lxbaserat | b7c60bc7570406370984e95e12934ecb7e935558d473e9444cee85951d202c67

Resubmissions

19/08/2026, 02:47

260819-c965eaxth110

19/08/2026, 02:45

260819-c87pjsvgqa10

19/08/2026, 02:25

260819-cwlxbaxsbv10

Analysis

user interaction
yes
max time kernel
88s
max time network
91s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/08/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 483KB
Sample260819-c87pjsvgqa
SHA256 b7c60bc7570406370984e95e12934ecb7e935558d473e9444cee85951d202c67
MD5 3d9f8ae8d0d4c9238e86a11017cf8ead
SHA1 2de5befe8eadae9b86160fe9c79e8c3e2f8d0d90
SHA512 7b40fdb970dbff050ca8205d3064867b2d96b09ef580ba1c0d8562b6b635633743da49f9b4ab4294ba6ed2a518f524cad1031e8ee11a9eb0dd9be6d9bd2bce31
SSDEEP 12288:JHciCX/vien2BwZVkiqyIJ4tB67W/0la0:BlCPvgeZFUiula0
TLSH
T183B46B407BE40A11E2BF4F71A87635041A7DF8636A73D34E1AA1699C0D717F2CE24BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

blv f32fa8beb733435d91b2e89f77f47b41 discovery execution lxbaserat persistence rat spyware stealer upx

Malware Config

Extracted

Family

lxbaserat

Version

1.0.22

Botnet

Campaign

f32fa8beb733435d91b2e89f77f47b41

s33mon3y.noip.at:4055
222align.noip.at:4055

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
RmKZdNG5oJcpwX7UmN3V

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Executes dropped EXE 2 IoCs

pid	Process
4372	client.exe
1872	client.exe

Loads dropped DLL 1 IoCs

pid	Process
668	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001a00000002b604-66.dat	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1032	cmd.exe
5588	cmd.exe
5056	cmd.exe
4636	cmd.exe
400	cmd.exe
5440	cmd.exe
224	cmd.exe
344	cmd.exe
5172	cmd.exe
5464	cmd.exe
3328	cmd.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4032	chrome.exe
2916	msedge.exe
796	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315811945805605"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{5F32C7AB-8761-4120-A299-10F399AD0FB0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{4047BFC1-AC1E-4931-A7CB-4945016B966F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5104	file.exe
5104	file.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4872	chrome.exe
4872	chrome.exe
1872	client.exe
1872	client.exe
1872	client.exe
1872	client.exe
1872	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe
4372	client.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
3880	msedge.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
3880	msedge.exe
3880	msedge.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	file.exe
Token: SeDebugPrivilege	4372	client.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeDebugPrivilege	1872	client.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe
Token: SeCreatePagefilePrivilege	4872	chrome.exe
Token: SeShutdownPrivilege	4872	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
3880	msedge.exe
3880	msedge.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe

Suspicious use of SendNotifyMessage 58 IoCs

pid	Process
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
4872	chrome.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe
5616	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6052	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4632	5104	file.exe	80
PID 5104 wrote to memory of 5992	5104	file.exe	82
PID 5104 wrote to memory of 3688	5104	file.exe	84
PID 5104 wrote to memory of 4372	5104	file.exe	86
PID 4372 wrote to memory of 6020	4372	client.exe	87
PID 4372 wrote to memory of 716	4372	client.exe	89
PID 4872 wrote to memory of 2848	4872	chrome.exe	94
PID 4872 wrote to memory of 2412	4872	chrome.exe	95
PID 4872 wrote to memory of 2412	4872	chrome.exe	95
PID 4872 wrote to memory of 4032	4872	chrome.exe	96
PID 4872 wrote to memory of 4676	4872	chrome.exe	97
PID 4872 wrote to memory of 4676	4872	chrome.exe	97
PID 4872 wrote to memory of 4076	4872	chrome.exe	98
PID 4872 wrote to memory of 4076	4872	chrome.exe	98
PID 4872 wrote to memory of 5540	4872	chrome.exe	99
PID 4872 wrote to memory of 5540	4872	chrome.exe	99
PID 4872 wrote to memory of 6140	4872	chrome.exe	101
PID 4872 wrote to memory of 6140	4872	chrome.exe	101
PID 4872 wrote to memory of 1904	4872	chrome.exe	102
PID 4872 wrote to memory of 1904	4872	chrome.exe	102
PID 4872 wrote to memory of 4712	4872	chrome.exe	103
PID 4872 wrote to memory of 4712	4872	chrome.exe	103
PID 4372 wrote to memory of 5588	4372	client.exe	104
PID 4372 wrote to memory of 1872	4372	client.exe	106
PID 5588 wrote to memory of 400	5588	cmd.exe	107
PID 5588 wrote to memory of 5440	5588	cmd.exe	108
PID 5588 wrote to memory of 5172	5588	cmd.exe	109
PID 5588 wrote to memory of 5056	5588	cmd.exe	110
PID 5588 wrote to memory of 344	5588	cmd.exe	111
PID 5588 wrote to memory of 224	5588	cmd.exe	112
PID 5588 wrote to memory of 5464	5588	cmd.exe	113
PID 5588 wrote to memory of 3328	5588	cmd.exe	114
PID 1872 wrote to memory of 668	1872	client.exe	115
PID 5588 wrote to memory of 1032	5588	cmd.exe	116
PID 5588 wrote to memory of 4636	5588	cmd.exe	117
PID 400 wrote to memory of 3828	400	cmd.exe	120
PID 224 wrote to memory of 3880	224	cmd.exe	121
PID 5172 wrote to memory of 3056	5172	cmd.exe	122
PID 3880 wrote to memory of 5832	3880	msedge.exe	123
PID 5464 wrote to memory of 596	5464	cmd.exe	124
PID 3328 wrote to memory of 3000	3328	cmd.exe	125
PID 3880 wrote to memory of 2916	3880	msedge.exe	126
PID 3880 wrote to memory of 6080	3880	msedge.exe	127
PID 3880 wrote to memory of 6080	3880	msedge.exe	127
PID 3880 wrote to memory of 6080	3880	msedge.exe	127
PID 3880 wrote to memory of 4272	3880	msedge.exe	128
PID 3880 wrote to memory of 4272	3880	msedge.exe	128
PID 3880 wrote to memory of 1324	3880	msedge.exe	130
PID 3880 wrote to memory of 4440	3880	msedge.exe	131
PID 3880 wrote to memory of 1324	3880	msedge.exe	130
PID 3880 wrote to memory of 1324	3880	msedge.exe	130
PID 3880 wrote to memory of 4440	3880	msedge.exe	131
PID 3880 wrote to memory of 4440	3880	msedge.exe	131
PID 3880 wrote to memory of 1600	3880	msedge.exe	132
PID 3880 wrote to memory of 1600	3880	msedge.exe	132
PID 3880 wrote to memory of 1600	3880	msedge.exe	132
PID 3880 wrote to memory of 2488	3880	msedge.exe	133
PID 3880 wrote to memory of 2488	3880	msedge.exe	133
PID 3880 wrote to memory of 2488	3880	msedge.exe	133
PID 3880 wrote to memory of 1492	3880	msedge.exe	134
PID 3880 wrote to memory of 1492	3880	msedge.exe	134
PID 3880 wrote to memory of 1492	3880	msedge.exe	134
PID 3880 wrote to memory of 5336	3880	msedge.exe	135
PID 3880 wrote to memory of 5336	3880	msedge.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /query /tn "csrss"
  2⤵
  PID:4632
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "csrss" /tr "\"C:\Users\Admin\AppData\Roaming\client.exe\"" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5992
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /query /tn "csrss"
  2⤵
  PID:3688
- C:\Users\Admin\AppData\Roaming\client.exe
  "C:\Users\Admin\AppData\Roaming\client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn "csrss"
    3⤵
    PID:6020
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn "csrss"
    3⤵
    PID:716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\url.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "http://finoglobal.sbs/r.php?c=rHgsp5"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://finoglobal.sbs/r.php?c=rHgsp5
        5⤵
        
