milleniumrat | 7534c653d02ef74f86d84402232f27b8d463955eca9496ac99e8f3857acf4217

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7534c653d02ef74f86d84402232f27b8d463955eca9496ac99e8f3857acf4217.exe
Size 2.6MB
Sample261022-vqpp5ady9w
SHA256 7534c653d02ef74f86d84402232f27b8d463955eca9496ac99e8f3857acf4217
MD5 139f3402c8d600a5450fd1a19c809fd2
SHA1 e638c222ecba1bd9d855ec1e36f0ec7205dbc6d6
SHA512 adf3333bdcd84e7eba8a44fdbce944a54b2cf605e627fcc71370f3e652908d1cbe88998ca76338ab474672bd519af07490fdb360e3b865e4d3a1b969a7253f63
SSDEEP 49152:R5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUA9KTnUVz:OTrVI4dGOgGpYHCB
TLSH
T1ABD59D62F782D0B2E4D201B152BEABF74D787535537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution milleniumrat rat spyware stealer

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c52a-0.dat	family_milleniumrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1124	powershell.exe
3960	powershell.exe

Uses browser remote debugging 2 TTPs 18 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
240	chrome.exe
2292	chrome.exe
3180	chrome.exe
3544	chrome.exe
5264	chrome.exe
4320	chrome.exe
3968	msedge.exe
4920	chrome.exe
1656	msedge.exe
4356	msedge.exe
2788	chrome.exe
4864	chrome.exe
5804	chrome.exe
6084	msedge.exe
2324	chrome.exe
2704	chrome.exe
3416	chrome.exe
5916	msedge.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\UzTo6BbZ3Q\svchost.exe	7534c653d02ef74f86d84402232f27b8d463955eca9496ac99e8f3857acf4217.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\UzTo6BbZ3Q\svchost.exe	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
2948	svchost.exe
5092	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
5	raw.githubusercontent.com
13	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000d00000001c52a-0.dat	suspicious_telegram_bot

