991d59b3ae3ad0e42d7837cb3515479499dfbf2251eb67de647f079e842b390a

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Goodhertz_KeyGen.exe
Size 669KB
Sample260815-2w6ddsvdqa
SHA256 991d59b3ae3ad0e42d7837cb3515479499dfbf2251eb67de647f079e842b390a
MD5 9f8f96ae6768c343836d83a388ac2629
SHA1 e252d5c43fe92570ef189c686afb05e044f49da7
SHA512 1b44b6638f7cb6438084b54c95a7582289f5ebf1c17d1f72ae915f7bcd9bf9b1bfa880814a9ed35cb52503d4427d2b74a7934f90978e6e6980442e33ea657cc7
SSDEEP 12288:4c9t2SllRl5pN3j2lkKeJut+/34JvhjKzHknb20qzKvZV5tZJHi2V87YC:4cLNB3CmJHG6H30YKJtrVe
TLSH
T1F4E4234AF9D408E7E926437015AB8B32233B7F918ABB0597B7D97F355533343601BA82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2508	keygen.exe

Loads dropped DLL 2 IoCs

pid	Process
2508	keygen.exe
2508	keygen.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Goodhertz_KeyGen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1288	chrome.exe
2936	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313082530995418"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
5932	chrome.exe
5932	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
5940	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe
Token: SeShutdownPrivilege	3912	chrome.exe
Token: SeCreatePagefilePrivilege	3912	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
2508	keygen.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 2508	3364	Goodhertz_KeyGen.exe	86
PID 3912 wrote to memory of 4476	3912	chrome.exe	98
PID 3912 wrote to memory of 4912	3912	chrome.exe	99
PID 3912 wrote to memory of 4912	3912	chrome.exe	99
PID 3912 wrote to memory of 1288	3912	chrome.exe	100
PID 3912 wrote to memory of 1904	3912	chrome.exe	101
PID 3912 wrote to memory of 1904	3912	chrome.exe	101
PID 3912 wrote to memory of 2412	3912	chrome.exe	103
PID 3912 wrote to memory of 2412	3912	chrome.exe	103
PID 3912 wrote to memory of 4120	3912	chrome.exe	104
PID 3912 wrote to memory of 4120	3912	chrome.exe	104
PID 3912 wrote to memory of 540	3912	chrome.exe	105
PID 3912 wrote to memory of 540	3912	chrome.exe	105
PID 3912 wrote to memory of 1412	3912	chrome.exe	106
PID 3912 wrote to memory of 1412	3912	chrome.exe	106
PID 3912 wrote to memory of 1848	3912	chrome.exe	107
PID 3912 wrote to memory of 4388	3912	chrome.exe	110
PID 3912 wrote to memory of 4388	3912	chrome.exe	110
PID 3912 wrote to memory of 4100	3912	chrome.exe	111
PID 3912 wrote to memory of 4100	3912	chrome.exe	111
PID 3912 wrote to memory of 1848	3912	chrome.exe	122
PID 3912 wrote to memory of 460	3912	chrome.exe	123
PID 3912 wrote to memory of 2688	3912	chrome.exe	124
PID 5920 wrote to memory of 5940	5920	msedge.exe	134
PID 5940 wrote to memory of 5976	5940	msedge.exe	135
PID 5940 wrote to memory of 5180	5940	msedge.exe	136
PID 5940 wrote to memory of 2936	5940	msedge.exe	137
PID 5940 wrote to memory of 5180	5940	msedge.exe	136
PID 5940 wrote to memory of 5180	5940	msedge.exe	136
PID 5940 wrote to memory of 3368	5940	msedge.exe	139
PID 5940 wrote to memory of 3368	5940	msedge.exe	139
PID 5940 wrote to memory of 1196	5940	msedge.exe	140
PID 5940 wrote to memory of 1196	5940	msedge.exe	140
PID 5940 wrote to memory of 1196	5940	msedge.exe	140
PID 3912 wrote to memory of 5932	3912	chrome.exe	141

C:\Users\Admin\AppData\Local\Temp\Goodhertz_KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\Goodhertz_KeyGen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:2508

