3fb88d8d475242a0d558b2bcce405254ea386844274d80ece0eab1780efa529d

user interaction
yes
max time kernel
316s
max time network
330s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
MEMZ-Destructive.bat
Size 315KB
Sample260419-ppcfhsav4q
SHA256 3fb88d8d475242a0d558b2bcce405254ea386844274d80ece0eab1780efa529d
MD5 d1494de6a497151197f3e3c2db31fe43
SHA1 76b20ec1fd7517100a4bcc049864923358071548
SHA512 c93195e4054439c4992edf6ff710a1b822123a29ce5198ebd84ebeb5713e719253117b366bbd30e6525a5aef9529b1a0673ecd6dfb68b7df42f366553d44b6f2
SSDEEP 6144:48vKn54IMdW0VxkHMAfarZ1OF4Hwk29QmfmJARqbLmutcMZJT3CqbMrhryf65NRo:pvKn54IMdW0VxkHMAfarZ1OF4Hwk29QB
TLSH
T1A264A470B234A67D422B5AC6F3706714B2AAF31BD28949E0A97FD3B457C2DD4FA43058
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "0"	WinXP.Horror.Destructive.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinXP.Horror.Destructive.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WinXP.Horror.Destructive.exe

Disables Task Manager via registry modification
defense_evasion

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	WinXP.Horror.Destructive.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinXP.Horror.Destructive.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3896	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210754183666503"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\WinXP.Horror.Destructive.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
2584	chrome.exe
2584	chrome.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe
2084	WinXP.Horror.Destructive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe
Token: SeShutdownPrivilege	404	chrome.exe
Token: SeCreatePagefilePrivilege	404	chrome.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe
404	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3320	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 3940	404	chrome.exe	82
PID 404 wrote to memory of 5024	404	chrome.exe	83
PID 404 wrote to memory of 5024	404	chrome.exe	83
PID 404 wrote to memory of 3896	404	chrome.exe	84
PID 404 wrote to memory of 1032	404	chrome.exe	85
PID 404 wrote to memory of 1032	404	chrome.exe	85
PID 404 wrote to memory of 2236	404	chrome.exe	88
PID 404 wrote to memory of 2236	404	chrome.exe	88
PID 404 wrote to memory of 3184	404	chrome.exe	89
PID 404 wrote to memory of 3184	404	chrome.exe	89
PID 404 wrote to memory of 4612	404	chrome.exe	90
PID 404 wrote to memory of 4612	404	chrome.exe	90
PID 404 wrote to memory of 888	404	chrome.exe	91
PID 404 wrote to memory of 888	404	chrome.exe	91
PID 404 wrote to memory of 3028	404	chrome.exe	92
PID 404 wrote to memory of 3212	404	chrome.exe	94
PID 404 wrote to memory of 3212	404	chrome.exe	94
PID 404 wrote to memory of 3804	404	chrome.exe	95
PID 404 wrote to memory of 3804	404	chrome.exe	95
PID 404 wrote to memory of 2608	404	chrome.exe	96
PID 404 wrote to memory of 2360	404	chrome.exe	97
PID 404 wrote to memory of 4324	404	chrome.exe	98
PID 404 wrote to memory of 2800	404	chrome.exe	99
PID 404 wrote to memory of 2800	404	chrome.exe	99
PID 404 wrote to memory of 2404	404	chrome.exe	100
PID 404 wrote to memory of 2404	404	chrome.exe	100
PID 404 wrote to memory of 2092	404	chrome.exe	102
PID 404 wrote to memory of 2092	404	chrome.exe	102
PID 404 wrote to memory of 4700	404	chrome.exe	103
PID 404 wrote to memory of 4700	404	chrome.exe	103
PID 404 wrote to memory of 2584	404	chrome.exe	104
PID 404 wrote to memory of 1940	404	chrome.exe	105
PID 404 wrote to memory of 1940	404	chrome.exe	105
PID 404 wrote to memory of 896	404	chrome.exe	106
PID 404 wrote to memory of 896	404	chrome.exe	106
PID 404 wrote to memory of 2308	404	chrome.exe	107
PID 404 wrote to memory of 2308	404	chrome.exe	107
PID 404 wrote to memory of 492	404	chrome.exe	108
PID 404 wrote to memory of 492	404	chrome.exe	108
PID 404 wrote to memory of 4916	404	chrome.exe	109
PID 404 wrote to memory of 420	404	chrome.exe	118
PID 404 wrote to memory of 420	404	chrome.exe	118