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4580	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	7534c653d02ef74f86d84402232f27b8d463955eca9496ac99e8f3857acf4217.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	7534c653d02ef74f86d84402232f27b8d463955eca9496ac99e8f3857acf4217.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7534c653d02ef74f86d84402232f27b8d463955eca9496ac99e8f3857acf4217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4480	chrome.exe
4796	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2948	svchost.exe
2948	svchost.exe
2948	svchost.exe
2948	svchost.exe
2948	svchost.exe
2948	svchost.exe
2948	svchost.exe
2948	svchost.exe
5092	svchost.exe
5092	svchost.exe
4864	chrome.exe
4864	chrome.exe
2948	svchost.exe
2948	svchost.exe
5092	svchost.exe
5092	svchost.exe
2948	svchost.exe
2948	svchost.exe
5092	svchost.exe
5092	svchost.exe
2948	svchost.exe
2948	svchost.exe
5092	svchost.exe
5092	svchost.exe
2948	svchost.exe
2948	svchost.exe
5092	svchost.exe
5092	svchost.exe
2948	svchost.exe
2948	svchost.exe
5092	svchost.exe
5092	svchost.exe
2948	svchost.exe
2948	svchost.exe
5092	svchost.exe
5092	svchost.exe
2948	svchost.exe
2948	svchost.exe
5092	svchost.exe
5092	svchost.exe
2948	svchost.exe
2948	svchost.exe
5092	svchost.exe
5092	svchost.exe
2948	svchost.exe
2948	svchost.exe
5092	svchost.exe
5092	svchost.exe
2948	svchost.exe
2948	svchost.exe
5092	svchost.exe
5092	svchost.exe
2948	svchost.exe
2948	svchost.exe
5092	svchost.exe
5092	svchost.exe
2948	svchost.exe
2948	svchost.exe
2948	svchost.exe
2948	svchost.exe
2948	svchost.exe
2948	svchost.exe
5092	svchost.exe
5092	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
4864	chrome.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	svchost.exe
Token: SeDebugPrivilege	2948	svchost.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeDebugPrivilege	2948	svchost.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe
Token: SeShutdownPrivilege	4864	chrome.exe
Token: SeCreatePagefilePrivilege	4864	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4864	chrome.exe
1656	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5092	svchost.exe
2948	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 2948	5644	7534c653d02ef74f86d84402232f27b8d463955eca9496ac99e8f3857acf4217.exe	90
PID 2948 wrote to memory of 4864	2948	svchost.exe	93
PID 4864 wrote to memory of 4700	4864	chrome.exe	94
PID 4864 wrote to memory of 4480	4864	chrome.exe	95
PID 4864 wrote to memory of 3320	4864	chrome.exe	96
PID 4864 wrote to memory of 3320	4864	chrome.exe	96
PID 4864 wrote to memory of 1208	4864	chrome.exe	97
PID 4864 wrote to memory of 1208	4864	chrome.exe	97
PID 4864 wrote to memory of 2292	4864	chrome.exe	99
PID 4864 wrote to memory of 240	4864	chrome.exe	100
PID 4864 wrote to memory of 2292	4864	chrome.exe	99
PID 4864 wrote to memory of 240	4864	chrome.exe	100
PID 4864 wrote to memory of 3404	4864	chrome.exe	101
PID 4864 wrote to memory of 3404	4864	chrome.exe	101
PID 4864 wrote to memory of 2324	4864	chrome.exe	102
PID 4864 wrote to memory of 2324	4864	chrome.exe	102
PID 4864 wrote to memory of 5432	4864	chrome.exe	103
PID 4864 wrote to memory of 3544	4864	chrome.exe	104
PID 4864 wrote to memory of 3180	4864	chrome.exe	105
PID 4864 wrote to memory of 3544	4864	chrome.exe	104
PID 4864 wrote to memory of 3180	4864	chrome.exe	105
PID 4864 wrote to memory of 5804	4864	chrome.exe	106
PID 4864 wrote to memory of 4920	4864	chrome.exe	108
PID 4864 wrote to memory of 2572	4864	chrome.exe	109
PID 4864 wrote to memory of 5804	4864	chrome.exe	106
PID 4864 wrote to memory of 4920	4864	chrome.exe	108
PID 4864 wrote to memory of 2572	4864	chrome.exe	109
PID 4864 wrote to memory of 4320	4864	chrome.exe	111
PID 4864 wrote to memory of 5264	4864	chrome.exe	112
PID 4864 wrote to memory of 4320	4864	chrome.exe	111
PID 4864 wrote to memory of 5264	4864	chrome.exe	112
PID 4864 wrote to memory of 2704	4864	chrome.exe	113
PID 4864 wrote to memory of 2704	4864	chrome.exe	113
PID 4864 wrote to memory of 5344	4864	chrome.exe	114
PID 4864 wrote to memory of 5344	4864	chrome.exe	114
PID 4864 wrote to memory of 3968	4864	chrome.exe	115
PID 4864 wrote to memory of 3968	4864	chrome.exe	115
PID 4864 wrote to memory of 3416	4864	chrome.exe	116
PID 4864 wrote to memory of 3416	4864	chrome.exe	116
PID 4864 wrote to memory of 2788	4864	chrome.exe	117
PID 4864 wrote to memory of 2788	4864	chrome.exe	117
PID 2948 wrote to memory of 1656	2948	svchost.exe	118
PID 1656 wrote to memory of 5852	1656	msedge.exe	119
PID 1656 wrote to memory of 4560	1656	msedge.exe	120
PID 1656 wrote to memory of 4796	1656	msedge.exe	121
PID 1656 wrote to memory of 4560	1656	msedge.exe	120
PID 1656 wrote to memory of 4560	1656	msedge.exe	120
PID 1656 wrote to memory of 4920	1656	msedge.exe	122
PID 1656 wrote to memory of 4920	1656	msedge.exe	122
PID 1656 wrote to memory of 4356	1656	msedge.exe	123
PID 1656 wrote to memory of 3968	1656	msedge.exe	124
PID 1656 wrote to memory of 4356	1656	msedge.exe	123
PID 1656 wrote to memory of 4356	1656	msedge.exe	123
PID 1656 wrote to memory of 3968	1656	msedge.exe	124
PID 1656 wrote to memory of 3968	1656	msedge.exe	124
PID 1656 wrote to memory of 5916	1656	msedge.exe	126
PID 1656 wrote to memory of 6084	1656	msedge.exe	127
PID 1656 wrote to memory of 5916	1656	msedge.exe	126
PID 1656 wrote to memory of 5916	1656	msedge.exe	126
PID 1656 wrote to memory of 6084	1656	msedge.exe	127
PID 1656 wrote to memory of 6084	1656	msedge.exe	127
PID 1656 wrote to memory of 852	1656	msedge.exe	128
PID 1656 wrote to memory of 852	1656	msedge.exe	128
PID 2948 wrote to memory of 3960	2948	svchost.exe	131

