milleniumrat | cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448.exe
Size 2.4MB
Sample261016-rrmelsvxev
SHA256 cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448
MD5 2a13c82baacd5251b47a15255217d0a2
SHA1 77413ad0948a40d31d826e42f294d80f9df8ca11
SHA512 ebf06d692a54549280fdc9caf8d80b0636a2769b1d30d7d3115fbbe37a3c2cc44142b882f603f0756f087580057a7f3d15efcb25463c221ad0faf0b60b16c36b
SSDEEP 49152:5fC7+hLkJiLw/KtbDITXjJG0zvq8ulcdhhtosT1MNMMnMznc2F:SoLr9DITjJG0boO1BHb
TLSH
T1CCC59E22FB8290B2E4D601B062BE6BF75D797234132558CBE3C01D6A59206D3763AF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution milleniumrat rat spyware stealer

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4be-0.dat	family_milleniumrat

Uses browser remote debugging 2 TTPs 19 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2136	chrome.exe
4076	chrome.exe
4056	chrome.exe
3572	chrome.exe
4768	chrome.exe
5668	msedge.exe
2832	msedge.exe
3016	msedge.exe
5596	chrome.exe
1108	chrome.exe
256	chrome.exe
4740	chrome.exe
5412	chrome.exe
5728	chrome.exe
3520	chrome.exe
4224	msedge.exe
4820	msedge.exe
6080	chrome.exe
240	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
4920	vshost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
8	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c4be-0.dat	suspicious_telegram_bot

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	vshost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2160	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vshost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vshost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3372	chrome.exe
4448	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
712	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
6080	chrome.exe
6080	chrome.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe
4920	vshost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
6080	chrome.exe
6080	chrome.exe
6080	chrome.exe
6080	chrome.exe
6080	chrome.exe
6080	chrome.exe
6080	chrome.exe
6080	chrome.exe
6080	chrome.exe
6080	chrome.exe
6080	chrome.exe
6080	chrome.exe
6080	chrome.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	vshost.exe
Token: SeDebugPrivilege	4920	vshost.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeShutdownPrivilege	6080	chrome.exe
Token: SeCreatePagefilePrivilege	6080	chrome.exe
Token: SeDebugPrivilege	4920	vshost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6080	chrome.exe
4224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 4920	5800	cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448.exe	90
PID 4920 wrote to memory of 6080	4920	vshost.exe	91
PID 6080 wrote to memory of 1576	6080	chrome.exe	92
PID 6080 wrote to memory of 3372	6080	chrome.exe	93
PID 6080 wrote to memory of 4316	6080	chrome.exe	94
PID 6080 wrote to memory of 4316	6080	chrome.exe	94
PID 6080 wrote to memory of 1392	6080	chrome.exe	95
PID 6080 wrote to memory of 1392	6080	chrome.exe	95
PID 6080 wrote to memory of 240	6080	chrome.exe	97
PID 6080 wrote to memory of 240	6080	chrome.exe	97
PID 6080 wrote to memory of 256	6080	chrome.exe	98
PID 6080 wrote to memory of 256	6080	chrome.exe	98
PID 6080 wrote to memory of 4740	6080	chrome.exe	99
PID 6080 wrote to memory of 4740	6080	chrome.exe	99
PID 6080 wrote to memory of 5852	6080	chrome.exe	100
PID 6080 wrote to memory of 5852	6080	chrome.exe	100
PID 6080 wrote to memory of 3760	6080	chrome.exe	101
PID 6080 wrote to memory of 5412	6080	chrome.exe	102
PID 6080 wrote to memory of 2136	6080	chrome.exe	103
PID 6080 wrote to memory of 5412	6080	chrome.exe	102
PID 6080 wrote to memory of 2136	6080	chrome.exe	103
PID 6080 wrote to memory of 5672	6080	chrome.exe	106
PID 6080 wrote to memory of 4076	6080	chrome.exe	105
PID 6080 wrote to memory of 3572	6080	chrome.exe	107
PID 6080 wrote to memory of 5672	6080	chrome.exe	106
PID 6080 wrote to memory of 4076	6080	chrome.exe	105
PID 6080 wrote to memory of 3572	6080	chrome.exe	107
PID 6080 wrote to memory of 4768	6080	chrome.exe	109
PID 6080 wrote to memory of 4768	6080	chrome.exe	109
PID 6080 wrote to memory of 5728	6080	chrome.exe	110
PID 6080 wrote to memory of 5728	6080	chrome.exe	110
PID 6080 wrote to memory of 5596	6080	chrome.exe	111
PID 6080 wrote to memory of 5596	6080	chrome.exe	111
PID 6080 wrote to memory of 3520	6080	chrome.exe	112
PID 6080 wrote to memory of 3520	6080	chrome.exe	112
PID 6080 wrote to memory of 3516	6080	chrome.exe	113
PID 6080 wrote to memory of 3516	6080	chrome.exe	113
PID 6080 wrote to memory of 2708	6080	chrome.exe	114
PID 6080 wrote to memory of 2708	6080	chrome.exe	114
PID 6080 wrote to memory of 4056	6080	chrome.exe	115
PID 6080 wrote to memory of 1108	6080	chrome.exe	116
PID 6080 wrote to memory of 4056	6080	chrome.exe	115
PID 6080 wrote to memory of 1108	6080	chrome.exe	116
PID 4920 wrote to memory of 4224	4920	vshost.exe	117
PID 4224 wrote to memory of 4840	4224	msedge.exe	118
PID 4224 wrote to memory of 4448	4224	msedge.exe	120
PID 4224 wrote to memory of 1460	4224	msedge.exe	121
PID 4224 wrote to memory of 1460	4224	msedge.exe	121
PID 4224 wrote to memory of 1460	4224	msedge.exe	121
PID 4224 wrote to memory of 5668	4224	msedge.exe	123
PID 4224 wrote to memory of 5668	4224	msedge.exe	123
PID 4224 wrote to memory of 5668	4224	msedge.exe	123
PID 4224 wrote to memory of 4820	4224	msedge.exe	124
PID 4224 wrote to memory of 4820	4224	msedge.exe	124
PID 4224 wrote to memory of 4820	4224	msedge.exe	124
PID 4224 wrote to memory of 3564	4224	msedge.exe	122
PID 4224 wrote to memory of 3564	4224	msedge.exe	122
PID 4224 wrote to memory of 2832	4224	msedge.exe	126
PID 4224 wrote to memory of 3016	4224	msedge.exe	125
PID 4224 wrote to memory of 2832	4224	msedge.exe	126
PID 4224 wrote to memory of 2832	4224	msedge.exe	126
PID 4224 wrote to memory of 3016	4224	msedge.exe	125
PID 4224 wrote to memory of 3016	4224	msedge.exe	125
PID 4224 wrote to memory of 5524	4224	msedge.exe	127