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bat"
1⤵
PID:2404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe128ec728,0x7ffe128ec734,0x7ffe128ec740
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,10968042048034151696,14536617076759130843,262144 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,16444078745516604114,7134203509923150608,524288 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,9329001375199888191,3300906092556956575,524288 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2460 /prefetch:13
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,1591197337831170435,5993109475226187497,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,6972294224755758907,3081349677209587430,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4348,i,9338313387672358819,6506002182109720454,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4356 /prefetch:9
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4628,i,16781829268347880855,10642592656568683501,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,6396419456425301319,14677001775493023092,524288 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5760,i,14727390454627943928,15232549226959161311,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3508,i,16994903855647880735,12147233198684158461,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3576,i,11702782837279013104,13306389149489115814,524288 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3228 /prefetch:14
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3852,i,12680701601116996787,2959770327195503043,524288 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3556 /prefetch:14
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3520,i,1849082419214641140,2309533025740934384,524288 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3856 /prefetch:14
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5988,i,1996143411198054325,13314000390998628488,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6072,i,9568047221078230305,13358748371245137325,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5788,i,15908745702264544491,16831530020573336438,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5756,i,18330026579318036594,13896438288624825286,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6156,i,9783393967263132824,1171389475042766517,262144 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6152 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6260,i,15594131755535845853,5286668258222070593,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6004,i,8292925339990271958,10383797671101244096,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6400,i,13548254332248381117,69506345473543193,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6608,i,782588766181817384,16027417163006101656,2097152 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6752,i,12529734823095269649,10675538070817130111,524288 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6788,i,7147352498085597153,1655572078536241822,524288 --field-trial-handle=1968,i,10649742835433391842,6653882004529557517,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4532 /prefetch:14
  2⤵
  PID:420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5036

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3320

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:764

C:\Users\Admin\Desktop\WinXP.Horror.Destructive.exe
"C:\Users\Admin\Desktop\WinXP.Horror.Destructive.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2084