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a8 0x4b4
1⤵
PID:4896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff4039c728,0x7fff4039c734,0x7fff4039c740
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,16195628635747947895,11452337783231677997,262144 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,12964097688586062073,17649134534672907750,524288 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,16112344984825532810,9453677192563657788,524288 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,12094101150098505881,9942101581856908106,2097152 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,15522651607142618920,12562511027487511345,2097152 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,12236359920959813843,15993306752011906026,2097152 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,1006001575780349548,7125371216273385839,2097152 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,12978827136071836436,11112059423960271954,524288 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5972,i,12208017072233833263,7505152375952152395,2097152 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6020,i,3554727113617918268,2680159015762825853,2097152 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4608,i,10507198515386472753,17341653100671196079,524288 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,15367778565727355672,4851286715809296636,524288 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,4905967454897730131,13637222639774345477,524288 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4488,i,15445341680709453399,17502701353751503964,262144 --field-trial-handle=1976,i,16915605425201348881,8988893380671621028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault068b38f2h3948h45d9h8976h14e9ee3b0594
1⤵
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault068b38f2h3948h45d9h8976h14e9ee3b0594 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x278,0x7fff3693c188,0x7fff3693c194,0x7fff3693c1a0
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,13279970538633728802,11373912491223453743,262144 --field-trial-handle=2236,i,14950844898676158962,9864986696732443049,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,10728599843523053517,286722605526494660,524288 --field-trial-handle=2236,i,14950844898676158962,9864986696732443049,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,13309590284960153167,14597486570186313130,524288 --field-trial-handle=2236,i,14950844898676158962,9864986696732443049,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3308,i,11170650745666599644,17512300074396815403,2097152 --field-trial-handle=2236,i,14950844898676158962,9864986696732443049,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:2
    3⤵
    PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f6bd82ddbae2b82d361e4f1473b926c44d3d939dcdb8f5faa8a9c90aef8e55c9
MD5 072c2fd1fd9a6f75f2d587d733fa7305
SHA1 a6b537914429ce1f49df1cab5e12c86c91fc50c7
SHA512 c59377692dabc8608ad570f2f451dd1c3b35ec5ca33b321f00b57cabac977201994f959d8879bba8fd783b382c5d07f3d0188180d773743507d6739e2fa92bef
TLSH
T1BCE02BA9D821AC6718F95B2960540745E79513563F90CC0F3B3ED10D8FB6A3B4666C2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d151fc50d116c935e8e63d78549786e77b45ce1b220164a64bd4d94227436318
MD5 50f6f422cd93e1e6381cc4932e0a9e25
SHA1 943d8c5cfc699e407b4a02e2882b99d3e9954731
SHA512 cec884b7141b457bcc4f96be13eaa6e6705ee0ffc9e0d67b4956d8549168495301d6222ac157e96d9361e473cd6de3c938ffdf8fc4c0353a51fe6d9c1221918d
TLSH
T1B2718FF7C7E8C57D890156F8AB156F1FCE290A24432C3C66C8D8AE6B93E2972D11075E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6c6f2c488ec3fae6b566ba4f3fa30099a8a15fb25e1be0ecb5c736a8ec9fdff6
MD5 10bdd1fcecee5682ea9dc57973c76750
SHA1 5b58f302cf55d11537d6d2a947a964512c325f33
SHA512 6c5e5c32faaa3aba7b0d11ecbe6909b0d95872d34f07fc1f96c151df73ae13a451ec372de8a81a81ca00adfe9b40ad56a020c6cf88c16e6a1a9dcd046b12f6aa
SSDEEP 192:uR4gdIj6mRjrPv7cpAPRp2qg9BHsb+WNnRl0LsesfJaKZWVVyIsnAUgtaJ:uRDCNBrHwUXlgrwX0MJaK0D8
TLSH
T1A742E82DAE24397B5CDBD219FD663B53E7F5102225942EC4EAFC892C04E76CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 823435f521928c6e9d5d0cb1775633ba5860dc95d915def10a04d5c40357ddaa
MD5 0a6fe67d196f64b7f1d1ab09790a5abd
SHA1 6c9ddeef4e93212b459570192a6cac03101d1d6f
SHA512 868440a0d1233875389adc199e4575d30482c394db944f2207d35ae72f985aeba8bff676e899499a06911430455334e9341917d416416513b1364bd3c626639f
TLSH
T10FB012C080035381C00202F81652148CB514DF10B60A370143E0B922C8355B08116050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59522d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59522d.TMP
Size 96B
SHA256 e6272664aa1e2fa2475490ec537f2db1b26e11e12967d23175bc7d53b86cb60b
MD5 203181533f801481e1de510c1083d212
SHA1 29e489ad293753e9d447eb68a05ccea9b0b34c22
SHA512 a5d8f859f07f3d1d6ce14d5c592f1c941be95d6fdb226fa1ab4d99c0e0578e0f7fc1bfecc0fa1231199015dae9b86ee74fed293f10779359aa1d05c6a60f58fc
TLSH
