e20249d5c5933e8204a0da141d7a66937a7c5c24819eeebae8b653ec41be665a

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b3dc07aab76fa54be44fc7519acc7e1.exe
Size 2.9MB
Sample260825-ryr9fazyev
SHA256 e20249d5c5933e8204a0da141d7a66937a7c5c24819eeebae8b653ec41be665a
MD5 0b3dc07aab76fa54be44fc7519acc7e1
SHA1 c6f12b5953f9faac40b2171b93c2e9acc7ba763b
SHA512 e946a02b0dd49e0d3ca785b0ede171e07260a106a2730070d1d1402b0a1f6236512a3265e934962778b6bad0c271d858f3cd42796b3e42bcd4fd3a687601e118
SSDEEP 49152:nEzGotZgwLc1102u/P2G/3NO0xmguW2WhoUzHnm+AYN6JSqsPji1aZI:PwLu1u3jAIruE+U7nm+l6/sPjiYZI
TLSH
T1E2E52393FB0A993BC4550437A9AC87231B85D3B0936C5B06A69031FE2E547E91F993FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 27 IoCs

description	pid	Process	procid_target
PID 3336 created 1652	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	91
PID 3336 created 1196	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	118
PID 3336 created 3132	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	119
PID 3336 created 1084	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	121
PID 3336 created 4596	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	122
PID 3336 created 1784	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	124
PID 3336 created 1456	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	125
PID 3336 created 3092	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	126
PID 3336 created 1196	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	118
PID 3336 created 1196	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	118
PID 3336 created 4596	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	122
PID 3336 created 4596	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	122
PID 3336 created 716	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	93
PID 3336 created 5324	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	134
PID 3336 created 4316	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	135
PID 3336 created 5928	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	136
PID 3336 created 5908	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	137
PID 3336 created 5900	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	138
PID 3336 created 5792	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	141
PID 3336 created 6020	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	142
PID 3336 created 6076	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	143
PID 3336 created 2524	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	149
PID 3336 created 2836	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	150
PID 3336 created 5324	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	134
PID 3336 created 5324	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	134
PID 3336 created 5928	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	136
PID 3336 created 5928	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	136

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 3336 created 3276	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	56
PID 3336 created 3276	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	56
PID 3336 created 3276	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	56
PID 3336 created 3276	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	56
PID 3336 created 3276	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	56

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1448	msedge.exe
5080	chrome.exe
4596	chrome.exe
5928	msedge.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0b3dc07aab76fa54be44fc7519acc7e1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0b3dc07aab76fa54be44fc7519acc7e1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321422131940018"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{30AA074A-234B-491A-BD1B-8D7F5B2FD938}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
2652	chrome.exe
2652	chrome.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
1196	chrome.exe
1196	chrome.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
3336	0b3dc07aab76fa54be44fc7519acc7e1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
2652	chrome.exe
2652	chrome.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
2652	chrome.exe
4180	msedge.exe
2652	chrome.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
1196	chrome.exe
1196	chrome.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2652	chrome.exe
Token: SeCreatePagefilePrivilege	2652	chrome.exe
Token: SeDebugPrivilege	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe
Token: SeShutdownPrivilege	1196	chrome.exe
Token: SeCreatePagefilePrivilege	1196	chrome.exe
Token: SeShutdownPrivilege	1196	chrome.exe
Token: SeCreatePagefilePrivilege	1196	chrome.exe
Token: SeShutdownPrivilege	1196	chrome.exe
Token: SeCreatePagefilePrivilege	1196	chrome.exe
Token: SeShutdownPrivilege	1196	chrome.exe
Token: SeCreatePagefilePrivilege	1196	chrome.exe
Token: SeShutdownPrivilege	1196	chrome.exe
Token: SeCreatePagefilePrivilege	1196	chrome.exe
Token: SeShutdownPrivilege	1196	chrome.exe
Token: SeCreatePagefilePrivilege	1196	chrome.exe
Token: SeShutdownPrivilege	1196	chrome.exe
Token: SeCreatePagefilePrivilege	1196	chrome.exe
Token: SeShutdownPrivilege	1196	chrome.exe
Token: SeCreatePagefilePrivilege	1196	chrome.exe
Token: SeShutdownPrivilege	1196	chrome.exe
Token: SeCreatePagefilePrivilege	1196	chrome.exe
Token: SeShutdownPrivilege	1196	chrome.exe
Token: SeCreatePagefilePrivilege	1196	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4180	msedge.exe
2652	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
1196	chrome.exe
5324	msedge.exe
5324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 2652	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	88
PID 3336 wrote to memory of 360	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	89
PID 3336 wrote to memory of 4180	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	90
PID 2652 wrote to memory of 1652	2652	chrome.exe	91
PID 360 wrote to memory of 1520	360	firefox.exe	92
PID 360 wrote to memory of 1520	360	firefox.exe	92
PID 4180 wrote to memory of 716	4180	msedge.exe	93
PID 4180 wrote to memory of 1448	4180	msedge.exe	94
PID 4180 wrote to memory of 4292	4180	msedge.exe	95
PID 4180 wrote to memory of 4292	4180	msedge.exe	95
PID 4180 wrote to memory of 4292	4180	msedge.exe	95
PID 4180 wrote to memory of 3612	4180	msedge.exe	96
PID 4180 wrote to memory of 3612	4180	msedge.exe	96
PID 2652 wrote to memory of 4384	2652	chrome.exe	97
PID 2652 wrote to memory of 5080	2652	chrome.exe	98
PID 2652 wrote to memory of 4384	2652	chrome.exe	97
PID 2652 wrote to memory of 2160	2652	chrome.exe	99
PID 2652 wrote to memory of 2160	2652	chrome.exe	99
PID 4180 wrote to memory of 4780	4180	msedge.exe	100
PID 4180 wrote to memory of 4780	4180	msedge.exe	100
PID 4180 wrote to memory of 4780	4180	msedge.exe	100
PID 4180 wrote to memory of 4316	4180	msedge.exe	101
PID 4180 wrote to memory of 4316	4180	msedge.exe	101
PID 4180 wrote to memory of 4316	4180	msedge.exe	101
PID 2652 wrote to memory of 732	2652	chrome.exe	102
PID 2652 wrote to memory of 732	2652	chrome.exe	102
PID 2652 wrote to memory of 4784	2652	chrome.exe	103
PID 2652 wrote to memory of 4784	2652	chrome.exe	103
PID 4180 wrote to memory of 668	4180	msedge.exe	108
PID 4180 wrote to memory of 3244	4180	msedge.exe	110
PID 4180 wrote to memory of 3012	4180	msedge.exe	111
PID 4180 wrote to memory of 668	4180	msedge.exe	108
PID 4180 wrote to memory of 668	4180	msedge.exe	108
PID 4180 wrote to memory of 3244	4180	msedge.exe	110
PID 4180 wrote to memory of 3244	4180	msedge.exe	110
PID 4180 wrote to memory of 3012	4180	msedge.exe	111
PID 4180 wrote to memory of 3012	4180	msedge.exe	111
PID 4180 wrote to memory of 2448	4180	msedge.exe	106
PID 4180 wrote to memory of 2448	4180	msedge.exe	106
PID 4180 wrote to memory of 2448	4180	msedge.exe	106
PID 4180 wrote to memory of 4692	4180	msedge.exe	105
PID 4180 wrote to memory of 4692	4180	msedge.exe	105
PID 4180 wrote to memory of 4692	4180	msedge.exe	105
PID 4180 wrote to memory of 2892	4180	msedge.exe	104
PID 4180 wrote to memory of 2892	4180	msedge.exe	104
PID 4180 wrote to memory of 2892	4180	msedge.exe	104
PID 2652 wrote to memory of 2236	2652	chrome.exe	109
PID 2652 wrote to memory of 2236	2652	chrome.exe	109
PID 4180 wrote to memory of 2112	4180	msedge.exe	112
PID 4180 wrote to memory of 2112	4180	msedge.exe	112
PID 4180 wrote to memory of 2112	4180	msedge.exe	112
PID 4180 wrote to memory of 3784	4180	msedge.exe	113
PID 4180 wrote to memory of 3784	4180	msedge.exe	113
PID 4180 wrote to memory of 3784	4180	msedge.exe	113
PID 2652 wrote to memory of 1408	2652	chrome.exe	107
PID 4180 wrote to memory of 868	4180	msedge.exe	114
PID 4180 wrote to memory of 868	4180	msedge.exe	114
PID 4180 wrote to memory of 868	4180	msedge.exe	114
PID 4180 wrote to memory of 3240	4180	msedge.exe	115
PID 4180 wrote to memory of 3240	4180	msedge.exe	115
PID 4180 wrote to memory of 3240	4180	msedge.exe	115
PID 2652 wrote to memory of 1408	2652	chrome.exe	107
PID 3336 wrote to memory of 1196	3336	0b3dc07aab76fa54be44fc7519acc7e1.exe	118
PID 1196 wrote to memory of 3132	1196	chrome.exe	119

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3276
- C:\Users\Admin\AppData\Local\Temp\0b3dc07aab76fa54be44fc7519acc7e1.exe
  "C:\Users\Admin\AppData\Local\Temp\0b3dc07aab76fa54be44fc7519acc7e1.exe"
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tskAp\0cf2d3c5"
    3⤵
    PID:3484
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7"
    3⤵
    PID:968
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\tskAp\b2c25dc9"
    3⤵
    PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffd22b8c728,0x7ffd22b8c734,0x7ffd22b8c740
    3⤵
    PID:1652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,9447489897679996461,8824455732801160111,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1912 /prefetch:2
    3⤵
    PID:4384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7" --force-high-res-timeticks=disabled --field-trial-handle=1916,i,9447489897679996461,8824455732801160111,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1996 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7" --force-high-res-timeticks=disabled --field-trial-handle=1916,i,9447489897679996461,8824455732801160111,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2568 /prefetch:8
    3⤵
    PID:2160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1916,i,9447489897679996461,8824455732801160111,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3076 /prefetch:1
    3⤵
    PID:732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1916,i,9447489897679996461,8824455732801160111,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1916,i,9447489897679996461,8824455732801160111,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3520 /prefetch:2
    3⤵
    PID:1408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1916,i,9447489897679996461,8824455732801160111,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:2236
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\0cf2d3c5" about:blank
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir=C:\Users\Admin\AppData\Local\tskAp\0cf2d3c5 about:blank
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\tskAp\b2c25dc9 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffd1552c188,0x7ffd1552c194,0x7ffd1552c1a0
    3⤵
    PID:716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2120 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2804 /prefetch:8
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3960 /prefetch:1
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3984 /prefetch:2
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3992 /prefetch:1
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4288 /prefetch:1
    3⤵
    PID:668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4276 /prefetch:2
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4332 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4344 /prefetch:2
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4312 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4352 /prefetch:2
    3⤵
    PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\tskAp\b2c25dc9" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2080,i,15530904832343493943,13373510132841742367,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4208 /prefetch:2
    3⤵
    PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd22b8c728,0x7ffd22b8c734,0x7ffd22b8c740
    3⤵
    PID:3132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1748,i,4777002928538085906,16644116194448356944,262144 --field-trial-handle=1992,i,18145261182260870649,17344095918774754997,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
    3⤵
    PID:1084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,15228090448594985473,16434636484495604597,524288 --field-trial-handle=1992,i,18145261182260870649,17344095918774754997,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2156 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,5237430160666963838,5548079263036940809,524288 --field-trial-handle=1992,i,18145261182260870649,17344095918774754997,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2696 /prefetch:8
    3⤵
    PID:1784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3048,i,15276821286256416482,13934319003407269609,2097152 --field-trial-handle=1992,i,18145261182260870649,17344095918774754997,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:1456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3012,i,646902867985006772,12256684296412973244,2097152 --field-trial-handle=1992,i,18145261182260870649,17344095918774754997,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:3092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5160,i,6860600777998647479,2514941087952558537,524288 --field-trial-handle=1992,i,18145261182260870649,17344095918774754997,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7ffd1554c188,0x7ffd1554c194,0x7ffd1554c1a0
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,12664915673135356727,3207971893245910284,524288 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1812,i,417200206041113843,4619404407212358756,262144 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:2
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,13525662659812531562,15632895027533104246,524288 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:8
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3316,i,15492771894000356509,14450367628211767461,2097152 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,3619268026477925322,10333746303662813527,2097152 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4024,i,7236808980780947386,2815137579954055232,2097152 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4036,i,511315930799698926,15570532882566102172,2097152 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,3551268706287191866,17373595410822815101,524288 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,13417979557977133811,3276912017710428399,524288 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,5323125867171765057,3772398456539880319,524288 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,16843220718792303226,10684900181678762233,524288 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,4463984648227907996,1822950848968476576,524288 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
    3⤵
    PID:1260
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,4463984648227907996,1822950848968476576,524288 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,3909446190920125228,1579830570238441888,524288 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,16823712825435906306,5062990133871830434,524288 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,14771641087660783020,9652758542217663492,524288 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,2054749330673944726,11454367478182229616,524288 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,7635931638148491360,651840884970603302,524288 --field-trial-handle=2904,i,1131602637537431404,16394436502432108821,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
    3⤵
    PID:5236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09ddaad5

