quasar | 09d2155850e8826432051c3c86100633548c44ab6ff5cc6bde9a478f0e28ca2d

Analysis

max time kernel
209s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2024, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Saitama-External.exe
Size 3.2MB
Sample240830-b9bsts1fma
SHA256 09d2155850e8826432051c3c86100633548c44ab6ff5cc6bde9a478f0e28ca2d
MD5 f80cce52b08718d9bd9b8d41427b97ca
SHA1 ca19d99893df61c7d4d90f3e91fc635cb6a283d9
SHA512 85951f4b206937cb84292042ec6e41a184f92d3ebff01dcf1ef60160091b30bd81cc33af03a8f6fc714eb9da2657510a7773c1cb0dcccb3eae14ec524b6f6bd4
SSDEEP 49152:UvHY52fyaSZOrPWluWBuGG5g5hNtRJ6UbR3LoGdf2tTHHB72eh2NT:Uv452fyaSZOrPWluWBDG5g5hNtRJ6e+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 discovery motw phishing spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

10.2.0.2:4782

Mutex

241d9c79-bb9c-47c0-a7af-9ce2f2cb3fc6

Attributes

encryption_key
E9496D60E6BC03EDBB7743D7EF80FA6044D620B6
install_name
Subtro.exe
log_directory
Logs
reconnect_delay
3000
startup_key
sustrat
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4748-1-0x0000000000550000-0x0000000000884000-memory.dmp	family_quasar
behavioral2/files/0x00070000000234f6-5.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3224	Subtro.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
764	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133694562710729124"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1204	schtasks.exe
4540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe
3912	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3224	Subtro.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	Saitama-External.exe
Token: SeDebugPrivilege	3224	Subtro.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3224	Subtro.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1204	4748	Saitama-External.exe	85
PID 4748 wrote to memory of 1204	4748	Saitama-External.exe	85
PID 4748 wrote to memory of 3224	4748	Saitama-External.exe	87
PID 4748 wrote to memory of 3224	4748	Saitama-External.exe	87
PID 3224 wrote to memory of 4540	3224	Subtro.exe	93
PID 3224 wrote to memory of 4540	3224	Subtro.exe	93
PID 4428 wrote to memory of 3584	4428	chrome.exe	109
PID 4428 wrote to memory of 3584	4428	chrome.exe	109
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 1180	4428	chrome.exe	110
PID 4428 wrote to memory of 2720	4428	chrome.exe	111
PID 4428 wrote to memory of 2720	4428	chrome.exe	111
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112
PID 4428 wrote to memory of 4336	4428	chrome.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Saitama-External.exe
"C:\Users\Admin\AppData\Local\Temp\Saitama-External.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "sustrat" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Subtro.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1204
- C:\Users\Admin\AppData\Roaming\SubDir\Subtro.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Subtro.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "sustrat" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Subtro.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ff8a0becc40,0x7ff8a0becc4c,0x7ff8a0becc58
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2228,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2324,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3236,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4588,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4808,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5004,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5104,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5024,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5092,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4580,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4456,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5308,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3324,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5324,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5476,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5648,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5924,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5928,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=4680,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6396,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5468,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6384,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6868,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6852,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6880,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6888,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=7332,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6440,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=7584,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7708 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=7700,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7852 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=7848,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7996 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=8020,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8124 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=8272,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8292 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=8328,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8308 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=8444,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8548 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=8556,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8680 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=8824,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8836 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=8856,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8968 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=8992,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=9100 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=7240,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=9288,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=9380 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=9544,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=9556 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=9764,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=9816 /prefetch:1
  2⤵
  PID:6264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=9584,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8804 /prefetch:1
  2⤵
  PID:6324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=5312,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=9696 /prefetch:1
  2⤵
  PID:6376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=10152,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=10128 /prefetch:1
  2⤵
  PID:6672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=10416,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=10432 /prefetch:1
  2⤵
  PID:6860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=10144,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=10324 /prefetch:1
  2⤵
  PID:6920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=10620,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=10608 /prefetch:1
  2⤵
  PID:6992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=10744,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=10760 /prefetch:1
  2⤵
  PID:7092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=5680,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:6232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=9400,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=10908 /prefetch:1
  2⤵
  PID:6544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=11132,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=11092 /prefetch:1
  2⤵
  PID:6536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=11136,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=10992 /prefetch:1
  2⤵
  PID:6568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=11060,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=11244 /prefetch:1
  2⤵
  PID:6816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=11324,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=11496 /prefetch:1
  2⤵
  PID:7144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=11660,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=11680 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=10900,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=11648 /prefetch:1
  2⤵
  PID:6444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=11656,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=11644 /prefetch:1
  2⤵
  PID:6520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=11508,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=12008 /prefetch:1
  2⤵
  PID:6556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=11992,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=12200 /prefetch:1
  2⤵
  PID:7224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --field-trial-handle=12284,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=12188 /prefetch:1
  2⤵
  PID:7232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --field-trial-handle=12456,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=12484 /prefetch:1
  2⤵
  PID:7360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --field-trial-handle=12452,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=12620 /prefetch:1
  2⤵
  PID:7368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=12776,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=12740 /prefetch:1
  2⤵
  PID:7472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=12760,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=12872 /prefetch:1
  2⤵
  PID:7480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=13048,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=13016 /prefetch:1
  2⤵
  PID:7584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --field-trial-handle=11504,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=12880 /prefetch:1
  2⤵
  PID:7700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=7556,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=13184 /prefetch:1
  2⤵
  PID:7756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --field-trial-handle=13228,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:7764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --field-trial-handle=13272,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=13296 /prefetch:1
  2⤵
  PID:7868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --field-trial-handle=13232,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:7924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --field-trial-handle=5008,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:7980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --field-trial-handle=6768,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=13252 /prefetch:1
  2⤵
  PID:8072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --field-trial-handle=5764,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8228 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --field-trial-handle=8144,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=8168 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --field-trial-handle=13348,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=10924 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --field-trial-handle=12152,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=13460 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --field-trial-handle=8216,i,16135088924655975773,15311912315985175748,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=13428 /prefetch:1
  2⤵
  PID:7140

