milleniumrat | ca3840a3558140edd6ab2effd8a54a0596061f7caebee4a61ad632ecd2c3cbff

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/11/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-04_ad9c9dc4f5d336f6d5d5ec7304dd35d5_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 2.6MB
Sample261105-t3c2esgh46
SHA256 ca3840a3558140edd6ab2effd8a54a0596061f7caebee4a61ad632ecd2c3cbff
MD5 ad9c9dc4f5d336f6d5d5ec7304dd35d5
SHA1 9fd1bd2c54c4d4749c0cf4fba3dd7429e5d6a985
SHA512 e85c71446285d22e2d93b99a90ac035f22de18b7cb439e3f7f6014abeba5a23a9df034eed45e64b723a56a26aa6baedccc358c5fbea3cd5383afac75c96bf264
SSDEEP 49152:75uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUo9KTnUVz:oTrVI4dGOgGpYHCR
TLSH
T1DFD59D62F782D0B2E4D201B151BEABF74D787635537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery milleniumrat rat spyware stealer

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b48-0.dat	family_milleniumrat

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b48-0.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b48-0.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b48-0.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b48-0.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b48-0.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox analysis VM names 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b48-0.dat	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b48-0.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Uses browser remote debugging 2 TTPs 18 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5772	chrome.exe
3424	chrome.exe
3712	chrome.exe
3088	msedge.exe
1804	chrome.exe
1524	chrome.exe
6120	chrome.exe
2228	chrome.exe
4224	msedge.exe
2664	msedge.exe
2928	chrome.exe
2728	chrome.exe
3844	chrome.exe
4860	chrome.exe
4632	chrome.exe
3476	msedge.exe
4928	chrome.exe
2944	msedge.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5828	svchost.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\AucIYcB\svchost.exe	2026-11-04_ad9c9dc4f5d336f6d5d5ec7304dd35d5_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\AucIYcB\svchost.exe	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
5828	svchost.exe
4896	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
11	raw.githubusercontent.com
21	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-04_ad9c9dc4f5d336f6d5d5ec7304dd35d5_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4280	chrome.exe
1248	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5828	svchost.exe
5828	svchost.exe
5828	svchost.exe
5828	svchost.exe
5828	svchost.exe
5828	svchost.exe
1804	chrome.exe
1804	chrome.exe
5828	svchost.exe
5828	svchost.exe
5828	svchost.exe
5828	svchost.exe
5828	svchost.exe
5828	svchost.exe
5828	svchost.exe
5828	svchost.exe
1804	chrome.exe
1804	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5828	svchost.exe
Token: SeDebugPrivilege	5828	svchost.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeDebugPrivilege	5828	svchost.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1804	chrome.exe
4224	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4896	svchost.exe
5828	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6036 wrote to memory of 5828	6036	2026-11-04_ad9c9dc4f5d336f6d5d5ec7304dd35d5_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe	89
PID 5828 wrote to memory of 1804	5828	svchost.exe	93
PID 1804 wrote to memory of 5788	1804	chrome.exe	94
PID 1804 wrote to memory of 4280	1804	chrome.exe	95
PID 1804 wrote to memory of 1628	1804	chrome.exe	96
PID 1804 wrote to memory of 1628	1804	chrome.exe	96
PID 1804 wrote to memory of 2424	1804	chrome.exe	97
PID 1804 wrote to memory of 2424	1804	chrome.exe	97
PID 1804 wrote to memory of 2928	1804	chrome.exe	99
PID 1804 wrote to memory of 2928	1804	chrome.exe	99
PID 1804 wrote to memory of 1524	1804	chrome.exe	100
PID 1804 wrote to memory of 1524	1804	chrome.exe	100
PID 1804 wrote to memory of 3436	1804	chrome.exe	101
PID 1804 wrote to memory of 3436	1804	chrome.exe	101
PID 1804 wrote to memory of 6120	1804	chrome.exe	102
PID 1804 wrote to memory of 6120	1804	chrome.exe	102
PID 1804 wrote to memory of 4936	1804	chrome.exe	103
PID 1804 wrote to memory of 3844	1804	chrome.exe	104
PID 1804 wrote to memory of 2728	1804	chrome.exe	105
PID 1804 wrote to memory of 3844	1804	chrome.exe	104
PID 1804 wrote to memory of 2728	1804	chrome.exe	105
PID 1804 wrote to memory of 5772	1804	chrome.exe	107
PID 1804 wrote to memory of 5772	1804	chrome.exe	107
PID 1804 wrote to memory of 3424	1804	chrome.exe	110
PID 1804 wrote to memory of 5896	1804	chrome.exe	111
PID 1804 wrote to memory of 2228	1804	chrome.exe	112
PID 1804 wrote to memory of 3424	1804	chrome.exe	110