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4384

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004B8
1⤵
PID:4456

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3292

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:396

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5060

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2152

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4680

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8268a3ea4274bdf4f9d75328cc60421e936fd31397d4c5aa7168f33c9fa3bc65
MD5 569ce22818c6b42ce2a9083c0e92d572
SHA1 bf69e6e4c555d5d9359d8bae50e7601e1a58bb15
SHA512 9fa813a33b988f52e1e5fe30e3108a70578ad6e89da1330cd6d0177d8abcbb16d28711a5ea687087abe6249ed3401b98a9cff122c4c9261d08edee7b9d8900f3
TLSH
T14BE0E5ABCC219C2719FD0B2AA0504BC2F60013572A40895B3B3C810D4FB163745D981C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 82KB
SHA256 de21f883ce55e5661461b71e8794b18281b01bdfdea2a22fd23c8476c3f0aae3
MD5 ae9fe899d5f9c1fd175835bdb3ac011c
SHA1 28ca696e98d0470ddb9a2bacbc8e63d616eca96a
SHA512 eec61e322340af519d59aaf01695e50f6254c784675512af252ab91b7b1e534728fa3eac7d46c6736ac132ff8644663307519c09b6014c92428235e54fdec413
SSDEEP 1536:i1jrZHvB6MjwNmoDi4jgN9DSdkmuPa2LMWwKfWt4Rq1InDnIhZOVlt:+ZpFYDi4j7dUa+GKQ8IrMt
TLSH
T1338302212C57BCBDFAC1F19770C2DA28892F55D6872B7510D5BAC2778328929E4D1F0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 aafbac11497c031851644c392a40a8cc39ecf918de683938377e532996d0c503
MD5 40fc617aab81e0fcb0a63959bb21c235
SHA1 f67c2c676daa4a950b23972339b88bd67e9ce52d
SHA512 35a8d7c6b6fed180fc1b0a20907501ee0fea16cefa19efb123296655b2122badbcf4ea793322f6bddd932d3b60514ba09ac6a38d1da37f8b5c71c5d3e684d9d7
SSDEEP 96:Ag76iIWfCwpbXnnkvWOJtLUewwbntH5ssFNwB7VIJAM5AhNU:TfI8CwdwoeBtlFq0JAMmhNU
TLSH
T1B5C1B60944B0CE0BFB064032EAEF5D106279DF8A7C668E4313E6586EA12B6D774F2975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 2d4ce42ce7e7128312bf4060c13207455856ac427b631221d3ebf98086f144ce
MD5 11b94cc98280c757f060cc37f491ff7b
SHA1 7d43b9774e943f91eda35f07b2c5aa5ac9841ade
SHA512 f202b8c9674934300cc6743550ddf653fd9ca83f61d894f534e08ce35884cba33f4d0f9c1d301659502ad0c4d9a6fed5b5abcaf64d893bc304ec0381969155b0
SSDEEP 96:Kg7+izalcwp1lnnkvWOJKLteww8Lntt5+fSslwB7VImLM5AhNn:dDzOcwxDRewtmJC0mLMmhNn
TLSH
T155C1C81940B0CD0BFB261032DAEF8D106279DF4A7C268F0317E5686E611B7D770B297A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 0f934a2e6535322dfe4f8e887f5e122480dd83f239f88c140468feb4b29ae4c3
MD5 e15bf62302c6198d2553e17d1cc599f4
SHA1 1d30159e6404a132bdf5af3aa9d0fe7f846c54ea
SHA512 16be488ef0c18f144702c837628077b036247d106574a7a6abdf0b0c13df3d276b71fe0033b23289ddbcf8326a405abb6c94ac267ff8f877f6e78e3d64215a91
SSDEEP 192:DRouRvBmrmp34oPaIaSaQIGI4krEymmmPmDmtmzm+l0eF1QV9/CI4LfIID329:DRouRvBmrmp34oPaIaSaQIGI4krEymmk
TLSH
T14812AFF7C3D8C52D895156F4AB25AF1FCE690A24431D3C2AC8D8AF4BA3E2871D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 075627c59cd4c9b1743367d1a985ce9bec096fc470fc712dede73472fa1af67d
MD5 db5dab62f516059bc96a652e0ec213e0
SHA1 d6fa82db056e7a8b183a0d2fd5ff7737c128333b
SHA512 017f393802a946cf6e53f2bd15520c177d27438f707f647a60440d1ca3f76b96a0807b55d05ef3ee984fd2b6f5e79bf63df7193128afab95c1e842dc00a926e2
SSDEEP 192:DRouRvBmrmp34orJNWU382aIaSaQIGI4krEymmmPmDmtmzm+l0eF1QV9/CI4LKIP:DRouRvBmrmp34orJNWU382aIaSaQIGIZ
TLSH
T1BE42AEF7C3E8C52D895156F4AB25AF1FCE690924431C3C2AC9D8AF4B93E2871D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 ae2c33b38eb5066a27c8e70cf52183025bbc2dcee3efb89779055f60fa139f33
