	chrome.exe	103
PID 3148 wrote to memory of 992	3148	chrome.exe	104
PID 3148 wrote to memory of 4092	3148	chrome.exe	103
PID 3148 wrote to memory of 992	3148	chrome.exe	104
PID 3148 wrote to memory of 2360	3148	chrome.exe	106
PID 3148 wrote to memory of 2360	3148	chrome.exe	106
PID 3148 wrote to memory of 2496	3148	chrome.exe	109
PID 3148 wrote to memory of 6056	3148	chrome.exe	110
PID 3148 wrote to memory of 2496	3148	chrome.exe	109
PID 3148 wrote to memory of 3868	3148	chrome.exe	111
PID 3148 wrote to memory of 6056	3148	chrome.exe	110
PID 3148 wrote to memory of 3868	3148	chrome.exe	111
PID 3148 wrote to memory of 5868	3148	chrome.exe	112
PID 3148 wrote to memory of 3680	3148	chrome.exe	113
PID 3148 wrote to memory of 5868	3148	chrome.exe	112
PID 3148 wrote to memory of 3680	3148	chrome.exe	113
PID 3148 wrote to memory of 4468	3148	chrome.exe	115
PID 3148 wrote to memory of 5924	3148	chrome.exe	114
PID 3148 wrote to memory of 4468	3148	chrome.exe	115
PID 3148 wrote to memory of 5924	3148	chrome.exe	114
PID 3148 wrote to memory of 4784	3148	chrome.exe	116
PID 3148 wrote to memory of 4784	3148	chrome.exe	116
PID 3148 wrote to memory of 4396	3148	chrome.exe	117
PID 3148 wrote to memory of 1124	3148	chrome.exe	118
PID 3148 wrote to memory of 4396	3148	chrome.exe	117
PID 3148 wrote to memory of 1124	3148	chrome.exe	118
PID 1544 wrote to memory of 2608	1544	svchost.exe	119
PID 2608 wrote to memory of 3112	2608	msedge.exe	120
PID 2608 wrote to memory of 5048	2608	msedge.exe	122
PID 2608 wrote to memory of 4360	2608	msedge.exe	123
PID 2608 wrote to memory of 5048	2608	msedge.exe	122
PID 2608 wrote to memory of 5048	2608	msedge.exe	122
PID 2608 wrote to memory of 3316	2608	msedge.exe	124
PID 2608 wrote to memory of 3316	2608	msedge.exe	124
PID 2608 wrote to memory of 4100	2608	msedge.exe	125
PID 2608 wrote to memory of 264	2608	msedge.exe	126
PID 2608 wrote to memory of 4100	2608	msedge.exe	125
PID 2608 wrote to memory of 4100	2608	msedge.exe	125
PID 2608 wrote to memory of 264	2608	msedge.exe	126
PID 2608 wrote to memory of 264	2608	msedge.exe	126
PID 2608 wrote to memory of 3496	2608	msedge.exe	127
PID 2608 wrote to memory of 3496	2608	msedge.exe	127
PID 2608 wrote to memory of 3496	2608	msedge.exe	127
PID 2608 wrote to memory of 5500	2608	msedge.exe	128
PID 2608 wrote to memory of 5500	2608	msedge.exe	128
PID 2608 wrote to memory of 5500	2608	msedge.exe	128
PID 2608 wrote to memory of 4724	2608	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-08-14_02975ba0a046872e7b67c60406d74b43_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_02975ba0a046872e7b67c60406d74b43_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Roaming\vd5LW6FEdoBZhFBo\svchost.exe
  "C:\Users\Admin\AppData\Roaming\vd5LW6FEdoBZhFBo\svchost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff93a06c728,0x7ff93a06c734,0x7ff93a06c740
      4⤵
      PID:2296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
      4⤵
      PID:3084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:11
      4⤵
      System Time Discovery
      PID:3276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:13
      4⤵
      PID:2584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