        PID:3828
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "http://finoglobal.sbs/r.php?c=6iza2A"
      4⤵
      Executes a command shell one-liner
      PID:5440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://finoglobal.sbs/r.php?c=6iza2A
        5⤵
        
        PID:3200
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "http://finoglobal.sbs/r.php?c=kduQHF"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://finoglobal.sbs/r.php?c=kduQHF
        5⤵
        
        PID:3056
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "http://finoglobal.sbs/r.php?c=qi4opd"
      4⤵
      Executes a command shell one-liner
      PID:5056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://finoglobal.sbs/r.php?c=qi4opd
        5⤵
        
        PID:5400
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "http://finoglobal.sbs/r.php?c=LFRwhK"
      4⤵
      Executes a command shell one-liner
      PID:344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://finoglobal.sbs/r.php?c=LFRwhK
        5⤵
        
        PID:2592
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "http://finoglobal.sbs/r.php?c=ycY29y"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://finoglobal.sbs/r.php?c=ycY29y
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7fff5b46c188,0x7fff5b46c194,0x7fff5b46c1a0
        6⤵
        
        PID:5832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,7452341162267576295,8937571783441314549,524288 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:2916
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1508,i,986861793467163945,17774878574163286163,262144 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:2
        6⤵
        
        PID:6080
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,1908537403845371212,16035412291634364724,524288 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:13
        6⤵
        
        PID:4272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,342211837802644197,11151043028000136902,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
        6⤵
        
        PID:1324
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,8219242461747793520,4707656956440750787,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
        6⤵
        
        PID:4440
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4376,i,18330878564672726,4904675391093154650,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
        6⤵
        
        PID:1600
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4644,i,17897906702471955373,14883325067229636647,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
        6⤵
        
        PID:2488
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3540,i,13832751389167484835,16320559473609066024,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
        6⤵
        
        PID:1492
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4968,i,16800880993933094622,720520566538172147,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
        6⤵
        
        PID:5336
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5552,i,7531281779869288929,17063551017715351732,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
        6⤵
        
        PID:396
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5744,i,15586400422676506011,2306914687423532792,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
        6⤵
        
        PID:1216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5932,i,10902262704637607211,10323804759714346830,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
        6⤵
        
        PID:5344
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6096,i,16452516575998188941,14361633989009151293,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
        6⤵
        
        PID:2240
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6312,i,12859642390038097118,17686254743621349165,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
        6⤵
        
        PID:1880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,2687168634500020136,7064951698318068053,524288 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
        6⤵
        
        PID:976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,4494161313274980671,16201831822304070157,524288 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
        6⤵
        
        PID:5896
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7468,i,8351558825631973758,9798512624464043627,524288 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:14
        6⤵
        
        PID:1120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        7⤵
        
        PID:1848
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7524,i,6171604781080934728,6867092557187814825,524288 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:14
        6⤵
        
        PID:5836
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7524,i,6171604781080934728,6867092557187814825,524288 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:14
        6⤵
        
        PID:4052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7792,i,3786249611820687051,16557546305646216595,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:1
        6⤵
        
        PID:4292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6128,i,13972944688020106173,11723285061396754216,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
        6⤵
        
        PID:5904
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3764,i,6873872906991993248,16061605474457435450,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
        6⤵
        
        PID:880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=8464,i,14842120757779708136,954776418821020764,2097152 --field-trial-handle=2016,i,8968553470716053888,11932106927635237758,262144 --variations-seed-version --mojo-platform-channel-handle=8224 /prefetch:1
        6⤵
        
        PID:3476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:4052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x220,0x7fff5b46c188,0x7fff5b46c194,0x7fff5b46c1a0
        7⤵
        
        PID:3628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,3318852378104683372,17336612916401881636,524288 --field-trial-handle=1900,i,13936714479069081547,10911707056486523704,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,9609880987644361559,4681348312251284083,262144 --field-trial-handle=1900,i,13936714479069081547,10911707056486523704,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:2
        7⤵
        
        PID:1708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1496,i,335369717098249894,4707466569600085057,524288 --field-trial-handle=1900,i,13936714479069081547,10911707056486523704,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:13
        7⤵
        
        PID:5604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,16943592664654017192,5842281525442399621,524288 --field-trial-handle=1900,i,13936714479069081547,10911707056486523704,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
        7⤵
        
        PID:2224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,16943592664654017192,5842281525442399621,524288 --field-trial-handle=1900,i,13936714479069081547,10911707056486523704,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
        7⤵
        
        PID:4188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,11700158652905897675,13979621359309665195,524288 --field-trial-handle=1900,i,13936714479069081547,10911707056486523704,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
        7⤵
        
