908c9fe8382f090bb06f9b5e4cf495591ec8846f8e1d967e417675828837ff92

Analysis

user interaction
yes
max time kernel
168s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
{01D0E4AF-FE59-4CE7-8C33-2DE68D032CAA}.dll
Size 4.5MB
Sample260423-ptv4escs8k
SHA256 908c9fe8382f090bb06f9b5e4cf495591ec8846f8e1d967e417675828837ff92
MD5 ec9dcbd087eb24bb4de56c34429a61a1
SHA1 1a158ab6807b16b9cbd1ada8073defbe8ce8696d
SHA512 284a95b8dc85a977aaee855c1d92709c2942d88ac2e850623de58ab8e3b1381a6add9b538908e07eff9ab09358d18e5b2891a5df6366ae381a76689b739e377a
SSDEEP 49152:TiKsqwzzfOCXWm+ts3KqpHba/kj1KV8+3eh/QcbmIOkoQII+c6jU0LQcsLTjzcOq:TuOwWYhM0pbrn+iZq
TLSH
T129267E1BBDB95869C099A13484737607F966B805172327C75AB0F2282F3B7E05FF9B18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 652 created 3124	652	rundll32.exe	53

Badlisted process makes network request 18 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1872	rundll32.exe
3	1872	rundll32.exe
4	1872	rundll32.exe
5	1872	rundll32.exe
6	1872	rundll32.exe
7	1872	rundll32.exe
8	1872	rundll32.exe
9	1872	rundll32.exe
10	1872	rundll32.exe
11	1872	rundll32.exe
12	1872	rundll32.exe
13	1872	rundll32.exe
14	1872	rundll32.exe
15	1872	rundll32.exe
16	1872	rundll32.exe
17	1872	rundll32.exe
18	1872	rundll32.exe
37	1872	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
652	rundll32.exe
1872	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
336	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214215595261030"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Applications\chrome.exe	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 50003100000000003e5c833310004c6f63616c003c0009000400efbe3e5c4b31975cdc642e0000003d570200000001000000000000000000000000000000b6b12a014c006f00630061006c00000014000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Applications\chrome.exe\shell\open	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202020202	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\0\0\0 = 60003100000000003e5c823310004150504c49437e310000480009000400efbe3e5c8233975ce8642e00000073aa02000000010000000000000000000000000000001e044d004100700070006c00690063006100740069006f006e00000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 820074001c004346534616003100000000003e5c4b31120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe3e5c4b31975cd4642e000000295702000000010000000000000000000000000000000a7aec004100700070004400610074006100000042000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\0\0 = 54003100000000003e5c823310004368726f6d6500003e0009000400efbe3e5c80333e5cd03b2e00000053a902000000010000000000000000000000000000008ade45004300680072006f006d006500000016000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType = "Documents"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	chrome.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
652	rundll32.exe
652	rundll32.exe
1872	rundll32.exe
1872	rundll32.exe
1872	rundll32.exe
1872	rundll32.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
3040	powershell.exe
3040	powershell.exe
3040	powershell.exe
1500	chrome.exe
1500	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5100	chrome.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
652	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	652	rundll32.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
2728	WindowsTerminal.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	Process
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5032	OpenWith.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
5100	chrome.exe
692	OpenWith.exe
692	OpenWith.exe
692	OpenWith.exe
692	OpenWith.exe
692	OpenWith.exe
692	OpenWith.exe
3052	OpenWith.exe
3052	OpenWith.exe
3052	OpenWith.exe
3052	OpenWith.exe
3052	OpenWith.exe
2728	WindowsTerminal.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 5016	652	rundll32.exe	81
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82
PID 652 wrote to memory of 1872	652	rundll32.exe	82