      4⤵
      PID:3120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:4368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:6056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
      4⤵
      PID:5924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
      4⤵
      PID:4784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:1124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:4824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1776,i,9699704025245915125,14812041785746000565,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ff930aec188,0x7ff930aec194,0x7ff930aec1a0
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2804,i,153654956256159192,2101255382404806069,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:2
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2804,i,153654956256159192,2101255382404806069,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:11
      4⤵
      System Time Discovery
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2804,i,153654956256159192,2101255382404806069,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:13
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2804,i,153654956256159192,2101255382404806069,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2804,i,153654956256159192,2101255382404806069,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2804,i,153654956256159192,2101255382404806069,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2804,i,153654956256159192,2101255382404806069,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2804,i,153654956256159192,2101255382404806069,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
      4⤵
      PID:4724

C:\Users\Admin\AppData\Roaming\vd5LW6FEdoBZhFBo\svchost.exe
C:\Users\Admin\AppData\Roaming\vd5LW6FEdoBZhFBo\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5fe7dcfa3a569cd31ea46a7faa8c7deba64cb67d72a3e1030e022ea6a64c3713
MD5 5495d0703235de4412af464e550dde36
SHA1 43c4e07e81d1998ae380c51ca80f97089e2a8ed8
SHA512 6f49d8c8ca7553e38275b30fc8016a56835da28aea270b02dc96cd82b65836f405571458eaf24ce7e7d8b9432246277f30d5952f2321a30cb98f089fffd53b48
TLSH
T1D05189B3D3E48A7DC41566F49B216E1FDD2E0A18122D3C62C8D4AE5B43F2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 29edc9ccbb1e4cbd4c4793085b86088a9a86652312daf48656f2be0c66e5d8dd
MD5 a4da0b3c40fc83c9ecb4729ee2592403
SHA1 364a58ee3201735a6fca8aab9a6f1ab612892ad5
SHA512 07fe96cdbe7d965e69b3fbc503e3a7b7b4b10a23d9cb1d598bcbe747be8291b0cc557788daa6cda72a1df79cb70fb59baa1e091cbe29ae1c6a33990466392d58
SSDEEP 192:ORVfPA0Nv7jSPRpEe9ZHsb+WNnjp0NTkVHaut9VyIsnAUgE:ORVfBtMXTbw908aOLE
TLSH
T1F742D62EBD54697BADCAD21AF9217B53D7F5102221A43E84EBFC9A2C11E76CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fd46ec1271674a7fb2438c9e036f0e4d4fb507727549acad193fc742de3a9e5e
MD5 fdfa1ec47a010b1d88ddecce28f08791
SHA1 622db86638788b87ed9eec64bd3511e73aa08022
SHA512 15b77229f397417c4926892aaf23bb6e52d4a71fcd2007a805f22fd71e070949adab6c81a4b40ba130f3ecf766ffffd59ffebd428bd7c704c2a8c8c1fe705715
SSDEEP 192:ORVfPA0Nv7jAPRp2e9ZHsb+WNnjp07kVHau49VyIsnAUge:ORVfBtqXdbw90iapLe
TLSH