        PID:1072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,7013009076850825357,4636368018056878874,524288 --field-trial-handle=1900,i,13936714479069081547,10911707056486523704,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
        7⤵
        
        PID:5452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,4100343114737397700,12777253329114667242,524288 --field-trial-handle=1900,i,13936714479069081547,10911707056486523704,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
        7⤵
        
        PID:1236
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "http://finoglobal.sbs/r.php?c=Dqwq8p"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://finoglobal.sbs/r.php?c=Dqwq8p
        5⤵
        
        PID:596
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "http://finoglobal.sbs/r.php?c=gwLwvq"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://finoglobal.sbs/r.php?c=gwLwvq
        5⤵
        
        PID:3000
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "http://finoglobal.sbs/r.php?c=4NrxRg"
      4⤵
      Executes a command shell one-liner
      PID:1032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://finoglobal.sbs/r.php?c=4NrxRg
        5⤵
        
        PID:232
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "http://finoglobal.sbs/r.php?c=Vi2cHX"
      4⤵
      Executes a command shell one-liner
      PID:4636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://finoglobal.sbs/r.php?c=Vi2cHX
        5⤵
        
        PID:4760
- - C:\Users\Admin\AppData\Roaming\client.exe
    "C:\Users\Admin\AppData\Roaming\client.exe" --internal-telemetry "C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      Loads dropped DLL
      PID:668

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7fff6d82c728,0x7fff6d82c734,0x7fff6d82c740
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,4994471930274115315,11866817300803186882,262144 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,12761844721134763606,13785399018649845138,524288 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2316 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,8623013815063281547,1677744034667413342,524288 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2448 /prefetch:13
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,3134758760968606589,15076313603084823330,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,10540890276439966756,10796130189887481801,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,10299974000478874032,17861593717629113320,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:9
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,8616543137712937397,2477179663984527243,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4960,i,17870846082948204286,3040679315906538687,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3580,i,15277595632003350002,3488060541487637011,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4956,i,13835812729584079736,2169689320552750590,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5696,i,5327920936967281631,14444758676605079498,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6140,i,18366009130337459323,4852583133561299459,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4808,i,8760382855771711540,549757802716583811,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5968,i,14172126608554962739,5529009220090253652,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6304,i,3554201119677741483,14810312582915668963,524288 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,15923515989550752065,2830961754273091960,524288 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3600 /prefetch:14
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,14316042471869194515,9869575720844117987,524288 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,8862131273826623453,18271671812759848002,524288 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4456,i,9437117716274388600,3756404491639166793,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4524,i,9115765369879185203,1652507750603634019,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4444,i,11379965283489016123,7699578603909492097,2097152 --field-trial-handle=2012,i,6886937500390978146,4365482391958811858,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:4208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2520

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:840

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e28203ee6f47a19bc0507371659f5a2dcbd324292d708e144672a22beabbe34e
MD5 69ae3bf6488b7428b8ff3081d2b7f8fe
SHA1 c547bb1d8ef6dc736feb96ae25bb7feff414054e
SHA512 59229f19d8d2b5f0f5f872cac7716a361700751fe9a8a0878b5966e19750aedca02b4550db108bed4cb33c976ec489f06b298bc4d410cec79f9de1595fb551ef
TLSH
T1D0E0E5EAC931DC7B18FC471950444A47E74513662A80485F3E3C94084FB873A459685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 38KB
SHA256 3370f2e33b0f3a2dae282f78a6bda56adacc76aaf06c7b388db4fda41b90b92c
MD5 b06c7a8dd8ad214e1f952bfae09f9301
SHA1 a0ab87119773fcc0720f1732763c28db8200f802
SHA512 9755d8ce26ab5b0d2293f00285d2334dd48e4c1b6f78a452758821133bd3d7aa3c8134cb2fab12eebb7120e00feb0b719cacacea7c12eb977c937d5cc50c4c43
SSDEEP 768:MS2Glq2FZ5dIEmd9C/imy3NUm07IARvRqLI:dSYfydk7IARvRqLI
TLSH
T16003F12EB1C51EAC510CAB3D92B74368952353063E6952F08DC297CE8584BD06AEF3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1a59a2fe7606a0a5a2d691dfc425878e5ae4cbb297693fd4f0674c4054892c8d
MD5 c5dabe55fe6d05d5c2fa9599f147a759
SHA1 2a32604073ab01a5f7eff52325550118bd5fa79d
SHA512 a5d381e15e74137660b27c7e1637cc78ef641abcea49f355377c678ba3ae506ae13d905327508504ffa28d726be6d2ee33efbcaf3dc0f9a81f9f663e310ea6c7
TLSH
T1A451741464A3DC30F7B1A97984AD4D64E1FC4467C7F2AE1206889D23341F75A100D7EF
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d93f36f2d5e90b08956aa1c12f0fc471a925ed2ee55138c95036c574e20cf37e
MD5 a7090000432b6539bc5bc75086c57491
SHA1 6c99c1e2dd5c21896ec82ffa1e2bd4c6c691d7a5
SHA512 df6115017a61eb1ae3f28b7b58e925391d51f4779e6aa20ce90129bf3c1d2625dd7b53e25645d1e353bf102e0f9bc2301ac3b66be2f1803dedb8382796006081
SSDEEP 192:uRrfTrs/LmvfDv7+hcPRpmTZ5Fq+XGYQXy9wHsb+WNYXLZIuNZI2WvII2tAQFkwm:uRrLrf76EXkcwbSyOwAFB/5gf2WaPe
TLSH
T1C962E66BB9506A3B5CCAE729F951BB57D3F5102225851EC4EEFC892C04EB9CC312712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 988217da4dcabe189072701141b01b50d0c12229e985e6afd13eeba7911ea719
MD5 b5703a0eda9412578b2c092fb5332d6e
SHA1 9faa7ba7f7818c7f04a93053d4e156ce2bc6db49
SHA512 ac9080a58b9d49d7822baf5e3ee8f2ca365607f88143d88bfa5139d05c8681e34181637445e91d43bc02eba751e7828f74c4a41c3c1f3a9e2f5489401eda474e
SSDEEP 192:ORrfTns/Lmgxv7+hAPRp2Z5FiAJGjQXy9wHsb+WNYXLZIuNuIT+vII2oAQFkwocc:ORrLIh68XIEIwSyOwAFBEsof2paRe
TLSH
T1AF52E62BBA502A3B4CCAE729F951B757D7F5102625C45EC4EEFC892C04EB9CC212712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
MD5 b28f8d2c357e9f30dbd5f6faec9be3a8
SHA1 7045d97913533ca8a4d3fd4bcccacb31200659fb
SHA512 0c3fd52647169605cd7ffcc7ff7895b9d1008ecd2a828bc0aac93f78a5c3515c5bf2ae9dd7335970687bfc199d7d6444d158da461151c200b0fb87c211b0d77f
SSDEEP 384:sejIb7KxkXqKf/pUZNCgVLH2HfgslHH7pLuLcSj2XXODIX+ErU38xHG6QDzXU:suIb7KxkXqKf/pUZNCgVLH2HfgshH7pZ
TLSH
T17072F8676C489A370F94CA8CDC267B4FADB5024B65EDC86483FA581903D5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 f7b402a06da1bfa872b39f69691198166dd56b28670b445a84bbda844c65ed27
MD5 4b5dc40264213d8c8af5118d6c469f92
SHA1 cd76eac882dbbe8861d0d42ff7a5d109e1e53287
SHA512 7a1f1937f15df089b4b092e6ddcf3365e8fb6427516b6865b22758f6f052a21c7632fe741a551dfb670563e505d491699aca2ee58902640497dd7f7ed94e55f5
TLSH
T1A8B0120184025101C88202F0218A248CB1545F10AE0A170183F46922D8292A2C838091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b1c7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b1c7.TMP
Size 96B
SHA256 18870a3ab5d935db6f32c8eba9b14c59205cbedaee7871c70bc58523934c8d8f
MD5 014616d7eac8cedc27719e8562a4a925
SHA1 9604968ae79e99eab210f98f7bab9a81b49bdade
SHA512 31bb5774acd11653de0e35c023869aa69fc5890b0bbd5b806f4054595d26054ddfc276ca3b398edd00092ce2dc8331bdb5a4dbe9f9537e1117cbd5e14159ef89
TLSH
T1FAB0026AC1036212C59747F82599E6DCB171DF35C707131296E01BABEC2B67346351A5
MD5 SHA1 SHA512 TLSH