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 81715d5fb7729e516713ccbf8cdbb9f84b84fd945ef96f12e7e998a2584cdc8b
MD5 7552405fdd1f5591799d4a1e080ef207
SHA1 053f0dde44fb0f8326892cbb09942660bb2be066
SHA512 d6d19fa4042b00a24f89718e6c9c4104178db797b4c766e7069e4fee315aeecc0a700cc63fec761465fe58b82694d9ac1dd43d2161922f031778b481f9c72c6f
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 31KB
SHA256 a8167736e561c18a6a184c4e6e36a67ca7e178630872f40bbb5cf8c8ddd38b9b
MD5 bd13702e025d8637bde93621d0b542c6
SHA1 283d8ec3a5cff4aa25aa4d0dbbaf06c01f7cd7c4
SHA512 4d84335372fb8d5c193275a67b478418fd52ce286ad42d85f85a0eff4a25f45432000067a9faa766b013d9838a479746deb77a0655b1239976e5daf944d7d615
SSDEEP 768:OwhonsKarjHnoTUgZhFU+UE0rlN6jqmlqmaO8BPsLs:Owh0arjHoTLZL0jBmwmT8FsLs
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 149KB
SHA256 b08987b941f17f3bedf35788d6c079ecb6887bc8354237748d20d7384e6fdeba
MD5 2ab57d57a8dcc210b0800dd9b51eea72
SHA1 d367d3640d259f5fbfc64aac7446719242af6be3
SHA512 c081ad5072ff57c0f266a78d3ba39d787d77f7d55aa4d74856eed582c23b163de7fe2c0e8589f8e15c69aeb618941ccc84d25421414384b9d4df712888847e84
SSDEEP 3072:9GbQEkR5rSWYelb9NRXoOT1kWPqNkDCmlvbA8x9v9gG0SNzCwKy5x:wbQEkRgQr9xT3WgVbA8x9VmqzTK6x
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 96KB
SHA256 a09cc3d21ad5a2d2b536c97fddfdd6d43f391eca9e657ef2904b5e80d96d5b6e
MD5 89c6949b805d5d3443b54face65d963f
SHA1 8d66d61c53062d5ac339baf1d3dc03f57298a5d6
SHA512 21fc0be146a1e5ac11ab62883f0dc6d167b4ee5db529d6640645f579e7f3b37006a53bf6ef7368f4e7089c4b9737dbe34fedac163001cec2ed0860d5afe65c8b
SSDEEP 3072:vROiGPHItgO0eT2QCL/DOLXr+kbQ295KvOIK3aC:JOiGPHzqukyksUwmz
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 1024KB
SHA256 21b7757220221262068a3943e4c7ac09e690e65c40403f3a20af4f58d1e5cf81
MD5 722a5c8e9a28cf3220825f4e555176a3
SHA1 c662f0371ee534a0e20b1b9e6a5f49e4609fb86d
SHA512 0a9cc0a324b3bbc7046be76103ea9c909d6bce6017cfb7c409344d7610b8d720be6e115775ff56b4ade6e304e69cdd944482d5f2511865dd30bd60afd0282291
SSDEEP 24576:tvFY40TCTZxUH3cyKfM7gorP9iimJOjMUI5:VXZ/yKEg+P9BmJOjMU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 20KB
SHA256 5c771a839e91fb87373f83b70ac4f68d12da2b58c6193b3012dcdc3c2521fa35
MD5 98a3c9faab6089f69ebab6fa26f8ec97
SHA1 c72dc16f5c523f1ecbe25626b758804c307492e3
SHA512 c7372ee85e2e1743f2f31eea0c283b9a5617212eda35101d0ca94016a57dcc97a028fc603bd355f4607f46359a5b18e43d326b90a3853aac3347e143bbcfb67a
SSDEEP 384:oPDRAhcvyfOnBNB9Rnr3bsOl/Q/PaNgHR4lQq5LDt1D7sVKOsw8C+qSGgy4q:obGcymrLRnrAYoPogHR4lQ+DLndOsMsi
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034
Size 251KB
SHA256 4784db290170a30a9630c8c1c7c632c0bf4b534b3fa575036d4575a26c8c5322
MD5 94269760355dc29d625fcc20e80a5cef
SHA1 0027c6056c92889304184abc03b91a4ee35dccf0
SHA512 4d286d020095cbae7cf4d92f17ee739f98a5970c263c4b57f90e16dd125b1853d9b3d850e2ee1f6ae057147d8dad7eeba6d09cf812f99fa1c350586fdaf68d0a
SSDEEP 6144:yRBdgZAr4qAR5VzI9Vn9XuJh4DcVD7d+m556mpdI+8W:yRrPUt5FI9VNuQDOPAmpdGW
MD5 SHA1 SHA512 SSDEEP