T13CB002D6C1066222C04207F27DD595D8B161DF25D607121692E02B6BDC35A74556A5B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 7bbaa897ad930d5b59fe88d31891e051fbe189a9849008120047450951c71ede
MD5 158917e57c4d190a961a4af37c2ba755
SHA1 e3e1239c10e413a3dcfae448b9265bf6aa7b12bf
SHA512 42c4a3361b0ef228eabfc9cf3c4be3474740f3f3e84e0be15d5c1e59f58979115725179354fdbac2f3ffb3ee5a3ff5a22103bbaf765aa91a63ebd44c48a60087
SSDEEP 6144:aAQeTh4tPl/HQFlGMUESPGzFmUi21rSm8uUVNSlzYh:a4ytRkl++fi21b8j8z8
TLSH
T15C3413503D93DDB3EADD111CB1A96EB98FA84D4182C5CD0183C3AE45A5EF3C6864DF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 2936ce780016fb358abcabccfecdb7df9a4290a892d16936850fd244e10abb84
MD5 e623dfd8fe6938c9bbd55f343f443281
SHA1 69cc8a497bb3a730c6d324797d394f06d803ebb6
SHA512 9d7e88f08b74770ea70f8c70f2863becffdd0b3ecbe2237abf9f30f66638bcb17c9aff6658efa0fa838e551ddc5821c015e55960efacd2acd6034b612631e255
SSDEEP 6144:/dAQeTh4tPl/HQFlGMUESPGzFmUi21rSm8uUVNSlzYh:l4ytRkl++fi21b8j8z8
TLSH
T15E3413703D939DB3AAAD115871696E798FEC4D42C6C5CD0187C3AE4164EF3C28A4DF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ed32a1d5d5f72cb7e441498ce922bbb27c1bc9686a91e9d2612bb1bd142e1a9a
MD5 fbbe00d8081a4c6be5237e688f8d04f0
SHA1 0df2d246d3cd14b163b22cfd80e242af125e8414
SHA512 5646813c6429e31da24c8fe48a2f73e963ec8c69d19904aa17324dce706abb7141fcbb3ac56448797f7f82769b942943843ab95d55bb84e126522ec1f3cbb259
SSDEEP 3072:S+FUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:LFmUi21rSm8uUVNSlzY/
TLSH
T1C4C31300BAE3E9F2FE5930447BEE2A145D6C0D818291C6415673AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 5b5bfef315644ccb0ae42089479a00a2dc37be6daed18d73f1f3d0c1a6a9ed81
MD5 428e99d0ac6364b34d6e4c289330a169
SHA1 0a587e4310d0143ae8c99524701634292d3c1f0e
SHA512 4dff50da0a9249d8121d7f943d4d6d140e5225771f87f4ec9823a0e16ecca3658aaa1f6b87916f9376533e9b00627393cde30a288c71cee82d99c59cbef4dbcf
SSDEEP 6144:1AQeTh4tPl/HQFlGMUESPGzFmUi21rSm8uUVNSlzYh:14ytRkl++fi21b8j8z8
TLSH
T16C3413503D93DDB3EADD111CB1A96EB98FA84D4182C5CD0183C3AE45A5EF3C6864DF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 66eaafd806059198a1390d35d441d4392d042fdcdafa56a8e40b319ec02871a6
MD5 ff51daf31b64c42e924dc1e56079492c
SHA1 a824f4d1193ca1009ee9fcc6133209f1755f7043
SHA512 63b62dd5b99a37fd7bc91b225e3eebc596485d13976a94d4bd97417aaff2293dace32200ab2c60a95a8977f27f8f2ba3f493015fa6c5bbcc2696e8a0269f28d9
SSDEEP 96:sa2jFiEDW5pscnb9zxdHW+i046W6hfuH9EOx+WVoMfm+uecpYQj6J67ywUhgNVDB:sxRuPsirrpMHW6+WNGYfxhgF
TLSH
T106F1C952AE34697F4CCBE11DBB267B03E2F9502165C5194CEAFC9A5C099B6CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 0e84b5db90e0cd68f05b582279ca22edd6c23756dac1ebea15f4143de6a71ef4
MD5 1eba22dcbdce98f278f15f1f1a7f370d
SHA1 fe0d373e97b5f516b9e79afbd2094c91b5102290
SHA512 544c43366e7ddcabfe6f872702dc2b3ce861e2192243e8e7c06ef8089e31997c792834615bf1e6d9c5c718c30d154b5f047facea858a41b741f3028162618409
SSDEEP 768:dDmjYDmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLlrZ+FHrofvyaa:dDmjYDmWvmKyEu1jakPLZQFU38
TLSH
T1F9C2FA3B244CCF7E4FC01A9DDD5A6F973EA802C76A588D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 00f067e79074f6cba34292b1212fce7fe6cae756d1cbddc47a57f0ed9f6b39e5
MD5 7845b93a5af36cc46b81393d1536e9c6
SHA1 e1d474742c9f48cf2e9a30180ea9d3789605190a
SHA512 8f11aedb2f6ba92f5739645b82c109fa84ca5a02e270f1822bb28f79f1ff9da368891936620f6a7a48dd801ab4382dc445192bc6c8ebab4eda4b039ca0fbb8e2
SSDEEP 192:z/sN/6hZEeQmiUy4EEH/+jVnjzorRUlXU+2mJ5cOTdqwyUO:z/sN/6AaKEf+98RUlXU+2mccwUO
TLSH
T1C8120A35A868AC679DD2B645F48B33639FE821779C856F84E6E85F1C00C779C370A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 52af614d3ea2ea4cf62fb927f952ea4800534d431b1688f5f411a920ec37406d
MD5 e63ae6f10dd71e5b7c026c6e69f2e2b3
SHA1 36067ca00dcfe3dc6ee469e2e9ed53e5696fe9e4
SHA512 b0c4e0d22394a81afea21c999cd01abb50be42a28a1ba2cf0261bac235b514e31e311f11fa092ef623f0bb19d49b3066cc2e7f14bf3716a42b61ba3a43510de3
SSDEEP 192:EONu6hZ0QmiUyNPpc/+jVnjzorRUY5wOZrzU6:EONu6oapu+98RUn2nU6
TLSH
T19702EA35A8786CB78EE2AE45F48727235FE5112BA9956B84DAE81F1D00C769C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a4c1d6363b1d22412c8575a79e6edd9a0c0e8229b31b52f4bd25569bbe23fadf
MD5 0f52208fb3a02a592aad31b8de407a89
SHA1 4d3737069c9c32ba2c5fd3afa488751ba5ee7014
SHA512 eb811f5dbbdef7b988c1b7bbdabb429711372ee6fa807d8f85b2bce836ed2748a9c14211492747390c9ae83f1079b57df860df7859f962d6e040f94340254122
SSDEEP 192:nONu6hZbQmiUyQPEc/+jVnjzorRUlXU+2mJ5cOqiqwyU6:nONu6hhEu+98RUlXU+2mc9RU6
TLSH
T1F112FA35A478EC675DD2B641F48722639EE821779D86AF84E6E85F1C00C679C3B0A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 9b86de8a7ccb73af9be2cdb9e667add68f9be6292dfd45c641fc153e2caeeffc
MD5 e72caefd669fea66ad7f1db87875f3f8
SHA1 a4f5f838ff460d227343d3082fdc0157c5ef285c
SHA512 e671fdf4bff1f40fd27a9f4d983ba84ff4ef9e10ac9b786fb307e08d1ac09853ae804a8ae8309748376a62a075018ea53a08f3ccc8d142e73372695f2446e932
SSDEEP 192:z/sN/6hZEeQmiUybEEH/+jVnjzorRUlXU+2mJ5cOTdqwyUO:z/sN/6AaFEf+98RUlXU+2mccwUO
TLSH
T1D5120A35A868AC679DD2B645F48B33639FE821779C856F84E6E85F1C00C779C370A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BASSMOD.dll