Submit Download

c263da01-90ff-425b-aa14-35b93755fa70.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c263da01-90ff-425b-aa14-35b93755fa70.tmp
Size 12KB
SHA256 ca65d796b583ea924c90f7bf88f2b437812567666fad04335285e33fa578ad57
MD5 e1974615963b1b11cc0a07c804d82bf5
SHA1 6b4d2c8a604c1ddb056922d661528af70fffb05b
SHA512 e42b0acd692d56b74a6bba5f0849157c1fff7fec4571ac3f65852dcccf1b105baebe0279eda53dce2f2a7e8bde5f68ad65c387eb3896643420301469b962289b
SSDEEP 192:ORrfTns/Lm2xv7+hAPRp2/JbXy9wHsb+WNnZIu4vII2VAQFkwocVyIsnAUge:ORrLOh68XOjyOwZBGf2eaRe
TLSH
T1AE42D62FBA50653B5CCBD729F9627B57D7F5102225851EC4EAFC892C04EB9CC212712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f0ff8a574da0805d3e517e6bccdc47cb710d54f75c9454ad7135c1f9ef76f7c1
MD5 4bd0e67d653576f39491b0de11c6a570
SHA1 39bccdadd42d5d2807aeafaa7292be9568628e21
SHA512 96663016d0d46fc32279ff31f45ff2775c6cc547db047b42dd5b27ae298d241d626af033005ffdeb50aa03a02278e772fb28faf248b7235877ef44584f3fc4d4
SSDEEP 3072:M0zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToJ:MqWDfxA3OnjrYQ9EU0/hEJ
TLSH
T1A8C302A15C39BD660CF8EE95B40D3A60EFF4ACAA91479DC3A2E91F4D14FB5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 cea4c1cb1cf8a066da994b05f623b064dbafe6143eb7f167398ee77d1f9a3366
MD5 2791e978e88d2afd627eb1cb1a5765ab
SHA1 1cd9a07e2a177678eeb89d16224bd0220bdc6048
SHA512 da676f9fd0832061ee169122344ae15d887606ed275ab11f918ac7d2dc2e2a6d9ee22e9864981108c414fbcd3ff3d246d43ea617cc0ca90b88dc4fd3dffc7335
SSDEEP 3072:uzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:MWDfxA3OnjrYQ9EU0/hEg
TLSH
T121C302A15C39BC660CF8EE98744C3F60BFF4AC9A91879DC362E91B0D24FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 280KB
SHA256 3ab093499a5cbb0a7c67a00bb1f20d63516edd1ef1f4e70d46f79fdb7264718f
MD5 c4ae04ebe3f5441af3140b6fa25829ac
SHA1 d19845e19b5e272906e3677a5111dbbe7f3858f4
SHA512 23b45d3b9c085723df45bd0f683dc1ebdbc068af791b7a71453fd4accd52bb9dbd87c87f0a54c3a4d005023459916caadd22a1027ab9983252e1d4bba6f1ba89
SSDEEP 6144:QoJPa7/Cwavf9sTYzJRItIwXr33jJag5mKMYWDfxA3OnjrYQ9EU0/hEO:pJS7/C1vUkJ9wnJloDfxjjs+Ch
TLSH
T1AC5413E19D34FE260B74D541A42D3FBC8FB08CFB10D28DE692D9278D50DB1DD2A2A960
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 bdcb3e9af1b7aeff1cebf5d3aad49d5dcf14ad2d5ea43926268bcb50087d8f71
MD5 ad882ebb62537716de31d9ffa309f7f1
SHA1 8551831e9704aa050cb58d53598b7246761ccc7d
SHA512 f5156e716827ecd0f64e1cfa4e134effdc68dc8c16ce5944075591b681378e9eb15e4eec56a8e926d34f55ada99734fc0b0bfad5cd448c1cf0179870f87ec81d
SSDEEP 6144:CIavf9sTYzJRItIwXr33jJag5mKMYWDfxA3OnjrYQ9EU0/hEO:CtvUkJ9wnJloDfxjjs+Ch
TLSH
T1173412D19D30FE370AB9DA81D42A3A6D8BF0CCEB11C29DEAD1D91B4D00DB5CD2935A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8ea6d4cca36921420fb287b8c2bae509b68a558db3a490014828b67eac1ac91d
MD5 7a68e1215fbfd7a6660aa61ec0335a60
SHA1 ea21f860bafe7fa736ba044204909989b85c5dd1
SHA512 c3fa4a8005c82da0bdd939e92de866ab7127ee7ee97d81e47e35a9295a250f76376a70ca293c75ca93f06cd4d8c9a6031a4263359174de4215849534e6585f4b
TLSH
T101D023F47657F6D1D73D003894D04210353945F1359B47417155DC0DDDF0048E2E79DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 779250cfcb17bbf8333f9b989c45f6314af6d17cee6076690bcde6c72bff561e
MD5 5727c5d46554f77e63ca2335ced38963
SHA1 8b366dc5ebc70979a66f9da0df389449157eb092
SHA512 044441ff3c94189d6770908ebbad79dbcc74a3e527e00041af995b37886821110663bcaa9098c22c97f50140b6d8d2899353c7b8c9cd53d860e65bd9606a490a
TLSH
T108D023F97357F901C72E4035ECD06625323F95F0345A47516096944DD5B5148F2EB49B
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2d7c18eda2823fed331a1f174088357d6593d41aed533d014128f28f52256ad5
MD5 b1b000fb9ba1d2e889b00b4b6c99461b
SHA1 277413e79d262684f9ee4e0ecf2969fbe49cf5b5
SHA512 0d79871a625007f6d08b5a2e6b0acac86beeb4582ee1ef517218e74b838d19ce84c92c3986f7f226ae3a486dc6d16ec524abd26da8f7240ca98c13eee1eaf77a
TLSH
T166E02BEDD9229C2B18FE0B1C65900606D705236B2A405A4F3E3D810D8FF463E099AD5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 439b29506162818b08adb220188e3c47b40cf4a88bd829d2806a3632a904d768
MD5 b19ba958e438fe6487669904449450f8
