hxxps://upfilesgo[.]com/Cy5WII

Analysis

user interaction
yes
max time kernel
900s
max time network
895s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/04/2026, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://upfilesgo.com/Cy5WII
Sample260428-hadxgaes21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1528	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134218315330333411"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714754311-527593155-1440850301-1000\{99B86946-BD77-41DB-B93F-77F1D1477F38}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2256	vlc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
692	chrome.exe
692	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2256	vlc.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe
Token: SeShutdownPrivilege	4100	chrome.exe
Token: SeCreatePagefilePrivilege	4100	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
2256	vlc.exe
2256	vlc.exe
2256	vlc.exe
2256	vlc.exe
2256	vlc.exe
2256	vlc.exe
2256	vlc.exe
2256	vlc.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
2256	vlc.exe
2256	vlc.exe
2256	vlc.exe
2256	vlc.exe
2256	vlc.exe
2256	vlc.exe
2256	vlc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2256	vlc.exe
2256	vlc.exe
2256	vlc.exe
2256	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 820	4100	chrome.exe	83
PID 4100 wrote to memory of 3884	4100	chrome.exe	84
PID 4100 wrote to memory of 1528	4100	chrome.exe	85
PID 4100 wrote to memory of 3884	4100	chrome.exe	84
PID 4100 wrote to memory of 3744	4100	chrome.exe	86
PID 4100 wrote to memory of 3744	4100	chrome.exe	86
PID 4100 wrote to memory of 764	4100	chrome.exe	88
PID 4100 wrote to memory of 2084	4100	chrome.exe	89
PID 4100 wrote to memory of 764	4100	chrome.exe	88
PID 4100 wrote to memory of 2084	4100	chrome.exe	89
PID 4100 wrote to memory of 1584	4100	chrome.exe	90
PID 4100 wrote to memory of 1584	4100	chrome.exe	90
PID 4100 wrote to memory of 4692	4100	chrome.exe	91
PID 4100 wrote to memory of 4692	4100	chrome.exe	91
PID 4100 wrote to memory of 4500	4100	chrome.exe	92
PID 4100 wrote to memory of 4500	4100	chrome.exe	92
PID 4100 wrote to memory of 3684	4100	chrome.exe	93
PID 4100 wrote to memory of 3684	4100	chrome.exe	93
PID 4100 wrote to memory of 4124	4100	chrome.exe	94
PID 4100 wrote to memory of 4124	4100	chrome.exe	94
PID 4100 wrote to memory of 3068	4100	chrome.exe	95
PID 4100 wrote to memory of 3068	4100	chrome.exe	95
PID 4100 wrote to memory of 1708	4100	chrome.exe	97
PID 4100 wrote to memory of 1708	4100	chrome.exe	97
PID 4100 wrote to memory of 1504	4100	chrome.exe	98
PID 4100 wrote to memory of 4240	4100	chrome.exe	99
PID 4100 wrote to memory of 4240	4100	chrome.exe	99
PID 4100 wrote to memory of 3656	4100	chrome.exe	105
PID 4100 wrote to memory of 3656	4100	chrome.exe	105
PID 4100 wrote to memory of 2968	4100	chrome.exe	106
PID 4100 wrote to memory of 2968	4100	chrome.exe	106
PID 4100 wrote to memory of 4692	4100	chrome.exe	107
PID 4100 wrote to memory of 4692	4100	chrome.exe	107
PID 4100 wrote to memory of 4104	4100	chrome.exe	111
PID 4100 wrote to memory of 4104	4100	chrome.exe	111
PID 4100 wrote to memory of 4572	4100	chrome.exe	112
PID 4100 wrote to memory of 4572	4100	chrome.exe	112
PID 4100 wrote to memory of 216	4100	chrome.exe	113
PID 4100 wrote to memory of 216	4100	chrome.exe	113
PID 4100 wrote to memory of 4900	4100	chrome.exe	114
PID 4100 wrote to memory of 4900	4100	chrome.exe	114
PID 4100 wrote to memory of 3968	4100	chrome.exe	115
PID 4100 wrote to memory of 3968	4100	chrome.exe	115
PID 4100 wrote to memory of 2772	4100	chrome.exe	116
PID 4100 wrote to memory of 2772	4100	chrome.exe	116
PID 4100 wrote to memory of 2416	4100	chrome.exe	117
PID 4100 wrote to memory of 2416	4100	chrome.exe	117
PID 4100 wrote to memory of 2684	4100	chrome.exe	118
PID 4100 wrote to memory of 2684	4100	chrome.exe	118
PID 4100 wrote to memory of 2124	4100	chrome.exe	120
PID 4100 wrote to memory of 2124	4100	chrome.exe	120
PID 4100 wrote to memory of 2204	4100	chrome.exe	121
PID 4100 wrote to memory of 4692	4100	chrome.exe	122
PID 4100 wrote to memory of 3412	4100	chrome.exe	123
PID 4100 wrote to memory of 1368	4100	chrome.exe	125
PID 4100 wrote to memory of 1368	4100	chrome.exe	125
PID 4100 wrote to memory of 3316	4100	chrome.exe	126
PID 4100 wrote to memory of 2080	4100	chrome.exe	127
PID 4100 wrote to memory of 2080	4100	chrome.exe	127
PID 4100 wrote to memory of 1604	4100	chrome.exe	128
PID 4100 wrote to memory of 1604	4100	chrome.exe	128
PID 4100 wrote to memory of 1712	4100	chrome.exe	129
PID 4100 wrote to memory of 1712	4100	chrome.exe	129
PID 4100 wrote to memory of 608	4100	chrome.exe	130