T19232B52EBE54797BADCAD21AF9217743D7F5102221943E84EAFC992C15E76CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 eef00b966bbe0fc255f85ce65d4c2f54510446496c58d0d95693239e98d73285
MD5 699550c04d09815ff28bdc9de5f3d985
SHA1 602bbb62310bdbf434227e1abdfc23b23961df1e
SHA512 08781c29bd0545fb2681d3a04372a3d51f441df7c9b03fb6932eb734038d0bd197a59223755670eeeb996977352ac8acd7e7ce76229fb51f1a57f6bb5fe85870
SSDEEP 384:ZvjNE7KxkXqKf/pUZNCgVLH2HfgslGWXODNs+ErU3+1HGfepSrv1FnGzu:ZbNE7KxkXqKf/pUZNCgVLH2HfgsA8OB3
TLSH
T12D52F767684D9A3B0FD8D64CDC16BF8BADB202977664092493FB5C0803A57DF124A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 74530e54419d62ab10f18358e7df75150a6ca68af659f4dd9e8f7408570e9540
MD5 93430ed78cad9fea5e74ee02b82b8aa4
SHA1 fa870bf8247c15085c66afbeda4f9b200b68dfd3
SHA512 e5bb2f84f073a188eb4d1cae2525d9f52772fa9b1c361b6a6d65423acfe01cea72ff9ff8ac48995481ebe30fe6583f44d579545c390a65c182d90a7807e3b465
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d4bed2d91c2128f448ce57f939d4382aecb84758a7fce676d29ced9097c81e8e
MD5 4747dcb76d64416fd4b63b0df07d0a83
SHA1 98b9b66931f2cfb2771f6f235f027c8d81b5a605
SHA512 bba7b141b331585bd35116173acc4fa4482811d63b62e90142ab1e4a5ce679e171f781834c0eb9c0ce34c82cc681b54e20b16a1d866104b8eb3965f35ac0a29c
TLSH
T115A0022545C60461EE10877064765D76275548265AD95713A4D50B84C85B1C45111149
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 44b2f677eba5c04ffa890679c4c620626570059f0169a33866e6158a2328f181
MD5 0df5a179c4e401319786a0cc12be03a2
SHA1 8fc86ec411a6f3c4a03aec631758077769f94af0
SHA512 2f2491e4c28005fa669d3b35fb8ec3ef9377246ae6ea3e8e5cf4d6c9ddb0ee7b34a12d896f3e9ddbe3f0c695f2255950c767fbb789fe251a9147479c5440a3c2
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OhuVumM4n6y:1nbZeMrv/hGthUn6y
TLSH
T17CD3874B3A743102EDE6DA725CE050BB5E3CB16D4F55A5D428B620688EF2853B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 a41f7e47a10066016bbbbfa7abf2479848b56e6e2972c44ec8915337372416c6
MD5 bfd3a5485298a21d4fb848b1c3735acb
SHA1 eb8b3d47a52141bf22367269aba40ce3bf17f11a
SHA512 6c688e24aea49b1e6c7d5a16eb2120f8bd1092adb0bbdc66844e46541a53f42e84e8244c8f7b4a4104544e2cf414b2b4c88305944e9431ba71ec06700c3bcfc6
SSDEEP 3072:H3mvJqRV4zRLEzdguSFqMCIpI1gl5R/Kf+I:2vqV4z6Zn2x3I
TLSH
T1EBD312B35F15139E1FBAECA4A049A253EDBE94F35489BF0B20CE7E1604BF7611253912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 6b7ab69b954c869973e007d5626f0b9b0a0488bd50ba8e34429c47bc408b525e
MD5 d75bcd9c9c6b38052fb91bd3adac58cb
SHA1 83a313d39a4241e2458ca92af1afc200fe166229
SHA512 84043b1580235505fb8b067ffd06185b1b006c5caf217a6e33ff2ffe1ced5b34c6bca051fb3bb325a2cda67a54b8908996d82ead0d002446f2221868a8bf1d51
SSDEEP 96:0C0d+x7oIU1fXfBVMLHRDotok5SdDfB6nGyvLlAAZbdOv4a:0C0G7/qffEDUDUpvcAAZbe
TLSH
T114A11931A42D9C3759B2D489FA466A53DFB970A76920AF44EDDE1F0801FB1EC1343923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 214a20399bcfe248b855297e08cae2af82912d8294ff0370a874c44598ebcb09
MD5 eefa38f13bd20f933bc7f3873b74af9d
SHA1 303fa1c14ce92c6186b2e881b9d60326046a03e5
SHA512 ed51fa405b6f0ca68815209423c6f9d029cbf49ec1a63d949519fc387af109902945dd9b4374335a8842e258bf7a1148fc8a15574b8964a7113575769b466c8c
SSDEEP 3072:vw3mvJqRV4zRLEzdguSFqMCIpI1gl5R/Kf+I:vVvqV4z6Zn2x3I
TLSH