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.dll
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R2RJUCE.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RJUCE.dll
Size 226KB
SHA256 79951906c0a397cb7afd15f1d3061e7f2f3f95c38ad553ebdb8be2737bfe7277
MD5 50359048673ed27bd174458a863ba207
SHA1 b1c7d5d534d4f5e4ce1c0381e42af4758cb294a8
SHA512 46f83fc6c76d76266292582b25d5893bbf79a1a8196b97e4229b193530f78da4addf1490e776480408cb691712ac100bf3d60586b67dda884592c425d818c338
SSDEEP 3072:Ud6T6B7g4pRxwz7Rjia0Qd4rl+0eZ4vJtW+8AhUKBLyvTBfbxsUx3kwPsnY5gl:7TH4PxwfNAe48D4v/dQTBjjx3TPtul
TLSH
T171349D41B4D0C476CA7F05348CB5EB685ABEB9600F70E9DB67884E6E4E316C0DB3176A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 493KB
SHA256 bd53e99d44c6e6d4a4daa47e89d7a5bc9d03fbda2ae6274484ab01ed3e668659
MD5 374a4358fb64510c36ab812c4bc196e8
SHA1 89ef238c4c565bfd7427ddb3f9271c31b99a0f71
SHA512 782336cb80fc8394a1479c2ad6630f506256f8c6b7012ba86ea441d266c4d3045870b2946af226a4d25f46525073269067408758997342e651cecf2f929bcf0c
SSDEEP 6144:icmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAO+ELC0zntWBFu9ICxSjLebGw:ic/kEPDonR6Y436vRBLC0ztWBFVCxO6p
TLSH
T106B4804AAE324ABEED70523F91DD554A5906B1F1C2E6C4DF42CB15FA881239E346C3BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2508-13-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2508-11-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2508-6-0x0000000000400000-0x0000000000441000-memory.dmp

Download