Submit Download

174a1e4b4d90c324_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\174a1e4b4d90c324_0
Size 43KB
SHA256 1e80b07d8189f199c147a2a19f7aab9cef07407f4a3a54de8bac2cdf3bf9dabf
MD5 4798c23f971b5fc95e00110ac954974c
SHA1 c92ede3742a5896f7d34e8bc3a4e7aac33e0c27c
SHA512 e0a8d0c93d7c8aba749158dca273b5ddab47a0f1e619bf96728ceb07554099ee69d3703ccaa8aeb7d7578c046d0be75ad3d84a88705e0f2a78abdd4df0e8e898
SSDEEP 768:PeSvy2anNqsljwvNKQTZawUDIp2a5hg02X+a5Da81e:PeSEnYkj2hk+Xe0u5Da81
MD5 SHA1 SHA512 SSDEEP

Submit Download

d5e42077b85df235_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d5e42077b85df235_0
Size 271B
SHA256 c87aafa319f96ac30458fe8f60818f7e1194aedaac90da9cbbd11e4642d2acba
MD5 155d5ec37edf28baa90656d6e4acfcc0
SHA1 f63302bede890ee56105b4684082d68cf72f6872
SHA512 726d53ba7626e78e1be28b1198ad9db697e9edd15f22a2b4d063995a29a1fd8f81e9d9373ee0acebbe76674cbe1aaabff0c8080bfba241eb143b47ec14d88ad5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7441e0da627b5a10ea9059d518d38d33a0c79dc9bb2726f6e835f2c2c97ec8dd
MD5 ea1af955728d5b437197dd94dad83a1e
SHA1 d7e2e03ef235222c4555ca79531aab945da6d06b
SHA512 e32e1483cd50a72404a8172a4f39a03a43314169de9f4cd1e2f5decd664a2309c1a286a14efa585594983439dffc8d449a9ed1d1a18613ab79b9afc43f1241e4
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 c4faf8f7b56b2f0b10077288f50881c49398811c33085e27f6f73cdbe617a8c5
MD5 ecccc3416f4c72a2883c6ba1db81230e
SHA1 4c90e733d37baffa8d879d6937673bc49b10b9cd
SHA512 01159a1db254f997d6362f00291bc96ccff5d5f6f7d42a58a1656f0dc0808104ea757679e9b05239fb0068c2a225059d8c1d347f858a9042337b7b0cb569655a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 99ed05c8392cde1a19ee7dd669479a35ebcb11430c07a01b6d5f39625763dc31
MD5 a935fcc9682842abb6d0db261cb535eb
SHA1 b1633329ec054e6d25f81d0c5a93e30e93da6811
SHA512 478f1025a11fceb56b9631d12ff1090e891858cb93e8b81550a6484df561ee24df8c4fc4cae75bd95db3530a2931047da3e4928366bcaf1e48064721edd7ed75
SSDEEP 96:IJUk8AU/IU9ieUw9sUbUViXUkrUHUCUtnUnSU2UZUJUIOIUsmUvU2SUyKUEBU6UO:qUvAUQUzUesUbUYUWUHUCURUnSU2UZUb
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 11d3b69a2d177dafa4b82a009d070a37d56c195cc67c92479c909bfb39c8b1f6
MD5 b0f60e1b560b4577e83a407dc5d61789
SHA1 66aabb0847ceac263e3c3a86f5e2be37a30d1eee
SHA512 839d6af3631ea8e58710b7acc7d0a99b995f66a1bf8507ca13d5742115f312bf2b5e2da22dfb2cdabde834d4d38f5bcc491a17482efb5e38964e77919c4d3db8
SSDEEP 192:aOUmUKAUAU/UvsUgUnUfUfUSURUeUTUiUJULIUzU9UoSU8KUOBU6UWUIjUVUs8Us:d9RAdkGsV+eQJYdYn6sIKayJKHTXH869
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 b0b83badd1f888615948849aa4e33e578a3e83b5e12a65d82e768581f89f8e28
MD5 402f2946836f4d9ba3dede07aa7982c6
SHA1 09ad6d4cdabc365f5894da6dc6d9ba72a33edd09
SHA512 50738b2e7ed55be6470a75ed15e68ee24c96b31b7c7d1ca257f8f779bd6e1c1ec7ebe29b0c591200dcd9210906697da57bc9ab76c9464ba3f44aedf1522dd78e
SSDEEP 192:aOUmUKAUAU/UvsUyUZUfUfUSURUeUTUiUJULIUzUuU7SU8KUOBU6UWUIjUVUs8Us:d9RAdkGsr8eQJYdYn6sIKtrJKHTXH869
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 4b409379345f53917d34ddf08e5ef8319d533317202245e63fc4d8668c1f932b
MD5 1f2824cbba95cf4f6177d8812a924118
SHA1 4a2636a403549febc9c11ca29d690230379e7d31
SHA512 99e7407c1903533f55c3f5006ba6fc12fe442191d42bb7e97ca6395b61d31f2f21c4afe75c8beb83a68c360d6f5ef95875fed9dd5ad6b785688d1e449633926c
SSDEEP 192:jMOCl/7W7Aq+95IejE9HV+FR6ey2eRkPo6yIsnVdg4:jMOCxWEq45fEtGRa2ea4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 a36a2708a62d0828a0b0ffe65215a7a4fb5949620007da5a309be9b71487bf04
MD5 b2b968368a4236dd7bca23b13082ca4c
SHA1 b067db6cd07d79b0ef56498ca2b404808b55eb8d
SHA512 bca05820e0608c6e8b8ea9ce7a5cb084e8abec32955d564209048c7dd9f47999d5434084674fd845d13b938e378377d67ea5b6837e5130c910205c73ab4bded3
SSDEEP 192:jMOCl/7W7Aq+9zIejE9HV+FRWTey2eRCPo6yIsnVdg4:jMOCxWEq4zfEtGRW2eo4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 5d18ac09325647460e50f76e3be2151462ca77b560c0da1f1b6fb25529ca14e4
MD5 8d697c0d6680f8a491e14816c8970e8c
SHA1 d83ec8f1e27615da6636577e936694d2a6f71ad7
SHA512 437097523d84e763144eb732579296933eeca11de695e0e440b24b770dd1fbee0223c5ff18eb8534d58574f0412d1eea573435a4a71ac7a389e1775366f20ccc
SSDEEP 192:jMOCl/7W7Aq+9bIejE9HV+FR6ey2eRkPo6yIsnVdg4:jMOCxWEq4bfEtGRa2ea4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 f6282f5796b0df82c22f5332702adae6410e1bec9aa4a98578bfc7310e2d154f
MD5 33695d5d8875c31a47b7160344ef3279
SHA1 bdf9e6ecffc55a21d51206d794570640999240d5
SHA512 154c8005eaec4adc70bbe634854de74fba397a2bed93f2c5983e4b7f3fad3de67ef7c7b82f59956e71cdc127a85a51807c1a1807824b119a81e0c13a9493bf2a
SSDEEP 192:jMOCl/7W7Aq+9WIejE9HV+FRWTey2eRCPo6yIsnVdg4:jMOCxWEq4WfEtGRW2eo4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 30277597e2411e3066c964b3303d9aec099ceaeea3a340e1091df8d7b28afe51
MD5 bc06a7a631a0c2694f833d5a3f531d4e
SHA1 5ecc7cfe3fa574a1412bc34ad476862360ebb55f
SHA512 540f2655eb8eca76b11ffae414b450d27a4486b70e7752f59ba98b61f72a8e5d382c5cca877b46d2be05868e30a6f03caef7ae640d8a1e075a04359293235852
SSDEEP 192:jMOCl/7W7Aq+9uyIe7eE9HV+Fh7kjey2eRSPo6yIsnVdg4:jMOCxWEq41WEtGBk/2ec4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 55c8dae3c4d25332e80b8bbbf49bbdfd083387a8ff4e12d9f422510d0c8a8b58
MD5 4b7d14224c517b7e08bca65a59065da4