T1DBD312B25F26135E1BB9F874E0899253E6BE48F250C97F1B20CF6D2A05FB7611263912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 1754e3260cab3cdc2085f6b29f0d873dbfa3b29a26873ae4de02b1afd7cf3864
MD5 bb7eed3d893836f7363ef2b6bede281c
SHA1 1a7d3ac38fbcae74c4bab4bdc6c048b5cbeedca4
SHA512 cdc422cf6d6191ee686eb9e31280a68b51f5fadbd13914c652263919f1d6a824ae279112eeaba711bfeac53f01a5092c5f18f30cc0e8b79ed75e759e79b391df
SSDEEP 3072:mw3mvJqRV4zRLEzdguSFqMCIpI1gl5R/Kf+I:mVvqV4z6Zn2x3I
TLSH
T1C5D312B25F26135E1BBDF874E0899253E6BE48F250C97F1B20CF6D2A05FB7611263912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index
Size 216B
SHA256 5cd75233ddf012a24650069064e494e8b787e56b168469d312b63c210ce58990
MD5 c275f08a303fec45ee21cf3bd6c3844c
SHA1 7f4cbc6fb22622aeb1813f139166d775a66b1349
SHA512 3dfb267ebac978417f78b2c5f1774e003e3a378dfe191dda0896df2e175a2fe4eba233336ba3ddf66c6d485d8b6f4f0f07e9daec6e84879fe8395e3db6c86362
TLSH
T15AD08045DC574655DB13397105773229133707FD35122F2A00BC142A69517BC8447505
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1eb5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index~RFe5a1eb5.TMP
Size 216B
SHA256 49175ee29c1dd0f12efd36ea5766d6c3e286f419139aa3dd68c0023dea8ee2d4
MD5 8606afdbf11fff640c3b1f24814d98fd
SHA1 8e279ec2d53e3a3842a9eaf1c25535c447305fd0
SHA512 1a16755b248d4992c893dc6dc21b8c5370b9eb69485133a60cdf8b982baeec2ec4b85f98e4cc9d30f3a070dc56e53e647cf7ebdba657f832019c2935db2e9da6
TLSH
T17BD08CDA9892AAA1DA0729702843722F237B482028226B3A9089282F5E712DC844780E
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c03fbaa4d6cef3aa27ad51544affe66e5368e068c1bb5d91a3242de9938286d5
MD5 0c59db85ecd06c986c45bf0450077014
SHA1 2a584f558bc2c78a0611957946066a192b872b0a
SHA512 9fa40e9ebb8563cac50e3371c40f9f2ffd6ddacfb0d6a6913b794a8327f629feb4aa9fc409141439956c5afe444cb3e1c1d660a79a9e811922e8059c99f62a56
SSDEEP 768:prv+4UNbdG3hgtDTd+Zc0U8eX6+qTko0u229a4vsDneVH1SdW:pbsbU35dULvVTVKa4GEH1h
TLSH
T13903CF32E8A589778DF79785714B75472FB91173C6C80B80D8ED6B4D028B5AC270BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8916b9fa1761c907b12c5834ad87b3cedc5941da5342018a6d7ab96456ea429b
MD5 178b3f543a726631bd991b149e78a13b
SHA1 0e6f84a5e1e1a416bd43760d77aae45c10ae0c18
SHA512 6b1fd55fcb429b42525207fee23fc5366ef0f122df107d29d3496a7df3bd22b04b6ce2dfdc4061a10dfdcc13aa02edb99e0eaf463d43214299d08b515408f101
SSDEEP 768:0rv+4UNbdG3KKGDTd+Zc0UXTtzeX6+qTko0u229a4vsSVeVH1SdW:0bsbU3XdUIvVTVKa4jEH1h
TLSH
T1EA03CF32E4649D778DE7D685B14B75472FB91163C6C80B80D8EE7A4D068B4AC230FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3148_758677021\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\vd5LW6FEdoBZhFBo\svchost.exe
Size 2.6MB
SHA256 36d3044a939b82e7456063d74f6f2395dea60ab0f63f04dde9dcc99eca4ba291
MD5 02975ba0a046872e7b67c60406d74b43
SHA1 f02c1991523e6e79b5933779e14547b55f8babad
SHA512 c67312bc56825e5815d529d8b945b4f577332f18f3aa68d499a324661da18e0ce28e0a61763a5c7150a9f1ccc7a754c2ffc7eb89853cda83c1c556adda576329
SSDEEP 49152:d5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUx9KTnUVz:STrVI4dGOgGpYHC4
TLSH
T1F1D59D62F782D0B2E4D201B156BEABF74D787535537584CBE3C01E6A49206C2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download