PID 1804 wrote to memory of 5896	1804	chrome.exe	111
PID 1804 wrote to memory of 2228	1804	chrome.exe	112
PID 1804 wrote to memory of 4860	1804	chrome.exe	113
PID 1804 wrote to memory of 4860	1804	chrome.exe	113
PID 1804 wrote to memory of 3712	1804	chrome.exe	114
PID 1804 wrote to memory of 3712	1804	chrome.exe	114
PID 1804 wrote to memory of 5656	1804	chrome.exe	115
PID 1804 wrote to memory of 5656	1804	chrome.exe	115
PID 1804 wrote to memory of 4356	1804	chrome.exe	116
PID 1804 wrote to memory of 4356	1804	chrome.exe	116
PID 1804 wrote to memory of 4632	1804	chrome.exe	117
PID 1804 wrote to memory of 4632	1804	chrome.exe	117
PID 1804 wrote to memory of 4928	1804	chrome.exe	118
PID 1804 wrote to memory of 4928	1804	chrome.exe	118
PID 5828 wrote to memory of 4224	5828	svchost.exe	119
PID 4224 wrote to memory of 6064	4224	msedge.exe	120
PID 4224 wrote to memory of 1248	4224	msedge.exe	121
PID 4224 wrote to memory of 1308	4224	msedge.exe	123
PID 4224 wrote to memory of 1308	4224	msedge.exe	123
PID 4224 wrote to memory of 1308	4224	msedge.exe	123
PID 4224 wrote to memory of 916	4224	msedge.exe	124
PID 4224 wrote to memory of 916	4224	msedge.exe	124
PID 4224 wrote to memory of 3476	4224	msedge.exe	125
PID 4224 wrote to memory of 3476	4224	msedge.exe	125
PID 4224 wrote to memory of 3476	4224	msedge.exe	125
PID 4224 wrote to memory of 2664	4224	msedge.exe	126
PID 4224 wrote to memory of 2664	4224	msedge.exe	126
PID 4224 wrote to memory of 2664	4224	msedge.exe	126
PID 4224 wrote to memory of 2944	4224	msedge.exe	127
PID 4224 wrote to memory of 2944	4224	msedge.exe	127
PID 4224 wrote to memory of 2944	4224	msedge.exe	127
PID 4224 wrote to memory of 3088	4224	msedge.exe	128
PID 4224 wrote to memory of 3088	4224	msedge.exe	128
PID 4224 wrote to memory of 3088	4224	msedge.exe	128
PID 4224 wrote to memory of 2868	4224	msedge.exe	129
PID 4224 wrote to memory of 2868	4224	msedge.exe	129
PID 1804 wrote to memory of 5912	1804	chrome.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-11-04_ad9c9dc4f5d336f6d5d5ec7304dd35d5_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-04_ad9c9dc4f5d336f6d5d5ec7304dd35d5_amadey_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- Executes a file named after a Windows system binary
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Users\Admin\AppData\Roaming\AucIYcB\svchost.exe
  "C:\Users\Admin\AppData\Roaming\AucIYcB\svchost.exe"
  2⤵
  - Deletes itself
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff99a34c728,0x7ff99a34c734,0x7ff99a34c740
      4⤵
      PID:5788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:11
      4⤵
      System Time Discovery
      PID:4280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
      4⤵
      PID:1628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
      4⤵
      PID:2424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
      4⤵
      PID:3436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:4936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:5896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:5656
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:4356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:4928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
      4⤵
      PID:5912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
      4⤵
      PID:3076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1904,i,5439588242243254729,7174017029257354050,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14
      4⤵
      PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x230,0x7ff994edc188,0x7ff994edc194,0x7ff994edc1a0
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2228,i,9013269351501504098,15900356396395483499,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
      4⤵
      System Time Discovery
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2228,i,9013269351501504098,15900356396395483499,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2228,i,9013269351501504098,15900356396395483499,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:13
      4⤵
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2228,i,9013269351501504098,15900356396395483499,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2228,i,9013269351501504098,15900356396395483499,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2228,i,9013269351501504098,15900356396395483499,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2228,i,9013269351501504098,15900356396395483499,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2228,i,9013269351501504098,15900356396395483499,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:2868

C:\Users\Admin\AppData\Roaming\AucIYcB\svchost.exe
C:\Users\Admin\AppData\Roaming\AucIYcB\svchost.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

30af5ec6-b778-4bc9-aeed-c9ae968dd2bd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\30af5ec6-b778-4bc9-aeed-c9ae968dd2bd.tmp
Size 4KB
SHA256 19ec90cc30eb940e6629a71a840db820b702297d6e888f77ae1e08f875db2009
MD5 e5b5a883ff1e719a37e7875300085f12
SHA1 3d6e5122a7ffd2cc31abb7070134b63400d4e749
SHA512 dd5d87a435ff16c28489109ce08026aeaf7f5ad699ed22c763338d6d5608a52e7fa12f75e8dede185a2876a593d3de3ab26678b4be22e5124a97444044f9c7d8
SSDEEP 96:pC0d+U7D/u1i5WFtfvuvTj7sCRDotok5+QHD6B6jGyvutFDL5mbYLsv4a:pC0z7q134vtDUDlqf7FDL5mbY6
TLSH
T1F5A12B70E87C99BB8476C485F5422A47CEB022BFA902BF80D8DD1B1D11EB1FC1316A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

778fa01a-3d11-4639-89d1-aa921e36967a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\778fa01a-3d11-4639-89d1-aa921e36967a.tmp
Size 147KB
SHA256 8607fbe6d96fe465a6a16c4a7e48a8db5dfebaa29de8eb329610df136a2279f0
MD5 e67e61f3b52d05319c1c4bacc126a3c5
SHA1 8ab321d5f7917ecdf06655b7def416ac5f7e6556
SHA512 6db03bdff425c9762da1e6edfc7763cb7c2907e616bc47b8e88973f49e40476c7f8aa214497cac8558c1aac580b470ffb2ff330b552c102cdf4baf67a65277d3
SSDEEP 3072:seoZHRQHLulItp/6T4ywmE6miL4QxdMguYB:segRYLHJGom9f6o
TLSH
T138E312A7E56DF11A1B2AE235C4B7AE9709C025138D110349E8FAFB84053D9FF3362E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00548eaa-716f-4d9d-a7aa-744dc6eb4502.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\00548eaa-716f-4d9d-a7aa-744dc6eb4502.tmp
Size 11KB
SHA256 1013b478073ef68929371a19069968cd52d05336f584988c49019e51911cb4b6
MD5 1590bd90fe359b77901077999378beaf
SHA1 ed7d64bef149f8cbb107ab84f33b74045065eb05
SHA512 467ec46122fcef95a4820253bd1dd4f198ec8ed821ae362fc418d944b7ecd48c262062566d8168d5eafaf2b310453dcf6dcd2dd0a74f2875a27131f29ae4d88b
SSDEEP 192:aRtInDq/v7ZAPRp2N9THsb+WNn3AdoxFCPckwK7iRacVyIsnAUge:aRtI2XQXO9wQdIFKcy2a4e
TLSH
T19A32A32EED20753F9CDAC219EA657753D6F5203225D12E88E7FC882C25D75DC222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f6132e9-e790-4dff-a2b7-aac3b5e17b5a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4f6132e9-e790-4dff-a2b7-aac3b5e17b5a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

520fdfbb-8dcd-409e-9b8a-71b4ed1714e3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\520fdfbb-8dcd-409e-9b8a-71b4ed1714e3.tmp
Size 414B
SHA256 7348525de5c92561f51e75a4fc75056b5e1a2ef482c441dfa432492828f6f24a
MD5 541d6f1e7863a9361e7fcdaf5832198e
SHA1 9dd513338d10bde29ecd6047c30c15d1a2ab690c
SHA512 3a59673be97de6e0230c5e9f2d659c834623f711c3d3b8b98f006c5e2584701b461f6fca831bf6f9fc19bde6132103fb75f5e0adb2a7ffb93c3f1b98951ec166
TLSH
T17DE022ADCD20EC2B19FC0B1860241647FA251B572A904A4F3B3CC21C9FB9A3E42D7C6C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

435679ba-883f-4bac-89e3-3da8925c9157.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\435679ba-883f-4bac-89e3-3da8925c9157.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e3053357-f309-450d-819c-92c6bd75608a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e3053357-f309-450d-819c-92c6bd75608a.tmp
Size 2KB
SHA256 3f4bcfe82c9729de026a877358b7a835f989919bbf9b69ff3512d47bf878b0d5
MD5 38532e38d8149bf6f659d8ae4a220a92
SHA1 849cc0b6a41479c4084cfb47bde1d38c65d68171
SHA512 ed0ba3a19ce08aeb570a5ba57652ee251381485d9a4faab3a6d6949f35c80b15580ecf404f94e550f9b2b7e2d4076139c3ab868237df811c1a3ce3880086a2ea
TLSH
T10C51BBF3D3D88A6DC41556F49B206E1FCE391A28121C3C6688D4EE4B83F2872D21078E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 4b51e54a1cdf9de514a23f8bce931ad0955ab7d68fc736ec7bc4171c5164b59b
MD5 978ac78d6ad3c94d335b583ed17437e8
SHA1 ed855bb5ada56bc222546c5307ee1ca451a5c7e8
SHA512 e43de89d3ef9e88da5d02a22b42dc15ce6ab492dc22993f33c5c8432437f17890b07379212ed37cfeca0b81352cf51c35766008a8861444bdbd436ea4fa7a0c0
TLSH
T1EAA0021042C56CD2ED12C270746317512FA1CC2819A557035993084699EF6C5C64D100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 681eebf064d2b02119531a0eb4f00c9a4e05a34df89d558b06e60df6e6ff0bfb
MD5 9527c380dbdb74e6bac5cab15c497ba7
SHA1 07523067432ddb39a329e4f12a55584dc18fd3cb
SHA512 b46927eb2056def0ad74567a653139c26eca029832151878305dc2f43756dbc6db1a1fd54e187d9a0e8256d0d96ee5149856c0ca4792ce108b9af814c65ffe39
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 90b02207158c5f54e3e1981bbe053e116ba513c9fd692c07538d757543aca098
MD5 7e1ff88af7c565c05710272032117ed5
SHA1 98798ad93ba5ba9dc547ee65765438e62faf53e3
SHA512 7df39fdd6e1d32e2680e9b006d9adc903cdb37f400c895b60a9fa4310ad36b29c4f34de58b89c12ca3300100b7ab632a59962e99b166e80bba2e009f1aa6e53f
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OQSMC7yVummnNa35:1nbZeMrv/hGtQSMCbnNa35
TLSH
T185D3984B3A743002DDE59A761CE050BB5E3CB16D8F55A5D428B620688EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae721786-d5bf-4120-8661-26d5072a4313.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ae721786-d5bf-4120-8661-26d5072a4313.tmp
Size 13KB
SHA256 1e87e5e579e5674e728fcb3983043340d0c5ad0eabfcd9acabf59582cfa53049
MD5 c2de01736fccfea17ce061260a8f8fed
SHA1 232059ade5bc88c402da662bcb2144baae7b98fa
SHA512 e2560e1e88b6da1715943271092de11d8395b95fb51018f2b1738c398f078e40a9bedfcebf19150b016d0529128e8d7021fa25d415d2b8d133e455b7f9466f4b
SSDEEP 384:dXj/y7KxkXqKf/pUZNCgVLH2HfgslsOXOD/W+ErU3yOHG47vJJ:dz/y7KxkXqKf/pUZNCgVLH2HfgsiUO7p
TLSH
T1BE520967688C9A3F0FD8DA4CCC126F8FACB501666678496452FB5C0903E97DB124A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7b7d858-cc40-4f3f-87a0-65ac08c8cab5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d7b7d858-cc40-4f3f-87a0-65ac08c8cab5.tmp
Size 12KB
SHA256 1cbf43235a5655bd7f564cb5331288e91e51e8d97f6418549693d1fb2caacb00
MD5 43349e8b4c1b66e29b532097aec1ddc3
SHA1 ba01533f2ed271bb155d012233057ce2acbaf942
SHA512 48d1f54484b237699daeb893abbe5f1b126f475cf36eb3a63ddc66d208c9f03b346208ecc150beaef89cc0d4126a4c7f638a6f0921dde3135d5f4621793a3888
SSDEEP 192:aRtInDq/v7Z4PRp+N9THsb+WNn3AdKxFCPckwK7iRayVyIsnAUgE:aRtI2X4XW9wQduFKcy2ayE
TLSH
T16242B42EED20753BACDAC219F9657B53D6F5203225912E88E7FC892C25E75DC222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a072b2f0-33d6-4488-9ebe-6d80669f0e26.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a072b2f0-33d6-4488-9ebe-6d80669f0e26.tmp
Size 147KB
SHA256 1c93c219d44eebbb35675a568cedc58f48fb993f55efb3cf58280fb8d4eab6b8
MD5 6b486652ba98cffe5c4782ab734adf03
SHA1 cd10c39dbf38efe9fe6fae6abd05de0593256fea
SHA512 68743921e96fde2a87903e9a49083a8f05e02225cb279ce1257225636c437f7ccc9388d155da6a984def28408e63c081bac6bf4efee4f08d832f8edf2627d751
SSDEEP 3072:TeoZHRQHLulItp/6T4ywmE6miL4QxdMguYB:TegRYLHJGom9f6o
TLSH
T15FE312A7E56DF11A1B2AE235C4B7AE9709C025138D510349E8FAFB84053D9FF2362E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9a8aa9a-dc19-44a7-b7b5-42745c499ed8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c9a8aa9a-dc19-44a7-b7b5-42745c499ed8.tmp
Size 148KB
SHA256 0247fd359a51cc8a104bdaef98dac73a05e6c4a07e3fe827a3dc0dea64a65426
MD5 c1a0eaa0bcd8df646fe81b7113cf00cb
SHA1 d09625eae69330deafefe8530a61060d3c52f4b2
SHA512 76356ffc80318bec8f0893ca8b6b79898c9e994a774ea331a32513c0fc3df54bb4c538a6ca49dc22082371c439e6c524c3e0d1069cad33ee638a79ca7cc8999c
SSDEEP 3072:selZHRQHLulItp/6T4ywmE6miL4QxdMguYB:serRYLHJGom9f6o
TLSH
T1CFE312B7E56DA05A1B2AE675C477AE430DC024138E11130CE8FAFB40092D9FF6762E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3278ebec-f971-483c-814b-0106c3eef0ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3278ebec-f971-483c-814b-0106c3eef0ab.tmp
Size 37KB
SHA256 17947e97ce9c5aeac72dff76eeb3b49f4d5d79d9b0a3b4ae923b5a063c195bfe
MD5 fc84f9ef6841b3e83b757ed5943c914f
SHA1 5b7699fbd940c44836c9645b6cbbef8c4f6a56b7
SHA512 2ca8413dfb2b8720ca798d856b77360be745924d06cf11164f50812a8a162ec8f16f6f35dbdc892abe8a328dbb455ff3f0180db6bd5e1e7b89c29360a6e78617
SSDEEP 768:X/UxvxjgC+H3lT9OYav/9OA9at01j0iq00+Ia2iSHxRz:KZj3+H3lswCHq00Na5STz
TLSH
T16D03B031ECA19D739CF7B384770A63879FF44663C6C66AA049ED2A0E05876AD1307C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39717840-d67d-41cb-a354-aa17795d8436.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\39717840-d67d-41cb-a354-aa17795d8436.tmp
Size 38KB
SHA256 e229e957a1c45c1f4888de5aeda5396ac456a4caff6c051a4ed55e9b63cfb69f
MD5 19b3ca3ab83ab220183e09b781a1b51b
SHA1 f395bc2fa82349d17342d5d415f63eed17e0b261
SHA512 368a675b3b8e6b966bd72f702d4a0c4ae1c4edbf35b54dd6807c026a696d97155c646fb6dd5d240c21480fcd8c51bb7fc3c81dcc691bad0500c0b756454d53e6
SSDEEP 768:F/UxvxjgC+H3cfXOYaex/9OA9at01j0iq00+IaXwSHxRz:oZj3+H3ca3CHq00NagSTz
TLSH
T11503C031ECA19D739CF6B284730A6387DFF45613C6CA5AE049ED2D0D058B6AD1307867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af8c352e-b0e9-4cf6-b78d-8676392c38ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af8c352e-b0e9-4cf6-b78d-8676392c38ce.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a897cd95-7fe6-4fce-aca2-53524ecb4c30.tmp

Path C:\Users\Admin\AppData\Local\Temp\a897cd95-7fe6-4fce-aca2-53524ecb4c30.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_295109606\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\AucIYcB\svchost.exe
Size 2.6MB
SHA256 ca3840a3558140edd6ab2effd8a54a0596061f7caebee4a61ad632ecd2c3cbff
MD5 ad9c9dc4f5d336f6d5d5ec7304dd35d5
SHA1 9fd1bd2c54c4d4749c0cf4fba3dd7429e5d6a985
SHA512 e85c71446285d22e2d93b99a90ac035f22de18b7cb439e3f7f6014abeba5a23a9df034eed45e64b723a56a26aa6baedccc358c5fbea3cd5383afac75c96bf264
SSDEEP 49152:75uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUo9KTnUVz:oTrVI4dGOgGpYHCR
TLSH
T1DFD59D62F782D0B2E4D201B151BEABF74D787635537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download