MD5 321f2a5604da4eff90450def48e7c53d
SHA1 e757ad4928df0210e4b895ee840e0650e280e41c
SHA512 bf86ac5d10829df9a9145872881a4d72434eda8d13f5b4f397a93d6ace74e1a74014c958612083da2440ec5e81e3a15465af3894efa5883bf8697a49f927b294
SSDEEP 192:DuRouRvBmrmp3EaIaSeqFlzVQIGIuImmAdHmkmmmgmeEhzMU6Nrf:DuRouRvBmrmp3EaIaSeqFlzVQIGIuImp
TLSH
T1BE02BEF3C3E8C52D895156F4AB15AF1FCE690A24431D3C27C8E9AE4B93E2871E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 08907ee4489ee5812dfe68bf61f20c7a0df946131f451e867e212c1c841045c7
MD5 254d91bbe02dbd16cc539a98befaa17a
SHA1 c5b44df4cd34909aad64be845fea97f2f01c4afd
SHA512 02c93d343410cd5c6f3a9e59a443e5d75b639bfe5549051533d36d60bf70a3dfd5d024ba862d927be6ecd924f6b874dffe4c692068c98a80345ba687ae4cae13
SSDEEP 192:bRTmcBhvuBMoSYZv7dpuPRpMCVeuIV9ZHsb+WN9etJ+dG4/1vDx+X9eWdFaYAMnR:bRKmhvuBd5puXqHwjBFAeKanze
TLSH
T14A62B51EB9242D7B5CD6D22AF911BB57E3F5102265C42EC8AAFC8A1C14E7ECD221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cf1a6aca4ab6b478e8901202c564072a543863fae66f0f537a37b80a28048a59
MD5 0671e6d8389bf2587a1ed47a3cb39fff
SHA1 f287d0da13acb23ab9cf98064d941e5cbf3238fb
SHA512 3a4151017ffbea82eb9a97e75e8e6e030e7838c628991ef575205e461b7a8ef615e89aea804732e2d528941ea737883c12a8f97ba0292ca45024eb09ceaab03b
SSDEEP 192:bRTmcBzvuBMoSdZv7dpAPRp2e8j9ZHsb+WNn/140a2JdFaYAM1CFVyIsnAUgtaJ:bRKmzvuBM5pUX2HwNy2xaHz8
TLSH
T17A52B52EFA14693B5CCBC22AF961BB57D7F5102165842EC8EAFC891C14E7DCC611B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0b2eb88edb05ef84da2308d5e903027005f57e9c136999ebbec344808b307ec2
MD5 af30de82fe5050a12288cd3a9822f48b
SHA1 9e8a43a240d84f61b814e4a2d0074d94c7f748c4
SHA512 6d2e941e4ad9e798bef94cff8e01b44ff482a577b174712f0046cb818c2c6784bc58c4364bb00412528d7e3f12dab7e91ee8490d8b6e7204e4b6415ce11ec975
SSDEEP 192:NRTmcBzvuBMoSAZv7dpuPRpMCVFuOV9ZHsb+WN9etJ+dG4OV+kT+7YEWdFaYAMnR:NRKmzvuBZ5puX9HwjgVxEKanze
TLSH
T11062C75EA924297B5CD7C22AF921BB5BE3F1102165C42DC8EBFC8A1C14E7ECD221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 a56055212539b289320deb184ddeb6a3e631bd3d44a20142de736db5e75f9f28
MD5 ea7ebdcf75259c4083d225113586d92c
SHA1 0f5de7a14a7f7f84c4bd1c05b72a9d5da7b37290
SHA512 0781092d8b5031445596d12ef26f400920a24f3f34eb767c9d2e1c40de3af5d81c7e9ed4588b87d486e3b7f09c10a683c3a84bec57cfc987447bd26981bc3f2d
SSDEEP 192:NRTfcBz7uBGoSAZv7dpuPRpMCVbpuOV9ZHsb+WN9eg2dGu3k1OV+kT+7YEqdFaYz:NRrmz7uB35puX5HwKgKVxEmanze
TLSH
T1C762B55EA924297B5CD6C22AF961BB5BE3F1102165C42DC8AAFC8A1C14E7ECD321B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7d28480f5d1641496e5c444a2abb3094c7b4204579bcd03ad440e1737895e1d0
MD5 56aac4aa973d14179c3f1efa25f13d55
SHA1 5db66a000caf131934b8aa2199898034ef8bc36e
SHA512 d703b5b415bbac9f8323aab87b55505340a9c712d90f35fe55c3f26d6006a1976c02372fe729fbbfff4341ca713f480b88606083ab72a3b9706fef5ebd68143c
SSDEEP 192:bRTmcBhvuBMoSdZv7dpAPRp2CVKbw9ZHsb+WNcJj/140a2JdFaYAM1CFVyIsnAU/:bRKmhvuBM5pUXDHw2y2xaHz8
TLSH
T19552B52EB924693B5CC7C22AF961BB57E7F5102165C42E88EAFC8A1C14E7DCC611B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 9a11d613da91c4892b99c1232af94749144854ec9677cb42ebc7a3ffe14bbbfe
MD5 639a9a9ba043cda612ddacf2ea723847
SHA1 019008c10265bf8ed5a88ccd1a5188935b14a47c
SHA512 4a6b34b97f1806a64f1531ef8406131b0dc91ff7daeec6dfec20a3088b8e66fa260175bf545c33b295eab89527ad4249da37f54b5d5b4c2831e81786c1fba721
SSDEEP 192:NRTmcBz7uBMoSAZv7dpuPRpMCVbpuOV9ZHsb+WN9eg2dGu3k1OV+kT+7YEqdFaYz:NRKmz7uBZ5puX5HwKgKVxEmanze