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://upfilesgo.com/Cy5WII
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff96d04c728,0x7ff96d04c734,0x7ff96d04c740
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,13997650452293199346,11050284111055542074,262144 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,568867923266267227,4542127681582557943,524288 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1908 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,13219754457841733884,10981846160387279670,524288 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,5832712823281742193,4534244386397986549,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,3470519192333091315,850012205447599717,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,11403196695465666140,18001189117050369955,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4428 /prefetch:2
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5160,i,12991257613562776330,146763547332985358,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4992,i,15537349755136147514,17892721581731692035,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5528,i,9345730432522562758,3768489733339192478,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5712,i,10420632017815050628,2714291938378292284,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5852,i,1332690021627237996,685040171157791075,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6032,i,1353043331175196144,6316564500086990979,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6408,i,12888549410577003395,11453451414067379147,524288 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6476,i,7600940630876748302,2752664126836530067,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6164,i,7312760950219577026,1169526192360842252,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6136,i,9238304447959724756,7598034998667464174,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6148,i,10633899840332813295,14623898996753391322,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5644,i,14480718724354629979,2167224786781427746,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6076,i,5685001290338905614,8204620687705473637,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5248,i,5691969242548843519,11819894774813652867,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6152,i,15662901594773284552,13813439835575864031,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4816,i,2385803030618515,7278005788463000345,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6716,i,18425895957489588862,18416232503046323006,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6584,i,17066211933336486848,5718267512920272406,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6796,i,5105023652171502110,3525360154078476897,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6068,i,6261746259449242956,12540461450759182853,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6696,i,10856220291020062432,11943291518394385455,524288 