SHA1 b85b377814f7e7d718db76b21ed66911740f37cf
SHA512 a6b0aece4e5b6821721d3063910d3bc2a4ba20aa984d580d46bd4445464924bbf19001a99e6882a18ae538c0d594fa619b5be67ae1b38cb1b860ce1702455f12
TLSH
T1C951731A464636A1F37116F0F9C381F875707CB58CAEFF91FA9018B5696EE2E8A10067
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 e78c5a893e78db7c30011790bf186d4cce5251f0161c017d27dc4613268662d5
MD5 a348113c5cbc3e118c39a505a8ac21c8
SHA1 b28ae1a59aa357fe9f34ead0c03be371109316a7
SHA512 7c80eceef48bf5119d48b0836fae0910fe081fab2372161f2f56db342a83370b723c1231e19421981dae52d763ab8d8a5dcc79c0787931d4dfd09eb68aaaa27f
TLSH
T132E0268C25CCC16E99DC78A3C37C47A8C3D0389AB38CF902278ECC88E101242A3E7681
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 02b935fa252aed1566f0756b825a0b0aef88c3010664e0833fbb926f12c0509d
MD5 de4395e29b7b66492a7b48f3a1b5efac
SHA1 369b0d835e4779d1ba6a037ecb834b8bbe200f39
SHA512 c2855bbec89a28d82b6cdd978d64612841179a0a80d744e94f29a7fd0fd2f0befe6f0b40b9ac39f7e00fad3beacd430bd909b9acced49dd56fdacaff2078c75c
TLSH
T1FF31C4F783F4856EDA0195F0AA18BE2FCF1D0511432C7D9989E4AE1793E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 8f77eca7c1ab5725a1a5568e01abde36f9cc0558cc72b4a6ede6b2b548a7efda
MD5 89b58d4ab843ad7319b938c83c6e67ae
SHA1 053582a50bb344bc682a3d37ad73b8d30db2838d
SHA512 f5f7814246a3d5403bdf725e0a38b85a76312fb24dca002cacca1c0fa62e479aac005a8ef7b59bd1ce73da3e88c330244b3f1ff2303818874b9d637e01b20b05
TLSH
T18DC0125284B9E4765036457EAE84B8857675D47501D090E4DAA993BCA0940F75B1106F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f9ac870d86ad1d51c32b50a840b122439fdfbe3ef21d608c5c6d35a05e4731a0
MD5 32465e4ac411d2a9bcd027078d8b41d7
SHA1 449737ffbc43508d0f3895cd094a082977f8d4f3
SHA512 a9e895fc665344f0e1763cd4c474e29d59ad0a0f12ff1296ff68ac21a1b40b7e3c7992329db5be0637d0c65c67d7e9356b1e87c4736874a33078777499973e7f
SSDEEP 192:sxZQ5RNyMqZjK1Ml8Mc6/f5s9URKQ7PgYsp0rzodpW/Zc6+WNGY0ZYv+PIgjJBJ:sxZQ5206/f5s9QV7orp0wW/vG5pjJL
TLSH
T1F762F7166A38597BCCDBD319FA457B93D7F9552391904E44AEFC8A0C00E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f0a468427d833b3bd0b5a506fe452d08f6022699aa220ea1214eb9374fe57591
MD5 55337e9e809f49aa7bd33b350efc62ab
SHA1 d257197cc52eaae33d3c07613c0a6057221788f3
SHA512 b0b5468dbd5e769ea816e9a3cc032ab8f0708f9e95e14c5784655114f71d67cdb1910cd04272e33e2325842a59f7073c13d91783f0e6498b0e45c9a01c880549
SSDEEP 384:sxZQ5u46/f5s7Wv6QV7orp0wp/LG5apJL:sMZ6/f+Y6Q5E/LG5I
TLSH
T12972F8156A38597BCCDBD319FA957B93D7F9152391904E44AEFC8A1C00E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b4a5725acdecd6a9d269cb06be419445076f3f2248dc925c365f424fe26963ed
MD5 6b882d2b9d402d9edf4e86e7589626a0
SHA1 5905340d34bdd547f4b4f53654ebe30c8da878d5
SHA512 dacbe837a906ef089a556f0dde719449cc098ba2a2b864b727da13b042e7042f11a44bad1192d2efad38136548f1970db1b684936f5106cee83bc5d130b85ba6
SSDEEP 192:sxZQ5RNyMqZjK1Ml8Mc6/f5sjURKQ7PgYsp0rzodp+S/Z86+WNGY0ZYv+PIg5VJL:sxZQ5u06/f5sjQV7orp0wp/fG5XLJL
TLSH
T1757209156A38597BCCDBD319FA857B93D7F9552391900E44AEFC8A1C00E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 536b280e01df69638789b1dcd5a70d77c684851ace4af5d49542c0029cb13e37
MD5 37d8c8af9d564d66b49121adaa0c10b7
SHA1 2d58815d41eee40402442f8289d77c15454181df
SHA512 b4ebfe249cf84c890bfdea1081a9faa07294ef1c644addeb0b62957378365451f365561fd9b3b2069641161eb822e73772c22ada5ef51d61aa8e1fceb463971f
TLSH
T17CE0265C16D8C2BE685A30874334870CC2E478AFD2CCBD023FC5CC446182905B2E3680
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 f3008e3167fa0b7966483037d0324fe44948273e08be38fc03f676bc8c320ff5
MD5 70902e04e4c0e176c4af3dcf81682468
SHA1 e5ce557a4213e3b909028555f5032837a12279b1
SHA512 81912d9cf6e31b995f5e1d7d8ab7662bc58692026ed1c31b3ad739ba1f64517d5aded1cc412313dcca0edcfe656ae7ceb6514eaca845302a3fb006e39c4f8e52
TLSH
T1B5B01260BB52E31BD08D5B3682D49B00A334E0091064A1C34C04FE709E023E838C65D8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 10e591609b236f186d3a31a4c6b75361c3e172a65d9c1459d04cf0429f3b62a7
MD5 9864395b93f212045c266ae989fa7fd6
SHA1 010d853535a688ff690ea6275f40020cb534b86f