TLSH
T11962B55EA924297B5CD6C22AF961BB5BE3F1102165C42DC8ABFC8A1C14E7ECD321B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 630539819a9ad140c5b3bddacd30f1552dca10bed51afbde27dbf3940de63904
MD5 e24b0930e0d7809de0bd4a575ab767cc
SHA1 44b1993925a9b40a67ccab6bc90b298c3a2670a7
SHA512 acd4b76ce9b2524f0f4f0b276fbd254e00e946eca7d9bdc9b459c91471f89102c738531dee095c1e9837c7014c057ba212aa1d636c95a8539c3cc0ee16764cc1
SSDEEP 192:NRTfcBz7uBMoSAZv7dpuPRpMCVbpuOV9ZHsb+WN9eg2dGu3k1OV+kT+7YEqdFaYz:NRrmz7uBZ5puX5HwKgKVxEmanze
TLSH
T17662B65EA924297B5CD6C22AF961BB5BE3F1102165C42DC8ABFC8A1C14E7ECD321B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
MD5 6c2a084e9725415d6e6f241570b51988
SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
TLSH
T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a73393094f803aa31748c93c6b63c56b35cf22c26ba0772e901cfb6d82777705
MD5 9b619711ce55a392c6a3dd4334c822a7
SHA1 5a91efe5c77bdf2d6f5e62fdd2e54dc1cf86c9d0
SHA512 dab46a28b785f6973482e7f363ac0679e7e1f4d69b041ddbf3fe9088584919fffb5852d9d3400e2d360b7d26b5c1572f625c959b0d6d7fd0016936802ecb468b
TLSH
T1E4B01212C4519952D04302B03182148C31149F108705170AB3E46B72DC265A34024290
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588edd.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588edd.TMP
Size 96B
SHA256 35fc10f088b0be14a2640a2939faca7f84a3aeaaa1956468747b0da5e44a61fc
MD5 9a5d16c90b9a1e7c561e416acc6af47d
SHA1 cf475e10919a1dd9b815eed91bbb56e655497847
SHA512 a25c8a2b502aa5428c9ec75f6a0856703e0901666eb2b8da66ebc3b42e815fd10aaeecb01527e502b302bd3184633799d8f6507cb695b14e379993ead57b3059
TLSH
T1ACB02200C002AA03C0C203B03082A0C838A0CF30CA03020382E02E23CC20EB020A0220
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 a3f81b1f33696657104abb0234632a565bcf2f1aaf01e6be5e3baeef8d933a01
MD5 2a7636a072ce3067eb047390ecbf9dcc
SHA1 fef1346474c33e76b6540fe9800609424b6034a4
SHA512 180f23c040a998fc0eafd80a42bbd70d5fb0e0b8cd6985a1badfa08d434ba101e5cb9cdf987fdc5d98cbff2cc3ffb894b2c1524aee74b0cf810103ab0f07a574
TLSH
T1B1C04CD3141085DB5E70AEE8202C7A2DD51F914C8CD4CDE8950851066578A26490267C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a851f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5a851f.TMP
Size 157B
SHA256 262ef5ad24d3aec7e6905f82bbde2491c2e7aef1bcd40d507c57e19e9efd800e
MD5 f19ee9fe92574998082c600a306b470e
SHA1 41fd62e53af58ce1a58e99c8c568b8d556b65919
SHA512 3480c1f76b679f990a97d532052da99e4de359415caf5d49cd7573530b9296ec46c8215a5ae0cee71a46a284c908ad1da798b27018eb4851ee5bcacf90569c63
TLSH
T183C04CD3151046C74F71A9E9602C7A5DD52F9D5C8CC4CDFC9509B1167578A27850167C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 605f33905acfc5fe1437aec4a2e8755c8ee327e5155f0c2736550b265d84947d
MD5 65f52814f2f505db191731db475ab89a
SHA1 369642de436bd1bfabf41567b4b7ffd57bce234f
SHA512 1167e2db4b09fdeece26373f960297c312ce1d086c443d2b040c57a6696568bdc1454d4fa0e2232bc3d092279042e898d46be5d9abded60044d83b951bb74c01
SSDEEP 3072:bWxD/hchoJKw0HjBvoPQb5mZHGFH++J3qUQm08KMWF0bFTcVHr6zb:bKbKol0HjBAc5emFH++JjcMW2VcVLk
TLSH
T1481412BEEA2DAE37514DC1FB61065EFDCCF69C490514A2EC31C19B4E158AB836347C94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 5689414f9afa58b8564db684aa3d41b850ea12b45269444a0a11fc4a4e1e84dc
MD5 71ea513d84507fd00944bd950fd57ca7
SHA1 a5ec7dbafb65dac23c4259b8837e9b056c25d060
SHA512 e649f771b0a266d3cee0d5411ae8b305f3fcd373bf16409554db74e1c43a0c7dde2ffc6ca29459af0c8b8c106e5a1393ad577f8cffc3f82b88275c1bf2711967