C:\Users\Admin\AppData\Local\Temp\7534c653d02ef74f86d84402232f27b8d463955eca9496ac99e8f3857acf4217.exe
"C:\Users\Admin\AppData\Local\Temp\7534c653d02ef74f86d84402232f27b8d463955eca9496ac99e8f3857acf4217.exe"
1⤵
- Executes a file named after a Windows system binary
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Users\Admin\AppData\Roaming\UzTo6BbZ3Q\svchost.exe
  "C:\Users\Admin\AppData\Roaming\UzTo6BbZ3Q\svchost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff88f7cc728,0x7ff88f7cc734,0x7ff88f7cc740
      4⤵
      PID:4700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:11
      4⤵
      System Time Discovery
      PID:4480
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
      4⤵
      PID:3320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:13
      4⤵
      PID:1208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
      4⤵
      PID:3404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
      4⤵
      PID:5432
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:2572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      PID:5344
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:3968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:2788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:4624
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:1064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1812,i,17213210155218265738,6300364118306383674,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
      4⤵
      PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x260,0x264,0x230,0x2d4,0x7ff88dd4c188,0x7ff88dd4c194,0x7ff88dd4c1a0
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2248,i,12310666167893990813,198683961597471443,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2248,i,12310666167893990813,198683961597471443,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:11
      4⤵
      System Time Discovery
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2248,i,12310666167893990813,198683961597471443,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:13
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2248,i,12310666167893990813,198683961597471443,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2248,i,12310666167893990813,198683961597471443,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2248,i,12310666167893990813,198683961597471443,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2248,i,12310666167893990813,198683961597471443,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2248,i,12310666167893990813,198683961597471443,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
      4⤵
      PID:852
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DisableOnAccessScanning" -Value 1 -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_15857_mine.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4580
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:1124

C:\Users\Admin\AppData\Roaming\UzTo6BbZ3Q\svchost.exe
C:\Users\Admin\AppData\Roaming\UzTo6BbZ3Q\svchost.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5092