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3124
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\{01D0E4AF-FE59-4CE7-8C33-2DE68D032CAA}.dll,#1
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Windows\SysWOW64\dllhost.exe
    C:\Windows\SysWOW64\dllhost.exe
    3⤵
    PID:5016
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\SysWOW64\rundll32.exe
  2⤵
  - Badlisted process makes network request
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:2832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:1760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:1980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:2728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:1372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:2324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:3160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:4860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:2844
- - C:\Windows\SysWOW64\dllhost.exe
    "C:\Windows\SysWOW64\dllhost.exe" --no-startup-window --type=utility --utility-sub-type=unspecified
    3⤵
    PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb07e2c728,0x7ffb07e2c734,0x7ffb07e2c740
    3⤵
    PID:5028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,9980889447430372357,13262439983857119300,262144 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1880 /prefetch:2
    3⤵
    PID:1108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1372,i,4102378654318323431,10008178381465124262,524288 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2264 /prefetch:11
    3⤵
    - System Time Discovery
    PID:336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,11517157745813895861,16769780719154691078,524288 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2388 /prefetch:13
    3⤵
    PID:3092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,15996548119852786601,3035339506011380799,2097152 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:4984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,981339680493961895,2387782004876699781,2097152 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4200,i,8219741743488840098,16776829945594970966,2097152 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4212 /prefetch:9
    3⤵
    PID:4508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,2127225206430435807,15970686355869571572,2097152 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4532 /prefetch:1
    3⤵
    PID:608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,7118173010631636391,3365721989268605846,524288 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4804 /prefetch:14
    3⤵
    PID:2916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4960,i,10433845041022560816,7524939503947000401,524288 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,4773505963525156125,4458385884057796899,524288 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4776 /prefetch:14
    3⤵
    PID:2744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5796,i,598121507555357456,941486438825929443,2097152 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5872 /prefetch:1
    3⤵
    PID:1980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3368,i,9759075534077209590,9248629670598694369,2097152 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:2268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,8103014921590086727,874409894429949970,524288 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6000 /prefetch:14
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,6096603299970289522,1186632284880254328,524288 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3600 /prefetch:14
    3⤵
    PID:2288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3820,i,3535235847295879778,2442657065181192691,524288 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3372 /prefetch:14
    3⤵
    PID:4940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4500,i,12194486629240075110,1998618254131476040,524288 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:3852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5984,i,5145236444550483241,6522711830127391318,2097152 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6128 /prefetch:1
    3⤵
    PID:1880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3432,i,8299623039612255776,1433759785808160090,524288 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4984 /prefetch:14
    3⤵
    PID:2604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,774314682511782714,9501843620009520987,524288 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3660 /prefetch:14
    3⤵
    PID:1692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,13440645440468319974,2776412874066302070,524288 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:3820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3360,i,2746239364929033092,12979770321133758998,2097152 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6208 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4244,i,2246264434935764060,8393999255017437625,2097152 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:1136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5548,i,12851737995445333048,4242374180395040264,262144 --field-trial-handle=1884,i,6140331843477177336,134540022868254661,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6220 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1500
- C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\wt.exe"
  2⤵
  PID:3144
- - C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
    wt.exe
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2728
  - - C:\Windows\system32\wsl.exe
      C:\Windows\system32\wsl.exe --list
      4⤵
      PID:2200
  - - C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
      "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa28 --server 0xa24
      4⤵
      PID:1340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4140

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\Admin\Downloads\{01D0E4AF-FE59-4CE7-8C33-2DE68D032CAA}.dll"
  2⤵
  PID:1280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb07e2c728,0x7ffb07e2c734,0x7ffb07e2c740
    3⤵
    PID:428

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\Admin\Downloads\{01D0E4AF-FE59-4CE7-8C33-2DE68D032CAA}.dll"
  2⤵
  PID:2140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb07e2c728,0x7ffb07e2c734,0x7ffb07e2c740
    3⤵
    PID:2608

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:1660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4ab90ee72321a1f65d12083802908cee44fd663c4de721d6a550a31b067a0f84
MD5 7a0d2e89df843297b6e4dff991e54a8d
SHA1 90c6e246b01e331a2a44f53bfd0bd631cecfbf41
SHA512 04f12d956d1319731fab914a4b22b6b8ef606d918dd131834b6c45f614832000491ab61798c9917c0dde78eb1dbf51e4e115c76da8d1b557cfdb569962f3c711
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 68c174acdb6335461ce43b5f00498435cb0a649782788f03186fcf778d12eb10
MD5 0719d2d6562a2835ccff66ccc0815923
SHA1 4bd413e70b58165359f544d002214c29b6c1b776
SHA512 c5741354f0ec1f023023d8795e504c7e442d63c1bff0ee13faa5dacd437f218f0549bfc625c41d8847e36bdbffe407718620b1ad1279d37f2ece7c487ef8d969
TLSH
T103E02BDEDA21D83B08FD476864940B46F720135B2740898F3B3C920C8FB056B498685C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 88cfd514636842b7b36e1fb19c0b7250a30482b93789c2cabb2a19eb08d8ba18
MD5 785998148ded2dda9dd42d0123321036
SHA1 c1c82fee86c76e9f6787601cf3dccd0c015bdf14
SHA512 6dcae667f5f3d523a153957533cd46145d31d16d649fc43b9226dc1a5436cac982cdb6bf017e1d9fe1a6cb7bf056b904776029f5012e714a86c02ea1f805f50c
TLSH
T100518BF393E4867DC911A6E4AA246E2FCE6D0A18131C3C66C9D4AF1B43F2973D20135E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e0f846d96787c09aafc761c2303f33005fc81358a1ca2da9f010547863dcada7
MD5 f5513d889d49fd1d876196d71e796d4b
SHA1 13a1303b60dc6550ceebec2776f5944678d36a6a
SHA512 2eedcab132dcedcfe1024662e5758bba2cd575e653fde07eb38a576a67bcc1520bc223ec923836cd5489637e901332f7ad5c69a741da977b2fdc3238a661b0e7
SSDEEP 192:pR1msorWZ9QCt2v7ApAPRp2w9qHsb+WNncL0knS0qVkwQaGaVyIsnAUgtaJ:pR1HpFCsUXz4w00k3Ewaz8
TLSH
T13252D72EAE18653B5CCAC22AFD11B753E7F6102571842E88EBFCCA1C15D79CD251B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5cfe1ba937649e78cce2d729f850a8cdb8e9343766dc55d53d33e16d288f97bc
MD5 e394b2de9c72224c8ed0fc451825691b
SHA1 5b9c2934a908450e9ceac8387a33ae99cfb4e927
SHA512 5258c74762e0d8b5d22253f4b4f27456596a30655447a8581eb97338c729bf70fc958ad243dca63dcecc6662f269d774999f36e87f0e21090958f85d7bfbedab
SSDEEP 192:pR1msorWZ9QCtov7ApAPRp2w9qHsb+WNncL3/c2FnS0qVkwQaGa8yIsnAUgtaJ:pR1HpF0sUXz4w0k2F3EwaS8
TLSH
T1F852D72EAD18693B5CCAC22AFD11B753E7F6102561842E88EBFCCA1C15D79CD651B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 510b45ce2ac011077ce16fa39a19ab0416ad4c8bcb40c71f1bb4b7911462451c
MD5 592abe61ab24d79016d061cfbfaa4df9
SHA1 3c60da6a3b41af13f6f124c11ea88758a7567f77
SHA512 178fe13436860617e959aad1a7dc3ae473660650d47ae6fe64383021a64f50d08528ce24345ff3e6193d5e66673ac754187649beae9b8eabede5bf6bb6845646
SSDEEP 192:pRnm6orWZ9QCtov7ApXPRp7w9qHsb+WNNosz1cL3/c2K5US0qVkwQaG28yIsnAUp:pRn3pF0sRXs4wNfak2eSEwase
TLSH
T15852D62FAD14693B5CCAC219FD51BB53E7F6102561842E88EBFCCA1C15DB9CD261B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
MD5 e1d791f76039330e35fa0e1827d639ea
SHA1 a37e7b6749565fdef84e626eb8e8ab5cfd1eaf09
SHA512 4cd2d4ec371de591ed8fc49a3c9c69bf2d80c0d8879044f55af268ee4a35e216538e529304db502c0dc2822c3e20cfadd9949c623d30489800bbc0cdffa3ddcc
SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLuLcifklXODqt+ErU3sjHG9TDWxSal2:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pU
TLSH
T1B672E8676C0C9D7B0F94C58CD8267E4FADB9024B65ED886483FA582A03D5BDF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5e1585384fefb363e432e9f432bf5f5419dda841fe8dbbb35a4ccc9ccaf8a9f8
MD5 ee2a9f70ee02e88ecddc315a69ca3cf5
SHA1 da2c8785a8f4949b5bdd1e448d974897ee07285f
SHA512 31e51f131626ec6f2d91e8be9072a27fdba17d81fd53d2fbd4461778d5a30a1ff2dcfd59059356d17f6e236ce97b1595e9d0a2d55bc64906110b8ea64943fd29
TLSH
T110B0125180059561C00303F41EC2048C7654EF10C705230163E0EE7198262E18019250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eccc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58eccc.TMP
Size 96B
SHA256 4eacd571165acbdb9ffdc94be655ffba40fc7208bd72e81f474667e38b25bb78
MD5 585a21dc9841a5bec427fdc6421c5e06
SHA1 b7ff6c3c3034f2cef08ab326dee4d6d826c35424
SHA512 e13ab50c5145c4dbfa72498662dd30a4c31818f55789464672ee6fc0b0d54a85b1f445728603e2264552c2352ced674bca14eb9c06ef7a9ed0011e4ab6aaf602
TLSH
T128B02288C002E20AC00203F02888C0C830A2FF20CA0302028AE00B2ACC202A00828020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 c2ed9568fe6b50f6f4c26a78b2f8da1cc60c1632feceae992fe4dbf4fb7ec9f1
MD5 1c15a099e492d9ed661e3d9392a8ff4f
SHA1 e46f1b93f73eb1bec4bcb7633d1d1e6c1b14e70d
SHA512 5fb5c41dcf09e7a996aa6c5625f31b7d5211abe96096a236061320e72cf244d10d6ba92f707da3adab92d8fee13928e7d9e554357a025d3d45447ded72d5d2af
SSDEEP 3072:OpM9vH5N8z8zh5h5jo7jntyZqUH++J3qUQm08KMWF0bFTcVHr6z3:UshNDFBjovtyZfH++JjcMW2VcVLI
TLSH
T1B3141225DD2D7D7A03EFDBA6F007595C4DA398E8045892FD619BEB0B02A63D287079A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 422b384e61a854de2f704731c0c0da138f0feb13ff01dda3deca75e34e6deeb4
MD5 30f4d84c5aa2378778c1e936ccdf8da1
SHA1 332ce6c8e7a0dff8079a8563873ecf2fa7405aaf
SHA512 0a4f2b32317b8efe6e6232adf4b1ceeed29525473bdcbb90f87dad4f17717ad787d4d81da7d08e020da7cfb27e95bf77f30e059eadad51d5172ecb1bb790c27a
SSDEEP 3072:lfppM9vH5N8z8zh5h5jo7jntyZqUH++J3qUQm08KMWF0bFTcVHr6z3:F3shNDFBjovtyZfH++JjcMW2VcVLI
TLSH
T16B141235DD2D7D7A03FFDBA6E0075D5C4CA3D8DD085896AC619AEB0B02663D28B07DA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 bfbbf7245d4f7d5afe13d8e8e7d58a9aee09a1503d3a95071358e59ea8f4b4c9
MD5 e9befae702cad59c90eed01d4d5fe9cb
SHA1 3efafadf1dd2f76777e00e49b7c74ea9aa7c7e99
SHA512 2b0ff82b5e4669e143680545b3b313e0f96aadd18662a2f90af86031ab88d6d987ee2d80d2eb749263505719ac98288db3a58d62b42810b3117490440743d66b
SSDEEP 3072:/fppM9vH5N8z8zh5h5jo7jntyZqUH++J3qUQm08KMWF0bFTcVHr6z3:n3shNDFBjovtyZfH++JjcMW2VcVLI
TLSH
T1ED141235DD2D7D7A03FFDBA6E0075D5C4CA3D8DD085896AC619AEB0B02663D28B07DA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 cd6465167aa30059f8f471bf7c9e6fe8253605749c4799aba82ec63bf339ee8a
MD5 29913d4debc676ce5b4589848d4f3ead
SHA1 4cdef7e37c56b8b1658b7ac5191f840ccd9ad106
SHA512 310a5ac880eab8403e6c25b9c51d96789099943e3ad99dfeb179fa981ebd2db1e29cdf92c606355a05c3e94a29adef27ddd1c08957d6a3d4a2ec3c133616852d
SSDEEP 3072:KpM9vH5N8z8zh5h5jo7jntyZqUH++J3qUQm08KMWF0bFTcVHr6z3:YshNDFBjovtyZfH++JjcMW2VcVLI
TLSH
T1F8141225DD2D7D7A03EFDBA6F0075D5C4DA398E8045892FC619BEB0F02A63D287079A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 1b1a87e0bb98d4cba32cd314516f3eeb4afa5f57b894dad2d14032c640d7e455
MD5 186322671a2815ac438f611178c0a813
SHA1 9082361766d396416080d5712e2a3c7741164a78
SHA512 290e24762012be1c8d91b62d036d3904388861448aa020534ebcc955e21ebef0ad15dc54a67613d4cd378e48ccf1fdf70369b66f564a96ea9a27369566aa8fe0
SSDEEP 3072:2fppM9vH5N8z8zh5h5jo7jntyZqUH++J3qUQm08KMWF0bFTcVHr6z3:63shNDFBjovtyZfH++JjcMW2VcVLI
TLSH
T113141235DD2D7D7A03FFDBA6E0075D5C4CA3D8DD085896AC619AEB0B02663D28B07DA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 d6f91d1484eb23ef152abf3d7d824f2380a689573fd6122eb3be540dc11fee03
MD5 f8174cacec6255bddce03c3ec9c5ae4c
SHA1 7289c49f65f8b0a14b51a2dc0cce35eb6015c117
SHA512 34181fa0337350de7944203dfa10591f2ae43710c1d792c5ba1e82273e5198862fdfba1b243d7cc78f9e1440dceb22a9cf0b867d384c2d9c1347dcecce2a9c05
SSDEEP 1536:hZ8P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:6++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T1E99302BA591E7D39536AC296D0079CAC8CD3DCCE1514557C30C7AB1E18BA393A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 fc5f83a0678d9c1fc727a5a0a644af3db3cff0181fcaa534381fe1911874a6bb
MD5 cc40056172f672e82d2d4f5e55d51c4c
SHA1 1c763da0efdfab96c46189bf8001af74504a4573
SHA512 91e857e8db92b685b771a9f9a17b655797c09437bce9d0e225a84c33657b354fa310dc550c3cafd7713b08b3e912c691de2008f4587c90cdf0a65d44d7778daf
SSDEEP 3072:ZpM9vH5N8z8zh5h5jo7jntyZqUH++J3qUQm08KMWF0bFTcVHr6z3:nshNDFBjovtyZfH++JjcMW2VcVLI
TLSH
T128141225DD2D7D7A03EFDBA6F0075D5C4DA398E8045892FD619BEB0F02A63D287079A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bsuekn1d.ykw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bsuekn1d.ykw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

{01D0E4AF-FE59-4CE7-8C33-2DE68D032CAA}.dll

Path C:\Users\Admin\Downloads\{01D0E4AF-FE59-4CE7-8C33-2DE68D032CAA}.dll
Size 4.5MB
SHA256 908c9fe8382f090bb06f9b5e4cf495591ec8846f8e1d967e417675828837ff92
MD5 ec9dcbd087eb24bb4de56c34429a61a1
SHA1 1a158ab6807b16b9cbd1ada8073defbe8ce8696d
SHA512 284a95b8dc85a977aaee855c1d92709c2942d88ac2e850623de58ab8e3b1381a6add9b538908e07eff9ab09358d18e5b2891a5df6366ae381a76689b739e377a
SSDEEP 49152:TiKsqwzzfOCXWm+ts3KqpHba/kj1KV8+3eh/QcbmIOkoQII+c6jU0LQcsLTjzcOq:TuOwWYhM0pbrn+iZq
TLSH
T129267E1BBDB95869C099A13484737607F966B805172327C75AB0F2282F3B7E05FF9B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/652-22-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-54-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-21-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-19-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-18-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-17-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-16-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-15-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-13-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-12-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-11-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-10-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-5-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-40-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-39-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-38-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-37-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-36-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-35-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-34-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-41-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-53-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-52-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-51-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-50-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-49-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-44-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-48-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-47-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-46-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-45-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-43-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-42-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-0-0x000002197D350000-0x000002197D351000-memory.dmp

Download

memory/652-60-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-59-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-58-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-57-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-56-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-55-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-61-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-62-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-63-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-23-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-24-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-25-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-20-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-26-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-27-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-28-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-29-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-31-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-32-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-33-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-30-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-14-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-9-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-6-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-8-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-7-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-4-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-2-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/652-1-0x000002197B860000-0x000002197BA0C000-memory.dmp

Download

memory/652-3-0x000002197E680000-0x000002197E681000-memory.dmp

Download

memory/3040-2497-0x000002C351290000-0x000002C3512D6000-memory.dmp

Download

memory/3040-2495-0x000002C351130000-0x000002C351152000-memory.dmp

Download

memory/3040-2506-0x000002C3517F0000-0x000002C351866000-memory.dmp

Download

memory/3040-2507-0x000002C3512E0000-0x000002C3512FE000-memory.dmp

Download