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6612,i,13404894087765707594,12422593637833496758,524288 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4816,i,15126522384150393600,18083265696565362878,524288 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=4488,i,1777812924271019357,2989141318434420882,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4492,i,13019487868980471315,9928516479570535702,524288 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4396,i,7314793564379945957,1331932059430996698,524288 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5232,i,5703288894260014153,13020310771047581537,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=208 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6840,i,214090228422325230,11913463110189434065,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6868,i,6950216911775060519,8192449968547237639,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6472,i,17764349391414129253,4236700338393795433,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=5888,i,8909312554170197458,17220201347013815724,2097152 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,13659721035052398732,17566091698762021868,524288 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\Swimming+pool+in👙.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6980,i,118522230371090768,13701406116817111977,262144 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7020,i,6135358252579391730,5284933297343265406,524288 --field-trial-handle=2028,i,4319901992024098291,3879307602173130214,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:1708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f1763dc27cd83219de4095a3a4bd52c544946eae2b19fbf4f9a90de971dd31a9
MD5 91b46b36ed26dcc07c4f970133c21441
SHA1 4f356ba576ecb0ceec9a0bc1be815e91435996b1
SHA512 6f78c3a68d23e972516f731a8f480ca29981cc67ff565d67b49a26de0d82524506dbb3bb3b42fdcfe64ec509fb1317f667a93616580c44563abd88eeefd0cbe4
TLSH
T1C4E02BAEC925DC370CF90B5C71540B45E74023572782894F3B3ED50D8FB1B7A458682C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 44KB
SHA256 9a359ae696e3a9f1f25b703e1d25f1e9fd4e20a86caeed7efd39328fbb60dbd9
MD5 287c47156c7e685229c536b21b47d278
SHA1 7490249f6b82bf6a512f9f004104b939c0546caf
SHA512 a323f46b62edbe8b515073f638cb19a74adc9d24e1e97be7ba72786c9573a1e3f5cb41f7d4f9157f25495cbab0b5333d91238c85fd00d249882ae59275c38f91
SSDEEP 768:6PvS4mXav1mfhrcxdQZPmz8qYyyhKk/m/yhQWtmgxaqp1H2b0P:KVhtmtAAi8yybmahLAYaep2b0P
TLSH
T19023F19317760A08DF41C271E6DAA8ECF85BE608C8FD3B14F53B027DA945750DEDA9A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 22KB
SHA256 e024f7d0d6634fa817a9a0f5ce46eda510775e218b08e2dcbf93c7eb6af6c61d
MD5 6b80402974e3bbe83cbea0f225d95e17
SHA1 ab25e56e44f4be07920f0e9e7354c182c208b3ab
SHA512 d9e2c2d36757e0ba1890909e259898ad3b50c4b4e3c765ae3fd7c84f1c276aa8ca056025d14736ef74922e47cc1ea016552dbef86cf88d81ccc8feaafdb81dd6
SSDEEP 384:CGDUSIrszJ4BfBhz/h0Qo2Zn53QfyVHUhkagcWm9b+AIq0U3rb6Td9GBR:pqqJ6fKuhQKV0hkflmNWUiUR
TLSH
T1E7A2D036DCE2A4CD48BB50C5C261DEFD6652A8BDE9D07351A345CB8C84076FDE3A889C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c2168cc535ddaefe989e7bc4928f22102be79490b56c76bad1fc619d37336bb1
MD5 3b81f2303fe6ea6ef78f20ef7127c9cb
SHA1 2a6d52cf8c4381fb873fa6bb65e4e6e3a7d582e7
SHA512 ad10db1d46ba2d6ec2582f2b44ee4888a460387f864819fe28dce5de0f48b5d22f5d6bf52392c7de042b072249a78dbd54432c15099e66eed0f0af481b4c496f
TLSH
T1A721AD5652E37197FB2E0D7124840E957DB1CCE0A88FEF0F6F845CB2D862BEC8482154
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.vpntoggle.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 a7689786c7da7fc6364fc71ff5dcad573563fa8c9d19572fd43874486720e18d
MD5 e77d95dcaf87069332945390dc664afc
SHA1 7c4ba627cb6b42791d7f4fc87f684b273ac032fb
SHA512 05fb171348074db6a5720167d5639369eda9ffffb1900e511b706047fd7e900bbfc8959bb0334298ae18e31db5bacde937f41cc35002255a5d3c1664f8cbb018
SSDEEP 384:D4NVFHeexepS7CT8WoEDpcQeeecv6KwL+j1HgZBaIaEgdRRrZxTlNtRQ/b7Vjwzj:TNcrupH
TLSH
T1CC928EF783F58A6D98119AF09714ED1ADF5C0528432C3E6A89E4BE47A7D30B2E20574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 23KB
SHA256 3a7388717816dc644fbd8e254d3323ccd38a463e06c5194c87b02f65b17219d4
MD5 535751f8d09d27bfa55f5659b4409cac
SHA1 1df0bd61c520e49a5b1f2359decf42da6e93b3bc
SHA512 45a2713b297e76618070c06665c076f38ceaf7584e704018870b37d04939cbe2b422a7e3354fd2aedac5c8985852947a59702ca80ee27a6f894caca4ad905458
SSDEEP 384:DuIQJye21KdyFI4MzZLmERle1BAbTUqoyrJodaIaEgdRRrZx4jNtRQ/bYiWBHXnt:NPeHvOILe
TLSH
T1C6B29FF7C3E48A2D881156F5A714BD1ADF5D0928431C3D6A88E8FF4BA7D24B2E20165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 19d3fb78b9d02b4aaccba3d126933e93dc9512f87a840abc91cb5dfd2b523021
MD5 475c554403fa13415f166156d9ceb4a5
SHA1 ab71c24a9178df115fb4f9d59bb833a5a4a4d054
SHA512 e914d852b1df7ad1034240afeab63bc0f342fab1712816aa2f2fae98d0e95b21ec7b084f8a10d2d8bcff509991bd04b9702b5f8aa089d1aa091070ee23522545
TLSH
T1C171A093E2BEB86B10BC89BF2D0D780D6979A8304391E0F5CE67612D74D54F36B12436
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7a7eec3f3f5dd5d84d7abec75deb83f39f0a9410275fc55fafb3098fdb120f1e
MD5 f411ca35b5fb7bea0ff045777ae3ac9c
SHA1 b13110a72f981a3d1d93c7aced3e2aa023527d0e
SHA512 cd4ed10855b45214b6a83a555e5b4ccfe3d8f209fd19cccf4fb32f06aa135c583a39d4dddb1aba215c9fca3e330d5e61545d00e12bc353ae65bde9a880e6c612
SSDEEP 192:cRAdxTdy4+jv7rpAPRp205AJ98Hsb+WNnl/r972OGkz8eO2aSYfamVyIsnAUge:cRAdZcbHUXk6wRh2OPz82tKa+e
TLSH
T17C42D82EA92439775CD6C329F965775BDBF2002220D46E84EBFC8A3C10D7ACD622745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 da96c5c4573a9f7e1588a87f9ba7869fd0269186cf7c319f12c82d84e4d95b6e
MD5 9ee4a33f0d2b0c0a044f1162b2671832
SHA1 e6aef3055f9285afdced228aa3940359888224b2
SHA512 dc25483de1603f4211c98a97005db277fe19abe1ff3a3a9c755f2273da51530ae416db8d3ed71c12540b11bc9fe5b54927d5ef8b82b207e1ebdea5a3bcf522cf