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

04a1b6bd-9558-41a1-9e57-31092d6ecc33.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\04a1b6bd-9558-41a1-9e57-31092d6ecc33.tmp
Size 144KB
SHA256 8d6b34889f06d137bb997b0b4798202016c51b1e9de6d73dd65a9a24f06a4399
MD5 f927be732853fbff64a1aa89979ba271
SHA1 91348e44304dea55ea063fbf4baab448a4bc4f37
SHA512 1b936ef48c362816d52f85e8de858ea2b19d5c55430d976db15c279dec255b08cd8e98be53e3f3658735a67a641010fd1cb4acbaf21ef3cb0341663c408c38d3
SSDEEP 3072:zecVoxkb6vpiw8ynvHIU4omxz5V3qCDMn39Vn7UIoYfFzl:zecmxvvpVft4np5V6EM3P7UXul
TLSH
T190E312A32D5D7E95842FB211121A39133CF534FB9A00E7C854DD6ACFE29B9A0861FD53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04e25339-8cc2-4806-bcca-3bc58d4c6e51.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\04e25339-8cc2-4806-bcca-3bc58d4c6e51.tmp
Size 4KB
SHA256 d5610f77cbe3a32056f7299ba9058cf26df50ec2ddec67370522f2ed8307581e
MD5 9d29caec15f30933af7ee4a156bf1e2b
SHA1 dba45234223bcfe196e3de301fb91d761cb8aefb
SHA512 46c453eccba0ddde3e973ed291f25ef7c3b9b6760a9cf4ec863e3ee49cd7697f5d503a6483ad49158f0f53a2a901ce0fa3b0cb69a792a4789854cc5235822629
SSDEEP 96:pC0d+U7D/u1i5WFtfvuvTj7sCRDotok5pHDfB6jGyvutFDLSmbYLsv4a:pC0z7q134vtDUDhpf7FDLSmbY6
TLSH
T1D7A11A71E87C99BB8976C485F5426A47CEB062BFA901BF80D8DD1B1D11EB1EC1312A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b75b09b-1d60-4eb6-bcfe-eeaffcecc532.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5b75b09b-1d60-4eb6-bcfe-eeaffcecc532.tmp
Size 143KB
SHA256 e0253c43f4a3d428f1036bd8f1767e108021fd9b00256b1a918d478f6aeb8baf
MD5 671aaf6d8bd8f3df246a785ddc498eb2
SHA1 76c849aa6685fb482fc05715c512cd97c45ee40f
SHA512 92c0280b735a02d0909c1a187224eec3dc0d3e6eece88a28d1a9595fa15d4b72ff15ad82c819dc766a3508e6a846df1620b1dacfdc3e6806a2be2a6543cff884
SSDEEP 3072:WeMVoxkb6vpiw8ynvHIU4omxz5V3qCDMn39Vn7UIoYfFzl:WeMmxvvpVft4np5V6EM3P7UXul
TLSH
T1EAE312822AADBF96841FB222135A2D1338F534F69500D7D464DD5ACFD2ABDE0861FD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5106e794-61e8-4264-953d-f71a56248177.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5106e794-61e8-4264-953d-f71a56248177.tmp
Size 11KB
SHA256 9fbf8afd6d384567bdba27f4f272f2dca92c905a4bce6a96a6c7ec88b8e65862
MD5 3d7e041bd671ff02e6610223efec8264
SHA1 e82d2476074f779d09591070aefeddda612aa752
SHA512 38c714e9bdc30face8bf027933704e7cacc3525c4d282b5525e3c0057703a29959f21f50f7b10d12a7362b1bb9d4c54ca61e62e1de605e6ef875f05dab469299
SSDEEP 192:URgXneerv7ZAPRp2N9THsb+WNnG80Aeey2icU7aUVyIsnAUge:URgXeeTQXO9wJ0r2PqaQe
TLSH
T1EE32A42EAD20753FACDAC219FA657757E6F6103125C52E84EBFC892C15E76CC222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b0f5801-6aad-452f-bccb-a78e321ed707.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6b0f5801-6aad-452f-bccb-a78e321ed707.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

977a8c3a-774a-43ac-b783-3ca060a4f47d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\977a8c3a-774a-43ac-b783-3ca060a4f47d.tmp
Size 12KB
SHA256 418690f3a125f9f7fdbe9b17bc472f82b9ae5022f218fb207e56d46adafe04ed
MD5 34c0714772b6f2930c258c3b21b6c6a2
SHA1 fff1574cde9f39f85169f8c05bb67577fcd6c4c9
SHA512 86c04f86999e32cb5c7e4f51e5ec41df95069b50abd5da99fed7067698633feeadbe97ac094c7ec7ea6ffc34930adb2994708ec09ad3a888d0292f3675cc675f
SSDEEP 192:URgXneerv7ZyJPRpxoN9THsb+WNnG80weey2icU7aDVyIsnAUgE:URgXeeTABXx49wJ0b2PqalE
TLSH
T15E42B52EAD20793FADDAC219F9657B57E6F5103125D02E84EBFC892C15E76CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e79fd3eecdac7e1f2f2eff02d070f21bd5d796a162e7f2784d30a53274537319
MD5 ab89259c3572e314b7d28e3d9ea63545
SHA1 c249ce52ec5262de664c6d82b941a52d775a57c2
SHA512 f6d6aaaf3ee8d9d31ac4d3d318ba9741715862fb22903e909ac1759be36554a57feaa4bfb77b031bee506cbd61d30031228a39087af16925112c7caf84d72c0f
TLSH
T1C1E0AB9AC930DC3B89FE4B0850940746F70507132AD04A0F363D850C4FB566B809281C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