SSDEEP 3072:s3xD/hchoJKw0HjBvoPQb5mZHGFH++J3qUQm08KMWF0bFTcVHr6zb:sBbKol0HjBAc5emFH++JjcMW2VcVLk
TLSH
T1BD1412BEE92D6E26914DC5FB61066EBD8CF3ED4E0414A1DC30C06B4D548BB83674BC94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 271d50bf8ca366f08fc092237998d3823dd3c68a333120347d7d7968a7fdde1b
MD5 20bb251a946c7bbaa22c14fcbfe4a1e9
SHA1 1ee4c5e4c32cd474e355cec5435fb1097ced0a8b
SHA512 ffef4adf49631fe6bb7251af82eaae075fc487be8f4f0e93dee7fd4c32d7923cebc83c2420fa1392ad6dc08aa848a004f626960d4659e79bb689744c6255be19
SSDEEP 3072:x3xD/hchoJKw0HjBvoPQb5mZHGFH++J3qUQm08KMWF0bFTcVHr6zb:xBbKol0HjBAc5emFH++JjcMW2VcVLk
TLSH
T1F51412BEE92D6E26914DC5FB61066EBD8CF3ED4E0414A2DC30C06B4D648BB83674BC94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 4224ee315e854e241a02b8d9d8359612ffd1e6754a361f3c521024dd84f2fdab
MD5 39940523de054e8e71da560607f64d07
SHA1 873a3fd33903e0471fded6ddd0d8c5a25f6a7a7a
SHA512 2ca964e522d7ac6cb5d9888301738f44c437fe2017df2bb50ed2b66b0669ca73e050993749d3201cb8b82a9bea423e373e25163f68960cc34d92e33e1ff4a949
SSDEEP 1536:XGP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:s++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1D19302BDA91E7C79536BD696A0079CAC8CD3DCCD151451BC30C76B0E14BA3A3A31B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 87485ce417c1b9408b7371f41d6bc84d161ed9bde0e915902a66d5a57be5acc8
MD5 983a0d9bbb26e361f398b775a07b00c0
SHA1 c2efd794413d2dbb443ebc086d8da017b70db8f2
SHA512 59beac1269c56ed9f43b219c744b6bd0c6c7845f2560c134a15e2ec99b5240130dfe4e1c449202c4dbcffb704454970e607f3fff9dfff77988551915f9dca4b9
SSDEEP 3072:QWxD/hchoJKw0HjBvoPQb5mZHGFH++J3qUQm08KMWF0bFTcVHr6zb:QKbKol0HjBAc5emFH++JjcMW2VcVLk
TLSH
T1C31412BEEA2DAE37514DC1FB61065EEDCCF69C490514A2EC31C1AB4E158AB836347C98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 1ccfd949456a5285223ae1a01d7dffadcf28e2612e564898abde13b9c1feee6d
MD5 be310154e0eee3511f9c672e858820ba
SHA1 5784d10b861dcbc412e29bf564d19209e79ab429
SHA512 5e7d54025736c8f44cfaa3814fa26eebd56461770ff8e9d54883d052d5b7ccce5c35d8746671de7b07bc5f2011a697bea39c2360404c96075908a2dbc86a21f7
SSDEEP 3072:f3xD/hchoJKw0HjBvoPQb5mZHGFH++J3qUQm08KMWF0bFTcVHr6zb:fBbKol0HjBAc5emFH++JjcMW2VcVLk
TLSH
T1941412BEE92D6E26914DC5FB61066EBD8CF3ED4E0514A1DC30C06B4D648BB83674BC94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 2f2bb34200535da4d01f1975f937a28434930c1cc2dc53ce12c66bdc4be15568
MD5 353d8ad682522f7478e627a2acc3e562
SHA1 8fadb46c4a0e56ffca490562bf9bf5b265416b59
SHA512 802fb7a6bf30d3d3b2002f1c50884f8511b61db7aa6c691cabbdd3b90b1f1cc69ba38f3151f9a4b5ef40e5ae6e593f889352ec8cb7d46020063c50c9e6fe9ab9
SSDEEP 3072:/3xD/hchoJKw0HjBvoPQb5mZHGFH++J3qUQm08KMWF0bFTcVHr6zb:/BbKol0HjBAc5emFH++JjcMW2VcVLk
TLSH
T18C1412BEE92D6E26914DC5FF61066EBD8CF3ED4E0414A1DC30C46B4E648BB82674BC94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 9996ae9e60a00489fd1ce2cf8a78cc2084e79631777c76ef84e40250141a1a44
MD5 cabd1b6884a16b55ad53f849c04341a8
SHA1 d38457f315dd2899883048bb0a5f79fc93835a05
SHA512 8fc7468b40673038e9bd5ffe9905b7cf6f93c98ed68254ebcef7780aa24599e1cabeed8e96c0db2bfc2d297fd88f0e08a16cac606b58a94f43e4cd06560bea5a
SSDEEP 384:TJWJRVca12krtuJVpmXmlJVjeQ8RJoSHghYjUhUWK5PEm5k+GDa500VGYAV7cg3A:l+RVcWrml8RJdHg2jUhUn1k+GDa500Vr
TLSH
T1ECA25C743AF41719F3F69F759AF1A95A643AB8669C00DB4D0122028D0937D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-1125-0x00000236712F0000-0x000002367134D000-memory.dmp