SHA512 25ae4f2f7598340bc4ff760377477aa211ffa4a262bdd4a30e1710b09bf05fc80a6c61475c08853f7add8fae223cdd12a4731ed8c6bd1196797a7fd97ace654a
TLSH
T198E0D82C36C9C66F658D3187D325D318C2E27857D7CCFA217B4DDC84A2065407383650
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 76de54f48e726ee048a7cea4f99aecc9b618596f26cdb587630ec42f651b64eb
MD5 6673a0bd3d8550ca21ddba71fbb70471
SHA1 4cfe7f2098c48e84bc78943fb5efc85822d1dd9d
SHA512 bca5329b64e09342c1d7a77723d324ccfd752edf9729e9742ec56a386ee8e74e3cc3c19d628990c400496bc0455a8a412f9f88344951e9f625f92ea423ff4aca
TLSH
T1C9E026BC56DCC6BE588870838374976DC2F07C5A93CDBA026B4C8888E101541B3E7980
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8e74935952921dc0bf35e5de5117617fb5d4d87588e23796b455dfe1a4efb5b0
MD5 00270921161a4cae92fbb61a250331d6
SHA1 7076fbf6ccef770fbc67f146506205f9c7a43256
SHA512 ab7a2adcd6e4a332c99d74c9fe5cc4ba85ac12f7e3706229f590d51b424b70ea2516d9cfbe4b2a71e8cd1882c24b6276ea3acf15fbd3c156a6ee8bce3941a38a
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjldfFi7Oy48IlkZO62168:ctGj+BCNC5qFVpKxdt9
TLSH
T149B2591632BA03023C3D791D87A597375A82B2633058E93B7BE954B60E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a08c2601-1dc3-4d05-a74b-b7709294ed22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a08c2601-1dc3-4d05-a74b-b7709294ed22.tmp
Size 36KB
SHA256 68858457de64675adfac5bba4bd75d2cbe362bd5b56c33ed82c17b44d245db88
MD5 bded20ca916f58687068f7b3d7e15b59
SHA1 bbf20d062a96838bd62d59f54a809c0c147d0a1e
SHA512 e4eb9d9fec3da3834ac217e120d48b07c5a843ef189280916f85621929cf9e5ddbe14ffaf45d6c0458afd4cfe61d0bbbd97ea3cafc1107bd1a0bc7761dadc638
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3aGq9LlC:XwZh38Dv2SkEnZFWRm6GQFmu1jaKaGqi
TLSH
T154030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 930cffdb86420661933c8eddc06bf47e92bd131b674a2b67cfe74eb3c645621c
MD5 2862427a1db6d688ccc54e295c286ff9
SHA1 96aa594745667a41569cf01fea78107991c3bf03
SHA512 eae9f03b88f080e81d6ba1d78e77ce56df61242479ec7066829b666cda4b226d71e95759d93139e53179fbe6e97eff2035ac6c447348eafc276aac386e1735bc
SSDEEP 192:HeOQjAsvlrqxrsj5RLhFCA1BrwQtFIIIibSMIMcNYcY1zcH/qLYM:FQ8sNis/FwQtFIIIibSMIMiBKzcH/q0
TLSH
T18052A5A927021B7BD04E5FB713A94B541BC589C2017732AD30622C8F9DF3A9386C91F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 bd0d4f0e1302310c571759b23bc58114e61e3f9513c7384c066c25e59f560939
MD5 72dd8b6b3ec47ea3fcc60c458c1a6812
SHA1 ee324c1852b03d1daa49879640177dd3a0c9ed8b
SHA512 73e5af94169dc0a6ad3457fa708183062ac590e7035b9573e4ebc7c91033c0fae8f9f0d96d7e107ce65fc0755c937d4a8374a24dce234abb0031494ee7a2e8fb
TLSH
T1F7E02668FAD8C1AFA85520CF52744708C3803CABEA8CB9063F41CC48A041105B3C7681
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 f0133e103c624453a6732ca95b9e4ca2f7f15b16699444b7a52ac89a1f8d39a6
MD5 e5d24f0158b3a0d449a3fa8ebf05718c
SHA1 21d8bc6c2ed1347dbd571b7c844a38efc30448d8
SHA512 cbc932deef35ae9882f8f437098ac3547b115db9f046a19c7f5c0310bee4ae384b8123d1b4ded81cb4d73483133c0c7ea549f39f1a467681b860fc53a0e38625
TLSH
T1C1216056F321C149E14E8A7EA12AAB361328E8029FFCED0F447920256D76F015E8F6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 cd685795e00d80f9fa9e843552c4129b66b263ed32583fc10fae7061f4d9eb1a
MD5 fffd8886b7033ee6833aec8b60f7edf0
SHA1 0687ca8d336cc10db32df7d471d65f806e552d72
SHA512 8ed99d1781f0289a6a133c027a46f2efafb524cb8c840e80bc13e49122a9f39a8adc735be2a36e81eb8bbcff829a9bdd9cf6ccbece08d6e2070736413ad6f8d7
TLSH
T1A8E0DF2CB9D8C1EF985830874274C368C2913C9AEB8CBE022F81CC8CA50114AB78B581
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 fc794aa48f3365b9589d27f0f1f53bb39728f91acffc4b092b5574d6b099490c
MD5 61acb2ac6fdc0a7148d1fb73c2c6609a
SHA1 822b6de04b58382f516512e5dff0dd42c9bd8b2e
SHA512 5871fb29374ac1ca775b6b5c861a698d0578c3cde0ca0073a29608db7d855267be2279a3f45d32389b32109bb83b52cf77c251311405ae799dbc0fad31ee7fbc
SSDEEP 384:naiFaZcIe8Nr8TUNTUlIRerk6Ojj51ifbLoq3qZAk3etFQnDvKgmTb4tGhSivL+t:RFYe0wg/5jioqw6An2gmTb4tGEijlA
TLSH
T14AE22739EC549D7FA8EE6F48A78E69129EE01137C5BC85C8E7D80F0C807649DE307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c97736de83f21c2e5c4e139284381b29e7d582c42e12ea5f5b389aecb91df632
MD5 63d5c1c8d9eddf2909633dea463fc493
SHA1 eecd97ef8b7c3fdc1f8c17364318ab4c7482bc58
SHA512 b610fbe577bcbe08cd685a0d03113e2fc60647a30767b889bbe15c5bf124499d99da11589ee2865d55e89c1082eb2a9f4a92b84255a9e71415536cddfd68af25
SSDEEP 384:ndiF9CcmyWCs38NR8TUNTUlIxBrk6oH8F1ifbLoq3qZAk3xSEe4KV8p029ty/7IA:UFccps3Swg4b8uoqwdSEI8p0T
TLSH
T1F7B26C36EC99DEABECD70F99E74E7507DEE05263858C9AD8DAD81D0D008B19D130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b0b7f76c1c7555724ebb67fd7341e887a9328aedd8639e55cfd8531563d9b2c1
MD5 ba66bc76a3daf671bf41c5b2a9a2f732
SHA1 e6dde18bd0b8771cafa0ccc408a621f9480a7c1a
SHA512 2513a5ed1bbd51f692df44cdf315f873071ff1c0d68886471fef4855ffbf4b7f3ac29735fdea5076e72c0e1cb1aaf30b75c401f60456036e5e7e13ad01c0e3b5
SSDEEP 384:nZiF9CcmyWCs38Nv8TUNTUlIxBrk6Xx1iG1ifbLoq3qZAk3etFWRoe4KV8p029t6:wFccps3Ewg4o1ihoqw6GRoI8p0T
TLSH
T182C26C32E859CEA7ECDA4B99F78B7547CEE02163C58C8AD8DAD85D0D008B19D170B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8bd6d64649601f42770c6dd69f4b2e5caf54ee90262d353a8e36ca52cff4a806
MD5 6787dcc90c24cc7b7ee49f5f49fcb38b
SHA1 315487f60db1f896c49ddcb0e30a51fe270c556b
SHA512 94151e628074e4be083e6660ba2ec83194eb034d2baa76f85bb8c7c6f42c4951ce0f95679a7ba8e5dde21e2989d91324785e73f00d19bf63d41b4f0c09c79ba9
SSDEEP 384:naiF1ZcIT8Nr8TUNTUlIRerk6G8p51ifbLoq3qZAk3etFQCoivL+aRty/7IgD:RFNT0wg/upioqw6ACoijlA
TLSH
T1E5C26B32E8A8CE67BCEB8B85F78A7657DEF0516385CC8AC8D9D85D1C008B19D170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6c9684ece467f383268ed49e657d8e040bd6b3146fd23fc1e35ddc0c90109dc9
MD5 c5c6d6c18d5af237475d9dc34c125b19
SHA1 a4456dd2f1ea3148104b4a0694d99b600fe9e687
SHA512 23e92192419a1f21e3dce2a102d6fdb102f4744360ba69cbf9a52e7f44f705715b91ffe369c0a64052a63ccf9ac7d4a4aba80847e138f80b1887745876e74714
SSDEEP 384:naiFaZcIe8Nr8TUNTUlIRerk6OQj51ifbLoq3qZAk3etFQnDvKgmTb4tGhSivL+t:RFYe0wg/Kjioqw6An2gmTb4tGEijlA
TLSH
T16CE22739EC549D7FA8EE6F48A78E69169EE01137C5BC85C8E7C80F0C807649DE307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5be788adf43751d95720bf0e8b967a5eab31750e6ba60c71f411572c88e973cd
MD5 8cb12f7d24ff3a7dc0791f13fba58094
SHA1 88fe0430fcd20a4ee27aabb7eed42eedaa39d612
SHA512 3190fc791203c189753b3c04193ffc6d61262ab295513985b424cbe10b25deef9b825eb8dfdf73b768ff90562a59236405430f0e5a8b3914b12ec48632091855
SSDEEP 384:naiF9CcmyWCs38Nr8TUNTUlIRyrk6a8Ol1ifbLoq3qZAk3etFWRoe4KV8p029tys:RFccps30wgvGOOoqw6GRoI8p0W
TLSH
T1CEC26C32E859CEA7ECDB4B99F78B7547DEE06163898C8AD8DAD85D0C008B1DD170B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9db8cc16cd871a157151db0efdac4d258fa0682e0ae045d866ff05145ce6e80c
MD5 b5d80d9864942e3dacc736f59c10300c
SHA1 6e25509b864c83288cddcd63e63bf9579a157790
SHA512 471957e2e4ca7f840eb8055d2c3fa966da28291179f1dfcb00daba76252827ac74e9e058bf18a1fe16db759a7f4e72292bbe79277b5381b27d37e15293a3c566
SSDEEP 384:naiFiZcIh38Nr8TUNTUlIRirk6G8p51ifbLoq3qZAk3etFQCoivL+aRty/7IgD:RFQh30wg/upioqw6ACoijlA
TLSH
T171C26B32E8A8CE67BCEA8F85F78A7647DEF0516385CC9AC8D9D85D1C008B19D170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 825466a15961eeabe8a691e8ba7be1809a50465f23321479b7d4a9b481855643
MD5 6d2c63a35a26b33c401e75b28270f6c7
SHA1 b224a758bc50e8cc34fe74ae0d6c9fc65eee36eb
SHA512 2d138454b949570eca112712c320b289b0795dec3f586749d4b19efe7e0c10121a1469f80de4f789929398ea1dc2d51b367acf6534b0548aa8496839e9e336c4
SSDEEP 12:TLzwPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isnJazWWnd3mQQttWndJ:TLc5UOl0afDdWec9sJZpejB5fc
TLSH
T11392DF676D351033E8DE4736FC8389910EB8135EDAA7B8448DD049621DB5BC2A2895FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 59b2303e01560ac13135653dcdf5e2a615819fe8cacc6cc3d1993b4d5fabf9e0
MD5 b67fc0932f4350c572aa9a5d85bb0835
SHA1 88728a9949499e9901e9e85db1720aa4da3ea034
SHA512 99356339319e12737d8fda004424e6b145f6c26645a788d8a0521e5a384663b21bdefa80e95a975dc9fa526faeadcea7e013a5540ece5192019c7ce2049b738e
SSDEEP 3:MsEllllkEthXllkl2zEfl0gKtll:/M/xT02zme
TLSH
T1A44404047FC00405D51014345051C3503770D41005515FC734D304735CC75400D10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

msasn1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll
Size 119KB
SHA256 fe8289239a81f3e1bc881e4f622e11c8e67b1d90c4a54d07a55e00a1950939d8
MD5 a6fb047749de3b890d36d2172df0ff97
SHA1 4431970ca391769bb36d72677c89e26217e006be
SHA512 3d8f6eb72f07fdf921aa4fcd000396ef5259aa7827411c691ed00742f721ff3d3334123ed178661434835b02f53d6224bd749a6e241e4d046b3e4edabf1935ed
SSDEEP 1536:nWdGfNbAkj1K3X7BQ9d0SHS7hdPFw5coos5J9PtSUDwS8U+DQAK+OAOxW4C:WdsA81ISdNQzPFzotxD789Q/+Oe
TLSH
T168C3D5D626D84E8AEA14667846DEC322773EFAF087434B03A268B0754E17FC17DC561B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

self_exe.dat

Path C:\Users\Admin\AppData\Local\Temp\BrightInfo\cache\self_exe.dat
Size 50B
SHA256 fdc446a0bf9ba0bd068552028354661175c5f5b5973d676ac6ff2dc211d976db
MD5 a444d9217038c54f160828015af8395f
SHA1 c5d4a156cfaed94c8e46743961c89c01d6517a23
SHA512 98a613c9b6e34e0161d3fd83914a5fac4ba7579abfae748c5b78fda37081070288fb3f3dd7531bb65434c16b85a597bd10422f9ebc5a76b571e0151c7958469b
TLSH
T11290021901F68A19540156534671D0D8D0756D612F457D558604444C5580488F945481
MD5 SHA1 SHA512 TLSH

Submit Download

url.bat

Path C:\Users\Admin\AppData\Local\Temp\url.bat
Size 1KB
SHA256 9ba9f0358eccb434b25156782e8ae3e29a277eed8e8338acb48e48a8c1205d32
MD5 f9a4801dcd7b751838d866169b87d6f4
SHA1 3399ff952de7c89a8460c8f7ef00d0a870bc3c41
SHA512 23a2cdf4a684e376f4b8b723d27da0a9c2481574ece990b7bac029fb7af59407beea8c1149e00c3869788eee0339fdc1f6740f45af74abe97cb642676bb5fd84
TLSH
T11B114F96443F30AD5EF2EC18D0A4AE18FA46DD87DB7E447981441DAD0C4B7BFB0E1295
MD5 SHA1 SHA512 TLSH

Submit Download

client.exe

Path C:\Users\Admin\AppData\Roaming\client.exe
Size 483KB
SHA256 b7c60bc7570406370984e95e12934ecb7e935558d473e9444cee85951d202c67
MD5 3d9f8ae8d0d4c9238e86a11017cf8ead
SHA1 2de5befe8eadae9b86160fe9c79e8c3e2f8d0d90
SHA512 7b40fdb970dbff050ca8205d3064867b2d96b09ef580ba1c0d8562b6b635633743da49f9b4ab4294ba6ed2a518f524cad1031e8ee11a9eb0dd9be6d9bd2bce31
SSDEEP 12288:JHciCX/vien2BwZVkiqyIJ4tB67W/0la0:BlCPvgeZFUiula0
TLSH
T183B46B407BE40A11E2BF4F71A87635041A7DF8636A73D34E1AA1699C0D717F2CE24BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1872-63-0x000001ECD8F30000-0x000001ECD90F2000-memory.dmp

Download

memory/1872-61-0x000001ECD8D10000-0x000001ECD8D60000-memory.dmp

Download

memory/1872-65-0x000001ECD9630000-0x000001ECD9B58000-memory.dmp

Download

memory/4372-17-0x000001A0F4BC0000-0x000001A0F4BD0000-memory.dmp

Download

memory/4372-9-0x000001A0F4BC0000-0x000001A0F4BD0000-memory.dmp

Download

memory/5104-1-0x000001D113480000-0x000001D113490000-memory.dmp

Download

memory/5104-0-0x000001D112F30000-0x000001D112FAC000-memory.dmp

Download

memory/5616-958-0x00000240AE390000-0x00000240AE391000-memory.dmp

Download

memory/5616-959-0x00000240AE390000-0x00000240AE391000-memory.dmp

Download

memory/5616-956-0x00000240AE390000-0x00000240AE391000-memory.dmp

Download

memory/5616-957-0x00000240AE390000-0x00000240AE391000-memory.dmp

Download

memory/5616-962-0x00000240AE390000-0x00000240AE391000-memory.dmp

Download

memory/5616-961-0x00000240AE390000-0x00000240AE391000-memory.dmp

Download

memory/5616-960-0x00000240AE390000-0x00000240AE391000-memory.dmp

Download

memory/5616-950-0x00000240AE390000-0x00000240AE391000-memory.dmp

Download

memory/5616-951-0x00000240AE390000-0x00000240AE391000-memory.dmp

Download

memory/5616-952-0x00000240AE390000-0x00000240AE391000-memory.dmp

Download