4333bf4e-716f-436d-a686-357f74decbe1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4333bf4e-716f-436d-a686-357f74decbe1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4d6aaee8-7bc2-4114-a51f-4fe6122e79d2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4d6aaee8-7bc2-4114-a51f-4fe6122e79d2.tmp
Size 2KB
SHA256 cbcd9e76ce4b1ec883271513e6b29a657b0e8ef50d98b9b1811558a0d0a9cdd6
MD5 091f484513b5707aba50549007daa77f
SHA1 dffffb12d52901a3331a78afb4680a789dc70e9e
SHA512 021eef9264ba7e9e9aed56b4b6f239d52cc7314882f65c7774495f6ec141ae5c249753939bf0ed92aff8dd0e1b9edb49065a1f328192a4856bbce46b476f87bb
TLSH
T12C519CF7C3E4866D896156E49B217E1FCD3E0A18022C3C62C8D8BE5F53E2972D24178E
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 1da15b01cee8b6680aade13aab6ed7e58b2d3b6a67867d188faab965a315e9e1
MD5 aefdcf855c3882fd0aa98eb7f26e5bdf
SHA1 85644242d1ae347797c83c6ccbb693499350bb39
SHA512 f112e1176517d60ab3cdeeca74377fdce123a040403ff29b34ff6f7b8ae0b2866b09106e81be3681dace1aa552a36fd5dfc48012ac3635f81e19ba05f485ffee
SSDEEP 384:dXj/y7KxkXqKf/pUZNCgVLH2HfgslsOXOD/W+ErU3DtHG47vZGB:dz/y7KxkXqKf/pUZNCgVLH2HfgsiUO7Q
TLSH
T1DE52F927688C9A3F0FD8D64DDC127F8FACB5016666B84D6452FB5C0903A97CA120A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 7e0f838e85645169232e92e30131f4c1b056dd4597f92387282c508fc93eb8c8
MD5 d2ffbc09464b79209c7a017c966fa51f
SHA1 db318b733be150fcf7d97a89fd51c1ac10688bc5
SHA512 6fa068eeaeb777b90f55540f0c5c530a631886b8e7fe23d6224e95f16ec9f42a9e4a3bbe213fffce4ab396a1512cbbcb5fb1435ce869858737ff295f77737519
TLSH
T1E8A0022049CC1433DE20437070F1554123634C2855569B0369D21D7D995B6C04192901
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 91f3b056f80cc16e30e7ab1a2751a0342f47125bcfa1e4f068f1691dca5a385f
MD5 f441c36e222e47de02cf0c2f4d3b0942
SHA1 0c8e0baae11f0caacbe992daf6193de4dd63d9a8
SHA512 1815fedb1c1197ea5b691b7ccbc9122bafb6b9b827ef7c9b4c3b3b49afba61609f0fc0edeb885d55fe5191936bce3a36494d34ab80b93514978b6da0efd4c2b1
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 19bc1c429f782ce037f57cbde57e4f2c8919fe2ec43b35ee29dd8c75f3d1cd90
MD5 d5f63bd8262eee7b2d61cca87ee6434e
SHA1 a206da46773381801c779294a316a9e04073a33e
SHA512 d9c9a2c32491841bb1602b385b4af381ce6b8e5c72b874f2273ec2be0805c0fa95cfc2ed5747e994e1bd43f18ef3b9e7464857ff199978ea2295eea13a81ccbd
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OQxMC7yVummnNa35:1nbZeMrv/hGtQxMCbnNa35
TLSH
T1A8D3974B3A743002DDE59AB61CE050BB5E3CB16D8F55A5D438B620588EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0857aaa-6689-4b96-9f3b-7aecfe7ac61c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e0857aaa-6689-4b96-9f3b-7aecfe7ac61c.tmp
Size 143KB
SHA256 d1b5450749c2f2b92e9321f3893b5d5729251b52e31fcd301cca7d569c307907
MD5 4223815225995774dd3737953aeddbb9
SHA1 491abcdc456dc3d9311ee4bd8a1f227f8ec6fd8a
SHA512 dd4e21dfb3e427fd042788ea90ccfe38161616024f882c50a2ce9b01dd9dfd5a6b5a1c6f96cb10c12e46b8a1132b540d695ad00467f4cc2208dec16dfbaa489a
SSDEEP 3072:zeMVoxkb6vpiw8ynvHIU4omxz5V3qCDMn39Vn7UIoYfFzl:zeMmxvvpVft4np5V6EM3P7UXul
TLSH
T181E312822AADBF96841FB222135A2D1338F534F69500D7D464DD5ACFD2ABDE0861FD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73abe389-d7fc-42a2-87f2-3c2aee16bba5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\73abe389-d7fc-42a2-87f2-3c2aee16bba5.tmp
Size 38KB
SHA256 170f44f286c7c8aa84318e540894dc1c6d60cc4c891f57246148c0a0cf1c2d6c
MD5 cbc76f976495a4e3bcbc4cb8f2399384
SHA1 9809049e4d05e43d88cf60b815c5446b94e979cd
SHA512 b736a0667bb165fc78bdae7394bf514038d78e37351130be3221a87409d6122245afcb20aad6cfff94f233cfbd20f50519d5d97377859c0b6d91c957122730f9
SSDEEP 768:x/UxvxjgC+H3eB0OE+36/9OA9at01j0iq00+IaXzSHxRz:EZj3+H3ejXCHq00NajSTz
TLSH
T10203C031ECA19D739DF6B384720AA38B9FF44663C6C95AA049ED2D0D058B7AD1307C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9020b5da-9f74-4a0f-a6c4-0d54c5e7c2bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9020b5da-9f74-4a0f-a6c4-0d54c5e7c2bc.tmp
Size 37KB
SHA256 e74674698cac23fb8ef79ab25096c3ee225ee9135affda48ae36777a43522b7e
MD5 9d91cbc799e66321f8483c545280d30f
SHA1 a4765ce1d4503ff167b7e510fd851536501e1c4e
SHA512 ba8340753ca9a3fe9ff2d5082fb628f08b1b0118f084a9dc01f3f79be33dc948df637d579d6c49ed6dd01e5d1ba84f7d8226658020ac0a6fb73d484c8812e197
SSDEEP 768:X/UxvxjgC+H3VoEOEA/9OA9at01j0iq00+Ia23SHxRz:KZj3+H3VXCHq00Na4STz
TLSH
T1D403C031ECA19D739CF7B384730A63979FF44663C6C56AA049ED2A0E05876AD1307CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