Download

memory/2084-1187-0x0000000000400000-0x0000000003DF3000-memory.dmp

Download

memory/2084-1244-0x0000000000400000-0x0000000003DF3000-memory.dmp

Download

memory/2084-1173-0x0000000000400000-0x0000000003DF3000-memory.dmp

Download

memory/2084-1163-0x0000000004380000-0x00000000043FB000-memory.dmp

Download

memory/2084-1184-0x0000000000400000-0x0000000003DF3000-memory.dmp

Download

memory/2084-1236-0x0000000000400000-0x0000000003DF3000-memory.dmp

Download

memory/2084-1190-0x0000000000400000-0x0000000003DF3000-memory.dmp

Download

memory/2084-1162-0x0000000000400000-0x0000000003DF3000-memory.dmp

Download

memory/2084-1209-0x0000000000400000-0x0000000003DF3000-memory.dmp

Download

memory/2084-1213-0x0000000000400000-0x0000000003DF3000-memory.dmp

Download

memory/2084-1216-0x0000000000400000-0x0000000003DF3000-memory.dmp

Download

memory/2084-1219-0x0000000000400000-0x0000000003DF3000-memory.dmp

Download

memory/2084-1222-0x0000000000400000-0x0000000003DF3000-memory.dmp

Download

memory/2084-1233-0x0000000000400000-0x0000000003DF3000-memory.dmp

Download

memory/2984-13-0x000002189D160000-0x000002189D1BD000-memory.dmp

Download

memory/3320-929-0x000002B07A200000-0x000002B07A25D000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads