45a446924a82bc7deac2d54535d02d2625995d739048e4e59bbeecd676f8bf7b

Analysis

user interaction
yes
max time kernel
389s
max time network
382s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cytrix Tag.exe
Size 651KB
Sample260416-env65afs8j
SHA256 45a446924a82bc7deac2d54535d02d2625995d739048e4e59bbeecd676f8bf7b
MD5 cdc4fce98f2a59c2102085bce566d94f
SHA1 8c4164a7ae741242fae61a74f42e5b73b8940f36
SHA512 a958fe0a120665e5bbd80e83b2c485e8adec263d130a7f9dccbd6fa96b47eaf5208395a3c450c85485ca8d28b629866b7deb6fa96e352ac275082e86bab93365
SSDEEP 3072:+QJ/VdFgIW9mYucJ/OD8JlsI97TI67G2E1:v/7FG9mpcJ/OD8+n
TLSH
T116E4F192231A64A5EC5205F4CC5DC7387EA26FE52E10D6FA22D1FFFB3AB13827915610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
64	3224	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
5940	Cytrix Tag.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Cytrix Tag.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3224	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207860091528594"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{29B3FF1B-BDCC-46D5-A882-5DF5D71024B2}	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Cytrix Tag.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
5236	chrome.exe
5236	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4420	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 1252	4212	chrome.exe	82
PID 4212 wrote to memory of 4308	4212	chrome.exe	83
PID 4212 wrote to memory of 4308	4212	chrome.exe	83
PID 4212 wrote to memory of 3224	4212	chrome.exe	84
PID 4212 wrote to memory of 5448	4212	chrome.exe	85
PID 4212 wrote to memory of 5448	4212	chrome.exe	85
PID 4212 wrote to memory of 4852	4212	chrome.exe	86
PID 4212 wrote to memory of 4852	4212	chrome.exe	86
PID 4212 wrote to memory of 1112	4212	chrome.exe	87
PID 4212 wrote to memory of 1112	4212	chrome.exe	87
PID 4212 wrote to memory of 4980	4212	chrome.exe	88
PID 4212 wrote to memory of 4980	4212	chrome.exe	88
PID 4212 wrote to memory of 1888	4212	chrome.exe	91
PID 4212 wrote to memory of 1888	4212	chrome.exe	91
PID 4212 wrote to memory of 3480	4212	chrome.exe	92
PID 4212 wrote to memory of 2340	4212	chrome.exe	94
PID 4212 wrote to memory of 2340	4212	chrome.exe	94
PID 4212 wrote to memory of 4724	4212	chrome.exe	95
PID 4212 wrote to memory of 4724	4212	chrome.exe	95
PID 4212 wrote to memory of 1992	4212	chrome.exe	96
PID 4212 wrote to memory of 1992	4212	chrome.exe	96
PID 4212 wrote to memory of 1960	4212	chrome.exe	98
PID 4212 wrote to memory of 3740	4212	chrome.exe	97
PID 4212 wrote to memory of 3740	4212	chrome.exe	97
PID 4212 wrote to memory of 964	4212	chrome.exe	100
PID 4212 wrote to memory of 964	4212	chrome.exe	100
PID 4212 wrote to memory of 2812	4212	chrome.exe	101
PID 4212 wrote to memory of 5940	4212	chrome.exe	102
PID 4212 wrote to memory of 1744	4212	chrome.exe	103
PID 4212 wrote to memory of 6044	4212	chrome.exe	104
PID 4212 wrote to memory of 3964	4212	chrome.exe	105
PID 4212 wrote to memory of 5236	4212	chrome.exe	106
PID 4212 wrote to memory of 4876	4212	chrome.exe	107
PID 4212 wrote to memory of 4876	4212	chrome.exe	107

C:\Users\Admin\AppData\Local\Temp\Cytrix Tag.exe
"C:\Users\Admin\AppData\Local\Temp\Cytrix Tag.exe"
1⤵
PID:5384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f013c728,0x7ff8f013c734,0x7ff8f013c740
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,15248533279573372003,13505908941320948085,262144 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,8082954414475171034,11510495097781820844,524288 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1456 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,4948998818166732718,4134536039598615599,524288 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2540 /prefetch:13
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,14641744870167952733,7539362793710805936,2097152 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,2433942245046298950,10137370379579475231,2097152 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,12604874820756861200,10259576644541880115,2097152 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4344 /prefetch:9
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4536,i,24494752051641661,13173097282483859651,2097152 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,8165638475997254607,8404816451606973337,524288 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5488,i,14033935366130837235,4417484597204213624,2097152 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4772,i,4392013266188905094,2598827040022130887,2097152 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5516,i,4095040774294870356,17794693194769778202,2097152 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3568,i,5421907758567954373,1826905057435353218,524288 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3592 /prefetch:12
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3524,i,3243960655456188440,8325605371828227409,524288 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3564 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3468,i,6204344313561123267,18128085862891832433,2097152 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4740,i,16579080312529987223,14492217669234790309,524288 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4480 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2812
- C:\Users\Admin\Downloads\Cytrix Tag.exe
  "C:\Users\Admin\Downloads\Cytrix Tag.exe"
  2⤵
  - Executes dropped EXE
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3360,i,5474452219935816512,5987490685958898844,524288 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3724,i,7295978830444204680,7106741400996203645,524288 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,10460322496562916572,1755663051601070505,524288 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6452 /prefetch:14
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3240,i,6225772856465227528,1420598241120703241,262144 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4360 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4004,i,12834886520511748306,12952139122771253167,524288 --field-trial-handle=1916,i,4432729218130440600,8729644889632540957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:4876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5268

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f778d1ac9a16d970c1cefc99a73402af77189f60d14dc290c450a300008ff6b5
MD5 7da00367b98dd2cf0b7ce2212c42a85e
SHA1 b00830e6098f8ddda0b24ab1caa96b5870f4f9c0
SHA512 ee89daea6dcb6a005cd31b36c5b1ff09f600edfb1f5530649a56149f4125d7af6d99a1b89e683effed193ecd1ff062b8120bd57247f292a902470c8bd92e88a1
TLSH
T125E022BAC826DC3B1AFD0B5C6495464AEB58131B2B90898F3B3C820D8FB163A45C685C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 552B
SHA256 28bc450a173225d24dc448c39c62f811e4e486c6a115ace411d580f477228d47
MD5 81dd3f9fa4e52c0ab8808e1d8b3896f8
SHA1 46e49b3b46792c96d276b8fad62ac4a832420749
SHA512 3cb078c02f29969d5cac03463cca96b4df56d6dc5ddb1b3235203e34197be6cf399d758df143909c5fd58828d05f3f3f9ddb88ef4fabcbd590b37e93dda9a777
TLSH
T18BF0ABAC24E1F44BFB59083288F84985BB7D6668380F1FA2E1C180BC84433D5990AF04
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 f13dad52a5ddc6180806a0b0d126d43d6864dce647313db03842e75ca48a085c
MD5 f77f06e01092116f11a052c38d5f035c
SHA1 e37763527c64853fb2ca5190a3339be6c9e881d5
SHA512 3252b82b095f9f5e1871ec786003f079511d6a0254d43a990ecf5dfce73e26ae27b5f402b36d9b39c57a1cf7a9f6c8bffc8d8bc1c6954f3dab20aa4883a012cd
SSDEEP 192:Diwjbz+exjdjcJjuXj4aIa5zQYiUjKmSMrGWQiKsAYjpjhijhbjh8jBZjNj7jKj/:Diwjbz+exjdj4juXj4aIa5zQYiUjKmS5
TLSH
T11A027BF7C3E8467DC91256F4AA256F2BDE2D0959436C3C0A89D8AF4BD3E18B1E34054E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 28df28d3c060a59ef5d3ea59b07ac5778315039d424d49e43bf0a5903fe9da08
MD5 64e869f14755b7ca362bc7f94cb49a20
SHA1 a1fc08df53af27aae972a1153ba6b712afb3dbd6
SHA512 c9d37e669a5821617d56698d9147083327667a19eda6c5464404fb02a6389382f03d907b99d05a8e802998992c54e1bcafdfae8d711aa35734a5da664cc7695b
SSDEEP 192:Diwjbz+exjdjcJjuLaIa5zQYiUjKmSMrGWQiKsAYjpjhijhbjh8jBZjNj7jKj3jT:Diwjbz+exjdj4juLaIa5zQYiUjKmSMr2
TLSH
T1B6027AF7C3E8867DC91156F4AA256F2BDE2D0959436C3C0A89D8AF4BD3E18B1E34054E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6055eed70ea0640b9efbd38b4aa9aac10c697ebc80fa35120c52d53bb997540b
MD5 8579198464282ffdd673d4304679558a
SHA1 97994ddc5cc22f4087ea1173334556e9c885f576
SHA512 9e88dcaff7d22c04c7c501f428cb3ab8b665edaa5359a2c0ccd63212af783dfaa1b0f4c370d2a1149c45fe7f8c9f4f66f425bf62dc9e96d1ac09d7544fbd78cb
SSDEEP 192:GRNfYrsKs2svbv7OhAPRp2Vflx9BHsb+WNn3cdQv2Sy7asKRX+VyIsnAUgtaJ:GRNfMMjC8XODwsq2Daf28
TLSH
T14E52D82EAA18353B8CDBD22AFD65FB57E7F5102161842E88D6FC8A1C14E75CD621B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0a91113fe968b4b9b859ee667e6532165dff964837ea53fcba38a48b75f57eb0
MD5 90d5a1f97496113721e6f8153b7c965c
SHA1 8c9e3f2f16291286881e6a49e02f34ac7d9d4823
SHA512 8afe95ff0dc3635cdc41efc4edba461e70006a644d674db9ee32e26916a2fe7cbb336c8f0081dced7239f13f6fc332beca61672da186482840152f429776bb4d
SSDEEP 192:GRNTYrsKs2svbv7OhAPRp2Vfl59BHsb+WNZg3cdQv2ky7asKRX+VyIsnAUgtaJ:GRNTMMjC8XeDwVq2Vaf28
TLSH
T18E52E92EAA18393B8CDBD32AFD65FB57E7F5102161841D88E6FC8A1C14E75CD621B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c420a359a1a2811dad30bfff7b260c355d4cf0296ad1de081a13efa0c6cf0997
MD5 e404419aeb6a7ff82c23dd1f07d8f1d4
SHA1 223370d8b2b79e2353c3f75a48e97b2d6b807fb8
SHA512 e8bc05d3a095bb68228811dfc92312684c55e3536a5690634a0dd446fd826819218e5a82a2fce3337a3aed0342408a50ddee5c1b346d79c4f8d3bcd394574f5c
SSDEEP 192:GRNTYrsKs2svgv7Oh9PRpdVfl59BHsb+WNZg3c0VynQv2/y7asK5X+VyIsnAUgrK:GRNTMM8CrXrDwVX022aT2e
TLSH
T1D862EA2EA918293B8CDBD32AFD65FB57E7F5102161841E8CD6FC8A1C14E75CD621B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 b348ef89a2004de3932b2d422cfbadcb8511ef1f7a57517647d45e46cced5182
MD5 b0d1f07abc4aceeca25ae213a8bbac55
SHA1 a12bc0ba5cc6482694c623f530bb61f84aa919e1
SHA512 31718e2157284309c07a2a635a298c85d9a7fbefa24d929b57b0b42e496770d473b3856a02414740260339a70352d551dfa116ce6cda0e72e227cf4c48e62db6
SSDEEP 384:4qj0v7KxkXqKf/pUZNCgVLH2Hfgsl0X7pLuLcifa7XOD0z+ErU3W8HGWTStBdUV:460v7KxkXqKf/pUZNCgVLH2HfgsyX7p0
TLSH
T1AE72F867AC4C9A770F94C6CDDC26BA4FADB5024B65DD886483FB581903C5BCB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 596e8bc85d9bc4074813f0c1212c43e1660632043baade889767cb8025ec981a
MD5 ad524cce62c5709c52f30653eab685d1
SHA1 1fd660b816c7c2411049d274f36d5e116d321812
SHA512 191f4691a836e534941b818c577fa6d8658be6c416d3f1aa346ba1b3a2175cdd2ca2b451701a1e312d0c50a26cf410f9867657f717ac62d7ae8d5f6ed9a40802
TLSH
T1B4B012508001D901C08702F4118204C837149F19C7061301D3E07D75983A1A0401C150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590759.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590759.TMP
Size 96B
SHA256 a4ea19dd4aa23b35c4825f361ca2b3c00d2ce66a9f7b3a746973fe712a2c6314
MD5 a238100106e4345abe9b6bce8fbe4749
SHA1 6a945618514f140742a6f7d13992ccc4186ca162
SHA512 5e649f073641dba0cce73927b9060eb010d6cf6194a5f8dd3d49fb23e38dc21f36c7a7a16700162cbba5b8ba4ffafbbb8521707d0f9d47035f699b2c7f276d7e
TLSH
T169B02282C00AB283C00203B028BA80C830B0EF20C3030202C2E00E3BCC23BA000B0C20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\d1d9b942-3231-4e78-8fc6-2507c1027267\index-dir\the-real-index
Size 72B
SHA256 59a74762566ef3454202cb5618a035e4ea880996c8f4545e058b25ec5c505b8a
MD5 f31023e04cc97b452c68a5048cdbd622
SHA1 e4b16e4df09a309a6e2d06410d8d967d61970166
SHA512 5d65a9b17eb1cc3893b39e0eea6d7a8fc5827414f7f1c2dbbba489d6ca39b8526187422c31d4197d591e7f0eb65d80c480f603d753c60c2651354531e73c0367
TLSH
T12CA0022823545711C84246B43467016132368915EE051202C1E22298DC911B5510313C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592040.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\d1d9b942-3231-4e78-8fc6-2507c1027267\index-dir\the-real-index~RFe592040.TMP
Size 48B
SHA256 cb0ffdc5278c4d7a09a730ed6bfac51fae7ea8035ba876ecfea67100b69a5f08
MD5 b547bcd1388f42653d86a6e7834916e2
SHA1 72d3be5bae4b236edfe35641076da61f6db63805
SHA512 cfb1f8cb937f529323e904621b7b28e00027c1e2b2da876e5e94bf7d16799e945fd3a550b1442c4fd2734cba36ca83140377c4ab6174b8c3f532c3a37c02cadc
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 73B
SHA256 16f2e733956a69caf3cba9a7984df8a9072d616051880ec52649d5a25de0b733
MD5 eabef125304ed56696f07d27dc0a4760
SHA1 f7b1959eaad9661d26183f0a39602128c7770501
SHA512 39ec79f7f17cc61719521fc98f8b1f25f58c611763ee56fad334f92f8d372156a636f7630dd049e7c55894d8952af5e7888725220d46d382715c693ce7c9e896
TLSH
T109A002F71804808E0F30B8E8353ABB5DE00B91DC8CC4CEF4C419B0422138AF70402994
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 154B
SHA256 39e8395d05d40587fe90cbb9fb66326b93cce37849ff582cf91a1aeb105f85d5
MD5 a9f56ca8772045902b412b153f1e1f0c
SHA1 67478a7acec39f2757153eb88193f1e54c2caaa4
SHA512 24d4574267ff665b7766dcb041d7e30429884b8854a9f183a293664d6f07e76086010fad32716085bc479e4eed4f176ca6c6bd04bffb0ab048dd63df57fb0162
TLSH
T142C04CF32824968A0B71A9D435297B5ED2574DAD4CC4C9E8A8157046703C5538845768
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 148B
SHA256 292fce893e35e6dcf4ef8f1cf38fac70528f3b867528adf9447ccb13eced2116
MD5 7c6f271446400591aaacda133de56263
SHA1 efc87ce103b1d5370e8225a481e6e1bc16c23eba
SHA512 10db89f378232a9273b503223a5ba115e5ed8447115c5a495088a8bea2c0d39a491c70e52b549b7cd1c8628c5747e78afcaec8d38ad4d75130808d18d7e06074
TLSH
T1ADC04CF32814968A4B70EAD435197B5ED247859C4CD5C9E8A8146046607C9534C46768
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58d0a9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe58d0a9.TMP
Size 157B
SHA256 dc6442a4c857467598bdfa58527f907ef40071cefb6756ae50eb632bfa35772a
MD5 7f794178ac0e239820c3005e12304cd3
SHA1 9e7cb25975e3e8776e0941f0b406dd4400a27141
SHA512 8ef25d767167b3c6a87af8c0216456fe2b7067dc028b00d85bc97960ddec884fcc9f5194563b2f8e3e1b25412d5e50f77d02a91453f15b2eadae75c736ae215d
TLSH
T147C08CA7027140491B20A8D0743A778CD11AED9E8CC4C8EAC806B0C22078E928011625
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 5cea387989166b12ea64eec02544a9ca8a0f5d7b617e5f168a68e4e0edeeb4bc
MD5 d83bd63a09e2877a8bb157eb852ddb9b
SHA1 e579d6869705ff92190077d8c1a6819764c2590e
SHA512 082dfc4786a5a4b0d13e0a0726f0fab59a820930d10b8ac00710c02e47b00ea1cc316fda264528a87a9cb93ab8bcc8fd165bf9fcebbfc101f400fb5c8f7e67d1
SSDEEP 3072:fvHv8zacwtpWKmeFh61Z7MG3lKf6sXrmO++J3qUQm08KMWF0bFTcVHr6zh:fvUzaMKlQ7337q6O++JjcMW2VcVLa
TLSH
T1311412B5EC1FBD2806478A8B60077C2D0CD6A6DE7318D93D30CD3A8E10DF64A9697867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 3a36d2df80acf073cc9f48909e0d1027602db102a4826b3be4e7493979882afd
MD5 8e207075f8d74731ccc899931db1891d
SHA1 0728a6f710528b6387d50bb6f5f7544fc76ccc3b
SHA512 9ba5a7f56a8cf75d0f7c6cd2fd68cd5b5e7bfea0828c74cf51aa11c5fb28b3e9babf8707925df16a97f22893c724095842344c40ad9bd6f445bdf58b304570c0
SSDEEP 3072:nvHv8zacwtpWKmeFh61Z7MG3lKf6sXrmO++J3qUQm08KMWF0bFTcVHr6zh:nvUzaMKlQ7337q6O++JjcMW2VcVLa
TLSH
T1AC1412B5EC1FBD2806478A8B60077C2D0CD6A6DE7318D93D30CD3A8E10DF64A9697867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 9b5f45fd6c35f949b7102dd3ced93a304f5d3f8dfa195fd742fa3bd793055c13
MD5 c3de56986a2d28e5b71fefce532e5878
SHA1 4b8e8a5f8d80f834ad80965d750f54b37dae45b6