693cc858-7038-4004-91c0-86cc1e0e4c84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\693cc858-7038-4004-91c0-86cc1e0e4c84.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a7e685a7-10a7-4da5-89fe-b121cdbde244\index-dir\temp-index
Size 768B
SHA256 486f2872a58bfab5fb98b107c78f469b3fe31dbf9d620a3113885b9d54e49b1b
MD5 179d4d0677f6b1fd75c3f686d40d0213
SHA1 28bec59376e697837b335e085312f168e1675f35
SHA512 992c59701634a6ac21d8c4b48faf83393d72f354f24284ac72aa1c9fcd1fdc2e4263524dfc5dae2493bbd97c1969983fbc73c1dfbe69d38435168a6fefba4e1c
TLSH
T1DE01E1CE1D125F46ED5402B12438B9C5617A21DC5344AE1FF0FDD12B9CD1754FD81658
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a7e685a7-10a7-4da5-89fe-b121cdbde244\index-dir\the-real-index
Size 768B
SHA256 298b4890b9556f0beed88d511c6de07b64cea361fc62631fa7974d8b7bbdf2fa
MD5 c29672ac863a2f0588060ea6bc30cfaa
SHA1 52c42757885c58bb8b790392ec59167c8d3bc74d
SHA512 ae44645b83bdab99100cdb1300c6c34c44c6e3bdf73e446e9f790af24cf8adf561309ebd9a58acbfb0b8ba8202795ef2bfb9aaef44c7984002ec9633bab800de
TLSH
T1AF0120D601624A43EC0011F1AA3CB584213A61049388AB0FE3E6A46BDC91784BD82AEC
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 7648dcf1a73d52a050bfac5e102f78f60185c7cb11dd1c170e83c02f34f3cab3
MD5 6e5690b5ba95e5f18da9ded8ce8e19a7
SHA1 48bef420c68754d092ce91a0a55fa5936f414519
SHA512 5469894013bc9852c87219cd1987ac2c7f760283e75608fd9ede5701611706331cde9ebe2f93a1c7dd3b9e1382c02e2cba1573be771262c942f7f95a4ccd4f80
SSDEEP 384:k1TBaGMr1iXGW14bSR/+TB51UlsL0CPwVBIAXDFQahlwuEBQ7vdbhN5Tg1iaPf9:wTnMRnWi+R/+TxZpYIAXDFQaTZbhNKiO
TLSH
T1B7828768217F6DC7D8D2227054D602FBFBE4D089DA755194BE2BCA2F5CA0EBA4F60520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06b44f4b-d5ad-48d0-901c-8ea591d851c7.tmp

Path C:\Users\Admin\AppData\Local\Temp\06b44f4b-d5ad-48d0-901c-8ea591d851c7.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bfk3a5td.ydl.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bfk3a5td.ydl.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4864_2027874420\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

tmp_15857_mine.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp_15857_mine.bat
Size 1KB
SHA256 5ab465291be45be87b7fc1fc6335fa3631b9494b0efdc7a274be4f80b15f676c
MD5 6c6165f6a680a8b02f35d82aad2bc1e4
SHA1 85d6b6c2ffab81765a8e28d2edbcda430f23dbbc
SHA512 3e914421f7b80309ae9679c514d5dc8d132456f9737185cfd3f3ac6cf205287eb27b349bfd49e3f546fb3b55968ba54f173d072ada02e69cc8590f8c46e7f20e
TLSH
T15231B77FADCD20DFA82FC0E19483911461568DC1F359CBDE674DC639E4A9A4910339D8
MD5 SHA1 SHA512 TLSH

Submit Download

tmp_28652_update3.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp_28652_update3.exe
Size 1KB
SHA256 f2e282d1c2915bd5eef790cfe9367c4368d3e95c0ef002e0298fd5376dce143f
MD5 0d32149bb61efa778ac95a5c7f6fe416
SHA1 f6bf1b7b9aa3444566e32f33fe32aa2542025eec
SHA512 62780edc234cb739c21873c95d3441273d5c0f5ec04762d8402b00b40c661c27f185f1971378c49dd256d0d1d1c61e9b0008afd3ffbd0f56f16a0a4050e4390d
TLSH
T11831B77FACCD309FA82FC0E19483911461568DC1F355CBDE674DC639E4A9A4910339C8
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\UzTo6BbZ3Q\svchost.exe
Size 2.6MB
SHA256 7534c653d02ef74f86d84402232f27b8d463955eca9496ac99e8f3857acf4217
MD5 139f3402c8d600a5450fd1a19c809fd2
SHA1 e638c222ecba1bd9d855ec1e36f0ec7205dbc6d6
SHA512 adf3333bdcd84e7eba8a44fdbce944a54b2cf605e627fcc71370f3e652908d1cbe88998ca76338ab474672bd519af07490fdb360e3b865e4d3a1b969a7253f63
SSDEEP 49152:R5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUA9KTnUVz:OTrVI4dGOgGpYHCB
TLSH
T1ABD59D62F782D0B2E4D201B152BEABF74D787535537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-642-0x000000006F9D0000-0x000000006FA1C000-memory.dmp

Download

memory/1124-638-0x0000000005960000-0x0000000005CBB000-memory.dmp

Download

memory/1124-648-0x00000000070E0000-0x00000000070EA000-memory.dmp

Download

memory/1124-647-0x00000000076A0000-0x0000000007D1C000-memory.dmp

Download

memory/1124-646-0x0000000006F30000-0x0000000006FD3000-memory.dmp

Download

memory/1124-645-0x0000000006F10000-0x0000000006F30000-memory.dmp

Download

memory/1124-641-0x0000000006ED0000-0x0000000006F06000-memory.dmp

Download

memory/1124-640-0x0000000005FB0000-0x0000000005FFC000-memory.dmp

Download

memory/3960-591-0x0000000006220000-0x000000000626C000-memory.dmp

Download

memory/3960-586-0x0000000005CE0000-0x0000000005D46000-memory.dmp

Download

memory/3960-589-0x0000000005D50000-0x00000000060AB000-memory.dmp

Download

memory/3960-590-0x00000000061F0000-0x000000000620E000-memory.dmp

Download

memory/3960-585-0x0000000005C70000-0x0000000005CD6000-memory.dmp

Download

memory/3960-593-0x0000000006720000-0x000000000673A000-memory.dmp

Download

memory/3960-592-0x00000000071E0000-0x0000000007276000-memory.dmp

Download

memory/3960-595-0x0000000007A60000-0x000000000801A000-memory.dmp

Download

memory/3960-594-0x0000000006770000-0x0000000006792000-memory.dmp

Download

memory/3960-584-0x0000000005500000-0x0000000005522000-memory.dmp

Download

memory/3960-583-0x0000000005620000-0x0000000005C6A000-memory.dmp

Download

memory/3960-582-0x0000000002980000-0x00000000029B6000-memory.dmp

Download