Path C:\ProgramData\093791aa508\09ddaad5
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

178c718f

Path C:\ProgramData\093791aa508\178c718f
Size 224KB
SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
MD5 4e19802d3c83e4dcd771f44517162143
SHA1 2323b0978ecbcf19633a4e710e70a07534558024
SHA512 9d5b3bfb0f9afdcaeb972abacc44c183954c3200c3afeadc2691cb5a78662bc5d9a7cb6fbc9b7cfdc8e86e05c91eabf88f7619775160d7477522a1fd40c918b0
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v:61zkVmvQhyn+Zoz67
TLSH
T16524D086AC04F52ACF4B3430E6834DF37E51520443486A76CABC0E7F1DB520E9B988E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21cbe932

Path C:\ProgramData\093791aa508\21cbe932
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

524c2010

Path C:\ProgramData\093791aa508\524c2010
Size 20KB
SHA256 6184646e5e6b42e8f7a0be57724ea9c0505c84408a295abb49388e1126237efa
MD5 f0d7123510d3d0f2d891f76c72fcc81a
SHA1 9f7eb303af244ea907a103ad156544fc8773f843
SHA512 bbbcaea50f56dc9c196a9f43646e19f1b83823821562f0f1b29b78279c9ab95a87d9be2af0a85ab501dd19a5aee7cfe5ef6469a636f86355310548f4aeeb5000
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBNd5V9u0UWGzebj:TeW9aw/aHLopFMavU1iBNHbuzWGA
TLSH
T11592EF8F1F307214C8F45732E9C2455B1E7C213C8323B98AAD5064F38C9559BF5051E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

605b2302

Path C:\ProgramData\093791aa508\605b2302
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65385cd0

Path C:\ProgramData\093791aa508\65385cd0
Size 5.0MB
SHA256 a31bdd606824150ebe6074cda64c9697216a027005b88c6198460d39c36ce75d
MD5 b69e5ad2f9ac5530d8f2460e0fb9c685
SHA1 3d794410a0fc4e01f6edcdbd57c981b506d43660
SHA512 5f18f30e0f7c76012fda324223f0ac292944d412548208b9b6101a54ea1ad73377401aa438648d4c4a4736ca9116f882e713ec395e7f14478601911c31e1bb98
SSDEEP 192:M8rJQaXoMXp0VW9FxWHD0sFD57QmpYU/Zm:M8r54w0VW3xWjt1
TLSH
T14536201F7A205054C4DAA232ADE31F295C3F71168A3736933EA4556D4DE0723B92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79f73cdb

Path C:\ProgramData\093791aa508\79f73cdb
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afdb8836

Path C:\ProgramData\093791aa508\afdb8836
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd2791f9

Path C:\ProgramData\093791aa508\bd2791f9
Size 288KB
SHA256 be84d7d1836dd687624934f96eecd5d1533dc3ba611926f18822bf4d316a0e99
MD5 0694f4bc805510115f11a279d4303731
SHA1 d124953b8b1a439ddcb31515f33112890b3640e7
SHA512 9d8920a5de19ea0f2cda9472574c99eb9e4c72d88a84cf33421adb5161d2a939dac7c7035c6b04906f403caf73f417b0230a8569aeb4e61b885c520d17fcc862
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vP9+C/RC:f1zkVmvQhyn+Zoz67y9T/RC
TLSH
T17954B946ED84F10ADB1A6830C6454DF36A11AB0447815E2BDBFC1E3E1EB164DBAAC6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfcd1324

Path C:\ProgramData\093791aa508\cfcd1324
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbb9b02f

Path C:\ProgramData\093791aa508\dbb9b02f
Size 138KB
SHA256 8557f90c38f7d05792217c45dae6269a0f753e652f283c29ad5a574de99ef36b
MD5 236fbfbdd9c6b4e447334ed529e2f41f
SHA1 7341860176b9eeb92ac86bb5d90509bb315e60ce
SHA512 f09ef426354f3f2b92a0993c152dfc665a3314e4cc7c0814afb76138e661c1dd5d502e4b3bdd71c7a3852457985c347cdbc3b9c54107e1b3ceb7c44c0088ad84
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2O3HVumTny4a4:FnbZeMrv/hGt3/ny4X
TLSH
T19FD3974B3A743002EDE59A722CF051BB5D3CB16D4F51A5D428B620688EF2863B63D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddffe845

Path C:\ProgramData\093791aa508\ddffe845
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6363b8f5cde5fc336d8e1ba939e42ed2cede0ee1b38a46778ed507210d878149
MD5 7e25bd1681b99ecda5cb54c9b813544a
SHA1 43fd85c815cbeed1fab20f1716391b9ae94556ba
SHA512 44cb3e6e080d52f31ee4265750b1d748cc073faa813bc121ca3501d3eee1cdd50405e3ad29cede1c7d0388a9003ab5e3be8cec9eb8bba3e14709b4cfd9f25114
TLSH
T14DE02BAAD935AC275DF9476C50504B4BEB4013573B81C94F3A3CC109CFB5B3B054981C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7ddd98c935566eff24db15aaa3ecb58866c1157bd64a11a4792be1f61f1e3abc
MD5 69499f68a7cafdca45f128182c3b96fd
SHA1 0de6dbd48670aa0d42e5109d09e83d7606016a44
SHA512 16c3de39e205fdb930760f416bf1ab12fdeaf1aba0ef4439645fc61a82ebf188feb7b713a0cced481be777f531a37c1a765c1ffed148adc15d18dde3b664ef08
SSDEEP 192:/ReMxguv78pAPRp209DHsb+WNnalP6QgiTfa0YVyIsnAUgtaJ:/ReM2K4UXD5wMP6W7az8
TLSH
T19F42D72EB914393B6CDBD21AFE667753D3F6102161952E84EAFC892C14DB5CC322B11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 facc731f9a7599570d03a4b0825dfb526741a7d6872176e4b76c8e54bac03d91
MD5 2c6097c41e00cad46c3a603bb6a832d4
SHA1 4bed4cb22462c3c8c10938771a8b9c20a0f4a588
SHA512 658a634c50828b7b307f6b5c9ad2b6a5c7649b69e9af0bd64589970bd26482f0b5e9520d7cc1090a77f7d529b040a418a7c8b2504e004c93323d1c32fddb69c2
SSDEEP 6144:361MqKAM7YMrAukqqwEKTYeVvm7Rkm1tYpBeh2BAoC:3yVKAMFrAubqsTYeVe9oBGcAoC
TLSH
T15634230BBE28B63719E6EB1AA50F0E5F0E766DD9C411CDD54AC75C0193AA7DC060AE34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 28feb191cf36ecd4f98db66c07eb22f37a9f478c714bb6c66cf4f8e6f60784f9
MD5 c1f4e5ca2a9711eb617e2f6576ed4718
SHA1 29029758d05c4a0f1cdb7006191659e22cd1c6e5
SHA512 1e5469415495560e83e2eb5af1f6b2cf27829f8d5dba83c613726207b575405be37864aefb293c77f2a78395783ffb3d8ef8a8010f59315fedfbe6dcec555507
SSDEEP 3072:TGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:qm7Rkm1tYpBeh2BAoO
TLSH
T117C3123B5D65E9375D79A70EB48E0B1E1EF24DA6C930DE42C8D46A0437FA7CC1944A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

2be54b93-0acf-4bee-a90e-02d5f4a539af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2be54b93-0acf-4bee-a90e-02d5f4a539af.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b3fda145d5845d6e77be6f06750da01d84b232e9985bd7bfe345fbd4a02c4758
MD5 cc4d3c9094b4a6ded43ccebb65fe155c
SHA1 281a6ebb5e9feede96bb03f82a6a61cdd90ed6c6
SHA512 b4d294fafeed98248ef7bb12f8f88ab6c5df9590319dba32136cc5e51cb49d2eda58180e29ac71a3dbd36a634593ae2aa565c64025fad87320d2221e0cee2d1e
SSDEEP 192:sxZwURQiy/f0sW8+B0lIdpJHW6+WNGYCTf/VIg4J:sxZwUny/f0sW8c0WJHbGnRc
TLSH
T17122B7526E28A5374CC7E319BB25BF03E7F9503250951E58EAFCC61C05E6ADD220B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 43c2a60140b02ed9541448cc8b1b169ae372d678a3d1cb2500fc3a1da6012428
MD5 92a746e80d311507c7609ee2f97fb818
SHA1 6a26b02071120022b4268fdd79fb141fc04303d1
SHA512 086a6291eabcd1c83357f3381e6a43d5e3400887b31c4b53f805bd1a5f23e9203d9ae87c4a783b9bff9d66dee16ec6e742b0a63acf910c5d0721c535185be521
SSDEEP 768:GiqbUyl7pLuLze+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OV9UbZLlRTKr5rom:GiqbUyzEze+WvSCs6u1jaMUbZLbWrym
TLSH
T1D1E2FB7B380CCA7E4F804E9DDD1A7F9F6EA8028B5698C94447F9945C02C76EE512B0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ca56c4d2537160946bc96090e6abb41bf6fe9b35e2e14d73a8d1ddd43385b438
MD5 49b985a61c6d75bfc1fe7b411b313889
SHA1 ca8e342362dadb1fe7877362d21fef5203f9e9cc
SHA512 062f3f520fe65be557a4b095a1c7bfe1ffb1e48fc176d43d68492a0e43923e6f1904e9f2fbeb8593675469ed7f02425033e09e23ed8172bee2694acdb965af8b
SSDEEP 48:KQJI5Ky8sjyhOIXKzacnyhjgXz1xFgRZSzI+bgKz1btgHrwsCNU:KQJSKy8KyOIKzam64YKBWp
TLSH
T18791E01A303A4292687E2588F3979A362F4235A33154E86F7FB804921F67E124CFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 29e6d8c741c4048fbcf7bcd6aef004223e5cf1580b2b732e4cf1af3153a4f65a
MD5 e06033d2ac99893b2f69acb1babd1f72
SHA1 17f86a33c09205087feeba882d016b77e846ad2c
SHA512 e2686440cf9c9c236027d891f6ca8d1929501fa2112d036e242321042c76ceacdf8dc675526db480773169ed6490346c429bf822633500ac58c44816f31673df
SSDEEP 384:nTZcIhsNzDCHzmEa+SdPId+2Wtive+aOoH:Lh51an2dlWtiGlOo
TLSH
T1C0829D305C385C7259FAEA45F8877A179FF8607789CE2E54D9DCCF1C0096A98230B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6fe10c77aa6e805e76bbf05ead44373d88d41965d9e1148bcb20fbc926a9d186
MD5 b219acc1e221118677a2b1114a901b9a
SHA1 b06eb137414270ebcf1aec201497553165a47c4e
SHA512 21e86a9c8ad9b53e3d705351846a8ec9f13ff6007f35d6a9643ad30201215294e5f92023f60c86bcf885f3a946fc384a4553aec8f3667796de3b64f5022ddcd8
SSDEEP 192:vONGV6Db6QmiUyT7HBa+jx+FdCYHojRgIipU6:vONY6uaHBa+SdPIaNpU6
TLSH
T15202E83568786CB79EF26E49F8876B239FD4117BD9962B44DAEC4F0C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 77deca4fe3b5bc3ddd76bbdd8f6a208520f86c42c2fcd2eac47c653b3ab2f2aa
MD5 1e25a864a793b40ed872c3e7e3183804
SHA1 17ac521102bf0556154b1883a86ccbf1a718d434
SHA512 d60759fd05a69aa605e6d81cc1770f7298a4b82d97bbb9b4aaeb1e3d08f10dcafea739b5d45cf4ee5acf984fcc642ed6b6801a7b642cd084040dc857084b6640
SSDEEP 192:9ONu6DbaQmiUy47yBa+jx+FdCYHodX+2uNzdq8U6:9ONu6OlyBa+SdPId+2StU6
TLSH
T1BD12F935683C6C678EE2AE45F4877A139FD41167D98B2F95DAE84F0C00D7A5C230B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e2c3c4a-824b-4806-906c-2528d014198a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1e2c3c4a-824b-4806-906c-2528d014198a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c4cbdb878f953fb865f0703bf9485946a53200eca8e2245b5d0f975fe53877c3
MD5 31812505517ed5c6e50845ba8e2f13bc
SHA1 37e8b7b2d0fff1c17f92f869058978facc271a0d
SHA512 cbe02d0074dc9d4f3b788e3d11087e775c32c61e9ad7c17adae42a0479dd85d058b7018b27dc7a6f5588712eb4596f8d7758bd35e71cc567e209c715e0e7d2f4
TLSH
T18741455CB6FA1044B3B36E5AABF7A86E487F79772E06D45D00110E8E4A63F40D861737
MD5 SHA1 SHA512 TLSH

Submit Download

6c5a1973-b7df-4c00-b3cb-9fc3e9b13664.tmp

Path C:\Users\Admin\AppData\Local\Temp\6c5a1973-b7df-4c00-b3cb-9fc3e9b13664.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

c508cd5b-7ffd-4a1a-a311-b9fda2d1935d.tmp

Path C:\Users\Admin\AppData\Local\Temp\c508cd5b-7ffd-4a1a-a311-b9fda2d1935d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5324_1069177529\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9374169f-f2c7-4ed0-abe8-0021cfa88cec.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5324_79993924\9374169f-f2c7-4ed0-abe8-0021cfa88cec.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7\Crashpad\settings.dat
Size 40B
SHA256 9d7f2183d5ea0026a7e9510fd547c4509047f046d0535b907c85f1a9566e5698
MD5 24ee6800a0315938989faeb2f000125a
SHA1 cf4092670a96c5efa19da4e1da360569645ea2ae
SHA512 51bc4c108b240be6da09469705932924d486546d92c4b1097ce26c5989675077dbf06b7c288a848436e6e18062fb1b69caa209363f278b2c799670736f0ccc2e
MD5 SHA1 SHA512

Submit Download

ACCOUN~1

Path C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7\Default\ACCOUN~1
Size 76KB
SHA256 4f3e18eea355690c25b4de99b18e90f0c81cbb088228ffca12c84a53c6dff98f
MD5 b89fd902b32528a846212c73a9bfbe73
SHA1 b2bc3a06c5bf56df8b8245e2947e7f78fb6a416d
SHA512 ae387b21b2d3801abe3543f23d1705b51982e4f076c923cfee764f3ea525ce276d8360623be00d402ed7c804f801e36ba42b68d32a5f6e856e153d6b96ea750b
SSDEEP 96:pv+kOyOFXmT7i04MDDPtg3IM8n0ys5bSAoFLoeqclNz58rx2n:pln06Ca
TLSH
T15A73224A7A342505EDE28A362CF090F75D7C722D8F01A9412DA73028CDA5897F23A4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AFFILI~1

Path C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7\Default\AFFILI~1
Size 52KB
SHA256 4cb381b1a653296a38381f16bfd94dd09b9c900c0ed24eb532d372d647bcb96e
MD5 142456354ac4a1d7e89f037c2ebda0a2
SHA1 60b5e6036da7c3c1e4e10dc04c319e55cd125152
SHA512 cad919e47513bfbc050db3a996811643f5381ecbe3224c5ed34bf7dcfdec993d7a5e0af674f36625648866b4fad55578ab7427be38c17f6d9eb74403da02960d
SSDEEP 24:TL9VAlZGUWEKdPq9XUeS0z8jNvN2HhKroyr0d8D4BmhltoVOq6Uwccm5fBGQww:TbBzdPqJZSm86Uu8baVOlU1cWB
TLSH
T18F33DF061B685434C9ADD23498D90EE279B4126FD9D1E9A42DFC1D190FE04546CFD46B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\tskAp\8f0eb1c7\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Crashpad\settings.dat
Size 280B
SHA256 4be38b9c907168243ddc1c2636f5f443c18d3c6f3b23b7221a2de888ea75fa10
MD5 d0c224111667cac7c64fb2dd2161b006
SHA1 817aebb198bab79e515da33b77a08aa0b09ef815
SHA512 7ec5c7997a190397cba753e8eb61e6cbad16779c5055ff713eaf08f484298fa518b03e806a07739dfe460711ebf50b0ef8f524444c176e79fd66bda565fea32d
TLSH
T1A2D0041F77031001D7541531401047001104C444014701004414454DD545000CCC5574
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Crashpad\settings.dat
Size 280B
SHA256 287e0d669894940c7b90cac7af9e758a4046a65cb2f1c5081a908873c820ee61
MD5 8a27e799ac7588b6616acd7350c4021c
SHA1 c37df22ca8db88b450249b6f59c1e1f784f03af8
SHA512 0c7936b1b4034bbc395f4064024f8caf14842aa7f812e28302ac532e5904285e27bc0978221840259a046f2b1c9c47f778277830aa4f291585f4b09675d1f12f
TLSH
T1FFD02435F7013047F3C104355031CF0C310DC454157F0400C415C7CDD44700044553F0
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

ARBITR~1.JSO

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Default\ARBITR~1.JSO
Size 18KB
SHA256 4f80297878efc766ea56228d59d559df416d36f3911a2ee240ba81a4eb27ca0f
MD5 0a4dfb2ee74365913fccd8dd47c41600
SHA1 7b99062fdbc83cd072d84457ed071c549eb2dfa7
SHA512 778351717d71b5b21f9be013dc112f0596c1b667fa450e2913d413e56183d115379b04de51b6d6e456459ec0be7338db03924ad05c2e60192026a676e7ad0b8b
SSDEEP 192:vQeqfRR+nft0joCxc/i4utSfnwzjOq52ef8Hw54ecoaSbqG/I5zT85:vQeiKF0jojq4uGE18efsSraSbqG/H
TLSH
T1C392D251FD5B7D6F7BBAC0346A9468075CAA475EA870900AF2BCCD049FEDF240216D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Default\Cache\CACHE_~1\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Local State
Size 3KB
SHA256 89020e78c30c20bbdae649a69c93719e109187f2e1b6ddbdf847e311b7d2011d
MD5 80432c180de13febfc167441df84ee05
SHA1 709dddd694e25a1a53c3903deb4a2a7f047ef5a2
SHA512 ec7692e16493c28ec1ed2e548412a1b43f28566d285571d563173077b25663e2d3c6ee431ace23a6154cf0efdc0f7d25e5e96c187ae129c1b0d8055f7035f6cb
TLSH
T18281B6736824EC7B5ED20E84F18A25039E78D217DA557F8051DC231C05FF16CA30E86B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Local State
Size 4KB
SHA256 c544b151b8302078da0f0123b670f12e42d2376747a253d6a8b143d49a606bac
MD5 141fb8158895ff9754fa4162d93969ac
SHA1 807a84993616d57b93c542c1be8d242d2998e6c2
SHA512 0dd877c2b5779274e7292e7929d1fe3e877505ef9332dc551e140762d7373eaef043bbfb78d7f8cbcde44e8548bd6449c90869e213ef907c503c31ebc184d2eb
SSDEEP 96:LSqGNkPQsFfATNlloXf58Frh/cInURoDotov7ZDLBS9v6UZ9V6JK0eUc62SDS4Sa:LpGNH3hoyooDUwF1Q9j16X
TLSH
T16DA1C8736464EC6B5EE25D44F5CA2603AFB4D227EA997F85C1EC2A0C05FF29C530A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587376.TMP

Path C:\Users\Admin\AppData\Local\tskAp\b2c25dc9\Local State~RFe587376.TMP
Size 1KB
SHA256 3cc52357fffe8a45c020f129d4c156a4f961c02407078a7910467eb6e284d609
MD5 fbccc2ea1aec1642fecf9fe69777626d
SHA1 ece10ec978dfddb40dbb2f9893e6cdd1c41067dd
SHA512 05441120d7750790daef4ae34d9ed65bfd45f1f593f5f7892cd58af104a0f825f0545c9dac8cca781beae3b1132d4a9f567924a57902ba5d8fd4fd8098bd018f
TLSH
T17E319771B85CACB7ACD10E46A3CE6B936F346176C5625D4581DC590D44EB18C271F83B
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download