SHA1 df4942923cf08f2a18c529a492eec1925a0ad3f6
SHA512 d5ee12388bb5c6925edc905b0ac98c7fb50bb961e1ec21f18eb36950af65d4015c709efb9b318454d30ac08429d2b92c01c2b364e396bda50db7eb1f6ddcc26f
SSDEEP 192:jMOCl/7W7Aq+9u+Ie7eE9HV+FbMO5ey2eRSPo6yIsnVdg4:jMOCxWEq4pWEtGQOJ2ec4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 8e22fa7c22367032aaa0247e68ab06bb3c23c67bca4bc8ba423ec21c8c1fffb7
MD5 49f8faae3a7796a9630a02f653aee58c
SHA1 fbb33ff1d52a890214bf768ce2f344c214489de6
SHA512 6838e199b82794c24bafe4ef78274933edc2563ef141cdb2290cb4ef1ad8e5444770e41ff39e59d3fc285b6c47b97072cc1093cac84614a1e7728ed8437d47bd
SSDEEP 192:jMOCl/7W7Aq+9u5Ie7eE9HV+FHQWJey2eRSPo6yIsnVdg4:jMOCxWEq4qWEtGwW52ec4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 42d28060e3ce263df85d74c386d169e7ffc350d96a32d2d1ea5753c36f362479
MD5 29c77fee2ea662607d4bd3cf24767ffe
SHA1 50e402992120392e59c899f8aa60c2253148667f
SHA512 89242e5813b7dd114adb85d60300e9f36dc19cd2425bf68864227b88a58c706924fe277ad730818841a941d1319305c1463d3ea81a34500957bee39a6803ba17
SSDEEP 192:jMOCl/7W7Aq+9KIejE9HV+FRqey2eRSPo6yIsnVdg4:jMOCxWEq4KfEtGRq2ec4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 c6d985964bb9d2826ba7fe9da83fe47e33e2bdb09c32c9630ee98d88d3c24b72
MD5 103bcad50f7860b99b6adb0908711891
SHA1 b5e9e6e6a5c75d2227bae18100603c9e784a1682
SHA512 a490cdad9bbd85786f7e24ff86307858510ce5e0d0c704cd86a7f4ba49ca023aa0c37ab4000cae1a94fc9517820d043ea0ab18c2620b8654cbdd9049dadd1463
SSDEEP 192:jMOCl/7W7Aq+9WIejE9HV+FRqey2eRSPo6yIsnVdg4:jMOCxWEq4WfEtGRq2ec4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 d6ca2c5ad37caa30251073915ce9b5da76a08283e9937525b7d293dca411c43f
MD5 a2901ce2afdf28f2d41ff083e79e68b7
SHA1 cab8c4ad3977c6f5b6c3187bcdb0c239396dd747
SHA512 b290f66e327341159aa0526190f101bf9d27a06e75788eeecd5c62a2373fd7f24397bd061fae54b00e08cd647e1aacec89c2dd2ec7717f244b5bc563cd0f889c
SSDEEP 192:jMOCl/7W7Aq+9AIejE9HV+FRqey2eRSPo6yIsnVdg4:jMOCxWEq4AfEtGRq2ec4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 2d6b371ab041d53576cde1391c23afbbec814a592db862562036aeea1de8fa68
MD5 c9a7cafefa31ad0884f0edefce769a79
SHA1 9c41b28d7adc0f95e2452c6d75b130e6fe38e9c0
SHA512 42ed13f98d05d67519a19139ca4b97d459a82454b11455f7e5173af550d3f9cb26fc934a27c20d13725a6366e70b3dcb721856738addfa489c06625eb9ac9e9a
SSDEEP 192:jMOCl/7W7Aq+9QiIejE9HV+FRqey2eRSPo6yIsnVdg4:jMOCxWEq4QifEtGRq2ec4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 a3e5642b8ae409afa4117ec001282713e69707bcf9277a37e5f09fe08a4ea9d2
MD5 7ebbdb2f756875662e1eed8ea5a63401
SHA1 7eaf94f49a7a4a09bc157f4be81c32cfcdefd26e