SSDEEP 192:cRAdxTdy4Xwv7rpAPRp202NfBw98Hsb+WNfeUWl/r972ckz8eO2aSYfalVyIsnAI:cRAdZFsHUXN6woh21z82tKaTE
TLSH
T1EC52E72FA92429774CE6C329F965775BD7F2102660D06E80EBFC9A3C10D7ACD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 006cd2959f528a6f118dee47437857abcb42fe3f967559b35bdf1e69858c6327
MD5 9ca041c32c59f27ca1cd033533fa76ce
SHA1 eaebc09d3eafbf773cead39b3f9e4d3792d0dd00
SHA512 eda9a75d97f5145fc7a94853d32e66b1d0431aae8584038ad9dd102cb693b585ee06b3ffc80ad4c36a2fc00ff966a280c8a809d4c73b6eb699b0f56b22d78711
SSDEEP 192:cRAdxTdy4Xwv7MpAPRp20+NqJN98Hsb+WNfdlCl/r972ckz8eO2aSYfalVyIsnAI:cRAdZFs4UXV6wQh21z82tKaTE
TLSH
T1F352D72FA92429774CE6C329F965775BE7F2102660D06E80EBFC9A3C10D7ACD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 65bd87fafdd233b0a840e82717f5894b8a1df940fa29286ae0fd11a173167a92
MD5 242a2a60e98aeebb8cd1f9e53e3f3b67
SHA1 7f3d0f584d2940607046d46258a9e0733354637b
SHA512 ab2aa675ce064ecce593cd825b176955e032d5f5cefe1745c3368997acca555a19ee7fd92bc0998039fa3521f5386e8aeb5576363e360a5921948fd8ed2ab810
SSDEEP 192:cRAdqTdy4Xwv7MpcPRpO0+NqJN98Hsb+WNfdlCl/r9722kz8eO2aSYfazVyIsnAI:cRAdAFs48Xt6wQh2/z82tKaVE
TLSH
T15162F72FA82429774CE6C329F965775BE7F2102621E06E84EBFC9A3C10D7ACD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7de80d96173b514aef5656b138f6c4374e6649d455790201012d34a8b81b0e06
MD5 756db8b9ed856d5d925cbef090161d78
SHA1 eeb3e62e00c438c403710d41f0aa85ce92da3aae
SHA512 a4d7ab98d2b79e78080b70bd8ae10fd0547a0dae5dfd081ef3bd2bc5708eb476568576d49bdbec5167b3015c21938430e97bd27dbddae3128a95f85dab65804e
SSDEEP 192:cRAdxTdy4+wv7rpAPRp20IN6G98Hsb+WNfqFl/r972OGkz8eO2aSYfamVyIsnAUp:cRAdZcsHUX+6wUh2OPz82tKa+e
TLSH
T10752D72EA924297B4CD7C329F965775BDBF2002260D06E84EBFC9A3C10D7ACD221745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
MD5 e96921d5ae30116aafe48367f7ac6695
SHA1 c6641ccac61c68d82ff32eff425c15feb5074091
SHA512 7547cbfa0fc206b66f70451b792b574afeb0e98365fa6e0b5000e8553976425c99b5d9d4c5ead0b18d87bd8ab8100bb185fc97363145cbc0d2cc4cf9b3e8d865
SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLuLcifqrXODID+ErU36SHG6+AwTlTNv:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pb
TLSH
T1A1720B777C4C9E7B0F94C6C8D8167E4FADB6024A65DD886482FB982A03D4BCF114A1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b6e4f15f6cb0f99e84fd4daa582d4632e17740cd674e7936e6e2c0cfc146072e
MD5 8bd27670c985473786fed946250c1eba
SHA1 9ef58ea44a9d7160e52b5ec0d7629e1962b34590
SHA512 f45d9c81494089016a39111e828a8d986714434a7680db9d32a8c0ff7725c188567c47a0ae266ccc8ba85094630b06910869232eec68df8b2d120bf3dc3be890
TLSH
T166B01210C802D501C04703B416E2148C3614AF149B09130273E0AA75D8261E64024151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589e9c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589e9c.TMP
Size 96B
SHA256 2e19b1be00bdd271a155e1c4cdfd9f8c582e9aee75c1e1b1c8a1068f9b46f0c1
MD5 45c1e04606897ad05d2ce5a9b2618e70
SHA1 961e8c90bc75324aaaad820eb5e5d06a2a3ab556
SHA512 bb563fcc7e28920d8d40ec02fb984c8dc9ade3f09eb89307fd5d45de6a9531f4f3591a95558984947a25878f4674f24c29336cd5211d270293052ab5b370c13c
TLSH
T168B02280C203222AC00203B0208088C8B020EF28CAC32302C3F00A2BCC202B20220020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 c2965a614b85378afe5e360086e63e94436ce628a092464f11cd49311e557c23
MD5 d9bec905f81cf0f86fe5d2eecf8234d7
SHA1 f5e1c45a6ef92961abbcbf96607d35116efb8d8d
SHA512 2c157835454139065bfeeea61d0f4d6bc440d5addf368bd96af6932ff51b1f8ea137b16d20e65dae7392337b75f522431bc68a74739deaa78675ec4c31f9abad
TLSH
T1C6A0025032550505CD00437025869151FB21BC59B51B420270E0594B8DA55C6511F0C0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 d71d03624991aba97f7c292526ec6d943cb476b3509f24d388e48cd5ea6c1395
MD5 0cec1698297956109326b212a369e903
SHA1 7fc5936b104d7245562f4097e08bbc58a9a852a0
SHA512 899b4da0e871965df0c3c5e1ed570195e4c1b33985b89dc44c3f9f8e105f416ea947fa6c0658a9b774220f42a276cbc9b42f52f7f69b4068c33df35c9e5cd555
SSDEEP 1536:EkTncYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE:dD3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T17D9302BA8D2A59F795BE5692729E3809CE12130E716FA8CC756C538C21D41C82B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 ece8e9e3e6fcbded286feb5a4a65c74118c163a42745e237b0ed4caceb773424
MD5 3b67aa15a09403c8ad6750fd3fea4714
SHA1 29335461f4aad0a093d7ca27ceaa97dcbe5dcb95
SHA512 788378b2217a0aaf6d9f89332c03983a5da259b0a0e903f71a48b67a68584fac68a09134d94262a7c9067d7177c29e87ff32ce38d476abb6df4471d19b904e8e
SSDEEP 1536:AkTncYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE:ZD3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1049302BA4D2A59E795BE5692729E380DCE12130E716FA8CC715C538C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 72046a2b5760729027fdb68c6eacc1206926b687a7eb1f7b4c420d01b3b701b5
MD5 5b23c7fe3f4715e40c66f14273feffef
SHA1 57caad276a65e2cd69133a555bc5e7d963b67966
SHA512 5c059688544628773e29e6ebd5a24b06ded1dbf58847c405b6511628e481c44083589db46c22c90135edc8bc32bfd17ff703c89ada97500c462fcd850f2ac45e
SSDEEP 1536:g+cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:v3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1499312BA4E2A46E7957E469176AE7809CE13130D70AFA8CC31AC539C61D01C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 efbd6501c7ed25c7bb9fafe64bdc5262fb579e2bfd4a2122dcbb8ee636eb4fd1
MD5 11d42f4499d51cdaf606b35396bccb74
SHA1 2cd5e18246af223dca5f0397ef9c56b38467c6e3
SHA512 81dd7220d939971c5bcc68615a1bae5540b90695ecf1438f2ca9b339c471cf0a066d2ac67203220bb827a9975ee35830cd33092d11cc7fe05ca33af746a63b5c
SSDEEP 1536:XOOTcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE:Z3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1D99312BB5E2A59E795BE4691725E3409CD22130E31AFE9CC72A8539C21D01C92B73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 a07710d687d3aac257e14bcb52ff26c81ccf0cf0775edb7cb8079276825b98dd
MD5 57115ed59e282641ad59ba211229c851
SHA1 cf538ace413828c2f217d89811ab8e9c9dcfcfbe
SHA512 38bff229e8e72b8b3acb09ed06be12a9f8a447c511ed0e583df1d4999f0a710f5a178cf7c879e114277b33b8a30e73ec012208c8524d97e3011c747eff143378
SSDEEP 1536:XWOTcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE:h3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1F19312BB5E2A59E795BE4691725E3409CD22130E31AFE9CC72A8538C21C01C92B73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 5de8577093e0f1e71ca771f5373d88b2d5b43d905753cd0eea5190b335cc13a4
MD5 c69cf56f459da9aeb1d573fd19ad8cbe
SHA1 08d9dac71f0bf7372cfa0a5f91bbe985459e4ca6
SHA512 b2559928617e054b31886d62751ee0635d9335bb221e3f2381d30cbcbb5e58693df0ed8664bbf8ae1dc04a63ce0d002995bfaaef8bc1a3bfb58905ece2a861a1
SSDEEP 1536:AqOTcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE:W3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1449312BB5E2A59E795BE46D1725E3409CD12130E31AFE9CC72A8538C21D11C92B73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 7f1f507cfa639cdd12bec26fc7710297a6ec0627298e25c058fc4e410f65b0ad
MD5 2a81ad741b53f4ce1ee6c5de42034813
SHA1 8a35440af14d9ac069db11e99345d5569874a7af
SHA512 acbd4b54ded0f9608175d3533d91cbc47c77e308df2d1422508c72a964b53884b50b9ed709828a7262845d895e2d3bca56806a6f6dba303889de08e8fd7a49e6
SSDEEP 1536:AUOTcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE:g3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1799302BB5E2A59E795BE4691725E3409CD12130E31AFE9CC72A8538C21D11C92B73E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 9KB
SHA256 1d5d2def00c15067b2a4d0ec6f0e61aa591fe8d2d677022467e86f28683ab5cc
MD5 c34c47c560af883c405f9b479f42cf8c
SHA1 49ec400bf51855c0e9135b0e20c1e508dad328b2
SHA512 eedc48c33d605d925e9553347bfbe76ce2ad201b89b604b9d891a970d4d8689f8b24252952cea60722d73d03722d5970af8e966697436c088128e55a461168ae
SSDEEP 96:76HVZTHXO6J0ODLZ6J/6HVzUXe2IzFSZtU6HVZF2+Kc4h6HVja6HVgBQ:7mZCOQ9mcIRSZtUmZuc4hmOmT
TLSH
T1CD1203046BFB2D5EF1F3DA32EAF27B904F39F8029514791A52E1430A09B1E409D6973B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 d70b175a4a73c59eff7c5c5aa0e25dea824722b44730e69ae6f0b866d0ba04dd
MD5 2e28b7ed7dc026d9b8b33825ad931859
SHA1 6b3f3b36a7e0b790887e5212afdad8fdafdbc72c
SHA512 7ed36c64f562151e9f493c65672a69059a19cfe483fb019411b2d2578384686338d9012cd6096e50f1b82b83995e41cae1da849a4040be0a65a93bb260ba7c70
SSDEEP 192:5acIRSZtumZuc44my4LUnOawtIyL6BmsmT:5acIQtumdNmyGUtgAmsmT
TLSH
T13922030427FB295EF0F3DA32AEF57BA08F7AF8119118791B52D143074A61A409D6973B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 9KB
SHA256 164964280bda5d8ba7ba601f6242899a43d2a06eae06b55422395e7c5e659747
MD5 0be764ed872a7e88637b4d90da0e78cc
SHA1 eac637ad57c39d9ef09e78cd199b2e9f0c5236e7
SHA512 69294c806db25f8a98812038d6d187210e09fa3e1b5c653c5804abdc3c69aa26e34f143460cd65156d4d64cebd8772eb7f5e652787e07676eb0eb63ee0157a2a
SSDEEP 96:76HVZTHXO64lODoZ6JP6HVZTHXO6J0ODLZ6JP6HVzUXe2IzFSZtD6HVjS6HVgBQ:7mZCOblmZCOQlmcIRSZtDm2mT
TLSH
T10C12024427FB2D5EF1F3DA32EAF27F905F3AF8029514B90A52E1430A05A1E409D6973B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Swimming+pool+in👙.mp4

Path C:\Users\Admin\Downloads\Swimming+pool+in👙.mp4
Size 8.2MB
SHA256 053397f4e8527ea4ffd4fb20eae11ef951f9ef43097d0887972a187b9b2c5639
MD5 25705e7a08e947ce1d3feb8af0096391
SHA1 4547704ded65785994e77f65e1370ffb08fb1fa0
SHA512 009697d5b4b74f60d3080c55b1005e028bfae9ec332856b0631fa4585f2be1aedfe2cdbe729865dbab0ce438bb73563cc9db479462f563f825fbe0c6c45a9f6e
SSDEEP 196608:LD9dIy+pfD8IUwdF7zo/XXUVPCBEO4ATOak7XB4YL:LnwdIwdZs/0VPCBE0paXuA
TLSH
T1F08633CE17C5915FE90F54F1C8E8037A9B35DF0542B9B42E109BA23C14E26893E8EDE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2256-384-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-422-0x00007FF956C30000-0x00007FF956D13000-memory.dmp

Download

memory/2256-375-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-376-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-377-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-378-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-379-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-380-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-381-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-382-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-383-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-373-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-386-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-372-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-406-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-407-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-408-0x00007FF658810000-0x00007FF658908000-memory.dmp

Download

memory/2256-414-0x00007FF959390000-0x00007FF9593B2000-memory.dmp

Download

memory/2256-413-0x00007FF9593C0000-0x00007FF9593D9000-memory.dmp

Download

memory/2256-412-0x00007FF959DF0000-0x00007FF959E01000-memory.dmp

Download

memory/2256-415-0x00007FF959360000-0x00007FF95938B000-memory.dmp

Download

memory/2256-411-0x000001C277D70000-0x000001C277D7C000-memory.dmp

Download

memory/2256-409-0x00007FF9596A0000-0x00007FF9596D4000-memory.dmp

Download

memory/2256-418-0x00007FF959320000-0x00007FF959331000-memory.dmp

Download

memory/2256-417-0x00007FF959340000-0x00007FF959354000-memory.dmp

Download

memory/2256-419-0x00007FF959240000-0x00007FF959312000-memory.dmp

Download

memory/2256-416-0x00007FF956740000-0x00007FF956AD0000-memory.dmp

Download

memory/2256-374-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-421-0x00007FF959150000-0x00007FF959238000-memory.dmp

Download

memory/2256-423-0x00007FF959100000-0x00007FF959141000-memory.dmp

Download

memory/2256-431-0x00007FF956530000-0x00007FF95673B000-memory.dmp

Download

memory/2256-420-0x00007FF956DB0000-0x00007FF957046000-memory.dmp

Download

memory/2256-437-0x00007FF956D40000-0x00007FF956D52000-memory.dmp

Download

memory/2256-438-0x00007FF950B90000-0x00007FF950DD5000-memory.dmp

Download

memory/2256-436-0x00007FF9572E0000-0x00007FF9572FB000-memory.dmp

Download

memory/2256-435-0x00007FF956480000-0x00007FF95652B000-memory.dmp

Download

memory/2256-434-0x00007FF956B60000-0x00007FF956B85000-memory.dmp

Download

memory/2256-433-0x00007FF956D60000-0x00007FF956DAF000-memory.dmp

Download

memory/2256-432-0x00007FF956B90000-0x00007FF956C28000-memory.dmp

Download

memory/2256-430-0x00007FF957300000-0x00007FF957311000-memory.dmp

Download

memory/2256-429-0x00007FF957320000-0x00007FF957331000-memory.dmp

Download

memory/2256-428-0x00007FF957340000-0x00007FF95735A000-memory.dmp

Download

memory/2256-427-0x00007FF957360000-0x00007FF95738D000-memory.dmp

Download

memory/2256-426-0x00007FF957390000-0x00007FF9573B6000-memory.dmp

Download

memory/2256-425-0x00007FF9590B0000-0x00007FF9590C8000-memory.dmp

Download

memory/2256-424-0x00007FF9590D0000-0x00007FF9590FF000-memory.dmp

Download

memory/2256-439-0x000001C279CA0000-0x000001C279D49000-memory.dmp

Download

memory/2256-371-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-370-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-369-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-634-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-368-0x00007FF9593E0000-0x00007FF959696000-memory.dmp

Download

memory/2256-367-0x00007FF95968D000-0x00007FF95968F000-memory.dmp

Download

memory/3528-13-0x000002036F930000-0x000002036F9D9000-memory.dmp

Download