C:\Users\Admin\AppData\Local\Temp\cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448.exe
"C:\Users\Admin\AppData\Local\Temp\cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Users\Admin\AppData\Local\Temp\GqDEf0RiiqM\vshost.exe
  "C:\Users\Admin\AppData\Local\Temp\\GqDEf0RiiqM\vshost.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff95f6ec728,0x7ff95f6ec734,0x7ff95f6ec740
      4⤵
      PID:1576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:11
      4⤵
      System Time Discovery
      PID:3372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:2
      4⤵
      PID:4316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:13
      4⤵
      PID:1392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:14
      4⤵
      PID:5852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:3760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:5672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:3516
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
      4⤵
      PID:2708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:4056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1572,i,1720994342485088371,2710605101285910694,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ff95f6cc188,0x7ff95f6cc194,0x7ff95f6cc1a0
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2872,i,10952739314053829629,10109769733275211246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:11
      4⤵
      System Time Discovery
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2872,i,10952739314053829629,10109769733275211246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:2
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2872,i,10952739314053829629,10109769733275211246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2872,i,10952739314053829629,10109769733275211246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2872,i,10952739314053829629,10109769733275211246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2872,i,10952739314053829629,10109769733275211246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2872,i,10952739314053829629,10109769733275211246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2872,i,10952739314053829629,10109769733275211246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2872,i,10952739314053829629,10109769733275211246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2872,i,10952739314053829629,10109769733275211246,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:6124
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c timeout /t 3 /nobreak & rd /s /q "C:\Users\Admin\AppData\Local\Temp\GqDEf0RiiqM"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2160
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20938afb-2ced-42e7-9fef-02be7600b586.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\20938afb-2ced-42e7-9fef-02be7600b586.tmp
Size 4KB
SHA256 63929901b9f3151ff7c0fddf397389d9a943ca38c5692a0335332bf4ff88005b
MD5 5a6b30c56727378d65ab1bf9f024da3a
SHA1 d449765e3c20c047c98c22278e3224b5befe5778
SHA512 4e7281fbf2e774e6bc32b89b3c8d9ba5135d5c4d12eaf1fedffd19a35994f19fb14648bd112e95938baeea577919e138c789aa238b59a0ed066a9fc083aeeee9
SSDEEP 96:8C0d+2+07WJ3aJPWyqgfdfrgnRDotok5D4DGAB6FJGyvQCl47Y0ZPE4/Rv4a:8C0d57WJ3aJ+yhYDUDSGkS0rY0ZsM
TLSH
T165A12970F87D9D7754F6C986F9423E47DEE8A15BA961AF84D4D90E0920E70EC0353123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