SHA512 688366e1fde25ca319edd00f76976382f8b0ba0e8d6d87709fdaa31388faed5a3265e3c2049eba8bde4606cf7c37be3331974fc4542bcf2e618a643f00f7d08b
SSDEEP 1536:aP/UsP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:6++J3qUQm08KMWF0bFTcVHr6z2
TLSH
T1699302B9991F7979536BC29690179CAC4CD3DCCE111821BC30C76F1E18BE393A31B895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 1b1382d73fd5e00af8bd652226c7e7fcca16defcc22c3ddc2ff67a34f223aaa3
MD5 ca6582e4519da83e87dd953a889c0df8
SHA1 96462ddeb57b514eb5f4c985c6f972310940402c
SHA512 d6583fd2a8ce461cd20ca84995d327febcc8a02eb4a2332b5be61cf0fd83581c12bad170e463ee3d10194b27cd46422e02d20cd05ed5aba0ef5911725c437575
SSDEEP 3072:cHv8zacwtpWKmeFh61Z7MG3lKf6sXrmO++J3qUQm08KMWF0bFTcVHr6zh:cUzaMKlQ7337q6O++JjcMW2VcVLa
TLSH
T155141295EC1FBD38020BC68770176C6D08D666DE3219D93E31CE7B5E04DE68693A7827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 7ca3fd781175382324566d697aee0e0852d044e0af3fcacea20d519852a7d762
MD5 4c9f87e62d81bcf488b7ec3f64ffb9ab
SHA1 344a4fb7b9c7e0aee4bf9dc55f7afe6c471d6150
SHA512 e8c0e53244994c72e87175ff6a24414cec8d30b875c271389ce0a2e14942e8b4eff1ccbb82c9a076605f10ec4ec7f06318bab3543466b2cf5281710750cb3520
SSDEEP 3072:XHv8zacwtpWKmeFh61Z7MG3lKf6sXrmO++J3qUQm08KMWF0bFTcVHr6zh:XUzaMKlQ7337q6O++JjcMW2VcVLa
TLSH
T12A141295EC1FBD38020BC68770176C6D08D6A6DE3219D93E31CE7B5E04DE68693A7827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 3ffbfb4ad814b72dea3aa49fe058cead46a3f80ddabff29d38881cb1c5723647
MD5 5f7b89a7d2bdd2987006a2aa785b9313
SHA1 90f2fac0843fa2f605db361605627d0bca5fdbf5
SHA512 16ae1e209bf1c9c4c45a76627b5e39f2f5c3334b070e17f02cfb0594202e23e325efa4dbaec9184a89362ef6680d631d43058ac407b478659c895d3442512ef7
SSDEEP 384:2JWJiVca12krtuJPpmXmlJVjeQ8RJoflgh0jU1cW75Pwm52+GDa50YL6YAVCcC3J:e+iVcWrsl8RJIlgyjU1ceJ2+GDa50YLV
TLSH
T138A24B743AF51319F3F69F759AF1A95A643AB8669C00DB4D0162028D0937D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cytrix Tag.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Cytrix Tag.exe:Zone.Identifier
Size 475B
SHA256 0a18cc34e39257622680779692c0416bd78aaa403e9f11632c8621cd450320a2
MD5 222b4656267342802bb9ea46f0b1f507
SHA1 d4d173565c39308fd7d8745d3694371d312182d7
SHA512 6c15e1eb61946149fa144e907f26684e2ce8ec12ceccb85a537ad51c991059165337280f5fbf9981056e4b90c75d7122372f33399e2264eaf6a71d4dc7fe644e
TLSH
T19FF0D4FF4D4041AD51143B5C7096A2ACB11711B638F3440ABC1153DFB8D44B4DCC9D65
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 20511.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 20511.crdownload
Size 651KB
SHA256 45a446924a82bc7deac2d54535d02d2625995d739048e4e59bbeecd676f8bf7b
MD5 cdc4fce98f2a59c2102085bce566d94f
SHA1 8c4164a7ae741242fae61a74f42e5b73b8940f36
SHA512 a958fe0a120665e5bbd80e83b2c485e8adec263d130a7f9dccbd6fa96b47eaf5208395a3c450c85485ca8d28b629866b7deb6fa96e352ac275082e86bab93365
SSDEEP 3072:+QJ/VdFgIW9mYucJ/OD8JlsI97TI67G2E1:v/7FG9mpcJ/OD8+n
TLSH
T116E4F192231A64A5EC5205F4CC5DC7387EA26FE52E10D6FA22D1FFFB3AB13827915610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download