SHA512 affc5b33a20ce17d4f2fd1fa9f83b2e6f88722009e61a6d45e4d39ba874627bb1d71d56505eaf7a140a98d5bb518708605072b55705309d07f2e8a6b2d0c521e
SSDEEP 384:B1P97pLhLc+eJcXi41kXqKf/pUZNCgVLH2HfSpsrUOqHGqOEVz:B997pLhLnOOi41kXqKf/pUZNCgVLH2HA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 ce0b6465c64c0fd6db3e645fe3ede31daa5bdb77c60159553c9959a7a83963ff
MD5 0482420f594394e5268e9af2f0b4670e
SHA1 c767d21355e233fc8627b81fe71997c8251b4da7
SHA512 6edb6c31573a007149e5a8bba2d3c75ea6e12fc89dc82b64e55516a1d34c87b83e93916af465347f780b6eb4fa53253273ebbf78eaced44d4e991c475deff68a
SSDEEP 6144:fzCxo+oyUwOJG5+MFF9rNdyhf5U3o310MBdodSI:+G+oyzyu+Mdrjyhf5U3ol0MEdSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ba70ecb6-df61-4e24-8f68-ebc158f2c8c9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ba70ecb6-df61-4e24-8f68-ebc158f2c8c9.tmp
Size 202KB
SHA256 485920ab72198959756981920dac29d1e042432fe4b5e9a1d4b4e35963dcd040
MD5 792842777c060e81a78acba97d2adab4
SHA1 fc70b5bdf229bce80e279d9d083d156c1412269a
SHA512 cc0cfdca55f055d5cf82a67c97f120d7f267aaa531125267ac53100f4109fc45738253e75bfe5d4b91d126338542382a65962c10a1bd96152b06258b9c473b2f
SSDEEP 6144:CzCxo+oyUwOJG5+MFF9rNdyhf5U3o310MBdodSI:rG+oyzyu+Mdrjyhf5U3ol0MEdSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Subtro.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Subtro.exe
Size 3.2MB
SHA256 09d2155850e8826432051c3c86100633548c44ab6ff5cc6bde9a478f0e28ca2d
MD5 f80cce52b08718d9bd9b8d41427b97ca
SHA1 ca19d99893df61c7d4d90f3e91fc635cb6a283d9
SHA512 85951f4b206937cb84292042ec6e41a184f92d3ebff01dcf1ef60160091b30bd81cc33af03a8f6fc714eb9da2657510a7773c1cb0dcccb3eae14ec524b6f6bd4
SSDEEP 49152:UvHY52fyaSZOrPWluWBuGG5g5hNtRJ6UbR3LoGdf2tTHHB72eh2NT:Uv452fyaSZOrPWluWBDG5g5hNtRJ6e+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3224-14-0x00007FF8A7750000-0x00007FF8A8211000-memory.dmp

Download

memory/3224-12-0x000000001C210000-0x000000001C2C2000-memory.dmp

Download

memory/3224-13-0x000000001C900000-0x000000001CE28000-memory.dmp

Download

memory/3224-11-0x000000001C100000-0x000000001C150000-memory.dmp

Download

memory/3224-10-0x00007FF8A7750000-0x00007FF8A8211000-memory.dmp

Download

memory/3224-8-0x00007FF8A7750000-0x00007FF8A8211000-memory.dmp

Download

memory/3224-15-0x00007FF8A7750000-0x00007FF8A8211000-memory.dmp

Download

memory/4748-9-0x00007FF8A7750000-0x00007FF8A8211000-memory.dmp

Download

memory/4748-0-0x00007FF8A7753000-0x00007FF8A7755000-memory.dmp

Download

memory/4748-2-0x00007FF8A7750000-0x00007FF8A8211000-memory.dmp

Download

memory/4748-1-0x0000000000550000-0x0000000000884000-memory.dmp

Download