310f7937-c7d0-438a-8a17-746ac9aa1f46.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\310f7937-c7d0-438a-8a17-746ac9aa1f46.tmp
Size 13KB
SHA256 40d1f7d5699f8884355a03221171f340ebcd1b81cdf28172a2bdd7768e517111
MD5 2147ecd8a80126ea156e4ed09885a9a1
SHA1 5599fee15e14956f3f13d5908f04d05c955625be
SHA512 889af779604636598ea37875251710362a0c0e5497af7f3b0f76a665a8f7f22eb8647bf908998466ba0c682b6461b46f3976a021703eb5943c9e79e0dea9b10e
SSDEEP 384:GkjKF7KxkXqKf/pUZNCgVLH2HfgslVNXODKF+ErU3+UHG5ot6w:GoKF7KxkXqKf/pUZNCgVLH2HfgsbpO+6
TLSH
T102520827A84C9A7F4FD8D64CDC126F4FADB502576268492897FB9C0803D97CB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

3237ac69-08cf-480a-b436-61b95a74de90.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3237ac69-08cf-480a-b436-61b95a74de90.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 45dd1b8f3d188aea7418f221677e20e0270f42ca1ce78300bbb1ba873bd009b9
MD5 8bbd8e18bdf3b9691bee021a165b8da3
SHA1 981bc521bb2f97f0e1dc5f22e21a810900d11092
SHA512 a26c10cffdec97f8c989d7528eefd8909933da8cf0bc96a3ce5b7cf4c34dd7145ccfbd21e34d38c91c496d4c2b9e6e44a0ebfbcb412ed770466af674242d3abb
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 c8050dfb01d7c6a303e6a1a01aae8efae1db42b23e93a1a2aefde3db81fc4098
MD5 5cb4ad1a83315c4998cb2b84c8cc6b87
SHA1 1e244123af972fce868ad3ec21e43a488c16f913
SHA512 a1aca3ee785aa3c065e3ee8c9b094779ed6ec2780c90a41392c61abb900304ad2960efe6271c1233f6db5c7bfe19b5bdf09deb9529339ca886b7535da062deb0
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OX7ZVVVumTnw:1nbZeMrv/hGtX7ZV5nw
TLSH
T12AD3864B3E743002EDE59A726CE050BB5E3CB16D4F5595D428B620688EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6a2f5a6-587f-4d3b-95a3-58c88da26ec9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c6a2f5a6-587f-4d3b-95a3-58c88da26ec9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f83a2961-cfe7-4e27-8864-de07aae0d97a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f83a2961-cfe7-4e27-8864-de07aae0d97a.tmp
Size 11KB
SHA256 753754a46da51cd64d413e134e9e74793e8544d8bff58e5d45846d39710253e8
MD5 3780b33ab50b5e8c5bd176b6fac07203
SHA1 023ac79ca8d96f6b362c0ed5752b0ba0e493be05
SHA512 7c4e0f3ad293bf349edfaa3d41ae8b7ebe55bb2e35eef1a23bad5cd546d67b2bec012ea088e18ee08acfa87e31e839f23ad8ba5f9f4f19358a3110178314d6dc
SSDEEP 192:RR7EXgBv7uAPRp2Hj9zHsb+WNnkr0zueY+oRVyIsnAUge:RR7EwR7XglwA0I/e
TLSH
T10632A429EE10793B5CDBD21AF961BB57D7F5102171C21E84E6FC892C24EB9CD222712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff8c630d-0302-4f3a-a548-9eb6823f1bb5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ff8c630d-0302-4f3a-a548-9eb6823f1bb5.tmp
Size 141KB
SHA256 44451bf2af66b3be9a97f38bb1519c7d7192a7680f843aaa100911e1517b99e3
MD5 7bd2e76d84408cd39915edeb4933e067
SHA1 cf551388e6a00e84dd71bf2bbaf676c4d4d9847c
SHA512 73f630653cca6566ce89e7439c66d96e5738eb2c71eff4bd7fb4e98af059d045c6d794d2182d2f1a576a6fdef86b2ae1471a6a70d4aa6ccaf5b171a2cc5511b6
SSDEEP 3072:9qAW6sISmtm5tThBM3ywxs8tff19JUHr+qNfSNWydG3X20AmJpOQvkitk9:9/WPISm81B6Oq39UH/NfSN9dG2dmfOCE
TLSH
T135E312536E3EFFB134729A17F5AFDB0F5AF084EF90D4831284B19A9B009F1A46B64854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52545a53-599d-4bed-a777-e4d78ee46edf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\52545a53-599d-4bed-a777-e4d78ee46edf.tmp
Size 39KB
SHA256 50e1a542366dae5938dfb364c923fa4b0f26fdabd64b1f1819bd55621d47b631
MD5 7d2037c64c1988c2b5995cabf8080827
SHA1 9d19bb1f940b684d62fceae2ece318f8818d463b
SHA512 afc47b0290e4157965b5affb89456849754694d4873e69d1fc858b24cdf2954bca7b2c9ca7da15e56f216fa17d2f5a0a6b1cf5307687662816deece9b7ef46b9
SSDEEP 768:k/UxvxjgC+b3U+cZ0rfZWXYo+TYoKsOBw4Ot5AEl94BHYje8AFTN/:RZj3+b37yBVa5AEncHYj7AFB/
TLSH
T1C703BF39DCA599239CF6A7C5760B3387AEF194A3E5C12ED08DDC2D1E0A8729D130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

87795369-e9ce-4a29-90c5-7895d8777b6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87795369-e9ce-4a29-90c5-7895d8777b6a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8b067322-d071-4967-9990-283827d1ba72\index-dir\temp-index
Size 168B
SHA256 7f7d1d1ee01beac085f34e1ffe1b842ad1ebc55fd82e7719edc534f2212713d0
MD5 ae73ef4b9b1acd0c4aec491ba01a4950
SHA1 269dadfda6d49c6c7c3d074aa32f8a2dcdf3c27d
SHA512 f430cc1cb403480f433e5451dfcbf7fdf38253b0b8f1c1a169bd4844b39bc32160da6d00abf4e35aa412a0e46b0df471a733b11729e819cb01b5d945dcc94515
TLSH
T129C02B14CD711001F817D77038BB303049A014EC00084B16D4FF900CDC52591D140704
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8b067322-d071-4967-9990-283827d1ba72\index-dir\the-real-index
Size 168B
SHA256 84d3ea714869b98f0a334a1552eb7d5a4c0c8e2d79d5381ef1b8d9efb36be19f
MD5 3713762d864151eb49caa03abc580fce
SHA1 32afdeab628715dd10e2ee25138f012a90ce4c24
SHA512 31e98ad57409d9c69524a2054460672c163c3926eb56c1d2913d3cb6ca710f2d0c9ca5693821897433823ed574def72b31fded230ba6aebd76336a697bc3f73b
TLSH
T1E5C02B648D315001F452D7B018F73031102018440414331342FA904D5C915A0CD41300
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6645de4-ae58-48cf-86f2-8f5c1cbc75fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c6645de4-ae58-48cf-86f2-8f5c1cbc75fd.tmp
Size 38KB
SHA256 b508822b65a9eba0d15ec35a613815154fdb711d0c0068f6ad7ba0565a89d24d
MD5 75cc81bda80f484f6fc92aa29b8aa562
SHA1 3a42d5bda950edbe10ba1e500448afc292d2d438
SHA512 ce0df8ae7fe01e54b9e873339aa1283271f4503028a3835ee76357f5f7fb707138b638736a795e916f0bb3777be1dc9b9a5d9623a0a2e6e75098a0c8b73d7038
SSDEEP 768:z/UxvxjgC+b3f0cZ0rfZWXYo+dBw4Ot5AEl94BHYj/UAFTN/:GZj3+b3IdBVa5AEncHYjcAFB/
TLSH
T12F03BF39ECA59927CCF7A785770B338BAEF19463E5812ED089DC2D1E0A8725D130B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vshost.exe

Path C:\Users\Admin\AppData\Local\Temp\GqDEf0RiiqM\vshost.exe
Size 2.4MB
SHA256 cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448
MD5 2a13c82baacd5251b47a15255217d0a2
SHA1 77413ad0948a40d31d826e42f294d80f9df8ca11
SHA512 ebf06d692a54549280fdc9caf8d80b0636a2769b1d30d7d3115fbbe37a3c2cc44142b882f603f0756f087580057a7f3d15efcb25463c221ad0faf0b60b16c36b
SSDEEP 49152:5fC7+hLkJiLw/KtbDITXjJG0zvq8ulcdhhtosT1MNMMnMznc2F:SoLr9DITjJG0boO1BHb
TLSH
T1CCC59E22FB8290B2E4D601B062BE6BF75D797234132558CBE3C01D6A59206D3763AF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba81f6fa-343b-459b-ab97-8aab36b91583.tmp

Path C:\Users\Admin\AppData\Local\Temp\ba81f6fa-343b-459b-ab97-8aab36b91583.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6080_1985412019\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download