d6b40e165cf32bac52407672b316175937a3ab192f1f1dcd8a04d927a672e1e1

Resubmissions

06/05/2026, 17:44

260506-wa97kafv7x

06/05/2026, 17:33

260506-v4yvysbv8l4

06/05/2026, 17:32

260506-v4e3vabv7l3

06/05/2026, 17:14

260506-vr3ndae16s4

Analysis

user interaction
yes
max time kernel
576s
max time network
565s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
06/05/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quantum Entropy Candle.exe
Size 4.2MB
Sample260506-vr3ndae16s
SHA256 d6b40e165cf32bac52407672b316175937a3ab192f1f1dcd8a04d927a672e1e1
MD5 69a61ed3418dc78a7aa0c64ec9d7ac2a
SHA1 da6093aaa72e25f7a6135be1e8dcb6a2ed97d9e0
SHA512 d88fde32894374b39de728eee110ad5ab0e6bb14603a9a6dffdce1fb7f9d179be4901b4f52c32eea2f3823101a0dde1c6d6c9f963e5c12f84f2e1124a90fe4c5
SSDEEP 49152:0v0IUvRAg0JLSccJBJzJ87HwJ3FcfYOpyrFPEaQ95dJvNoWHtBBP2xCsYXf7cGiM:sUqJLCXJzJLOWRnO3oOP2w/gGiAjRCEb
TLSH
T1FC16CF43F6A350ECC01AC174875AA623FA75B8894B107EEB5680D7363E75EE06F39724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000\Software\Microsoft\Internet Explorer\GPU	TextInputHost.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225614560667918"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\localhost\ = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\localhost\ = "0"	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\localhost\NumberOfSubdomains = "0"	TextInputHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\MuiCache	TextInputHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	TextInputHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\CRLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CTLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\Certificates	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\Certificates	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\localhost	TextInputHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\CTLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\Certificates	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\CRLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CRLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\Certificates	TextInputHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\CRLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\CTLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	TextInputHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\CTLs	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\localhost\NumberOfSubdomains = "0"	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\localhost	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\localhost\NumberOfSubdomains = "1"	TextInputHost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1680	TextInputHost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
3596	chrome.exe
3596	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe
Token: SeShutdownPrivilege	5844	chrome.exe
Token: SeCreatePagefilePrivilege	5844	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe
5844	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1680	TextInputHost.exe
1680	TextInputHost.exe
1680	TextInputHost.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 2976	5844	chrome.exe	83
PID 5844 wrote to memory of 2116	5844	chrome.exe	84
PID 5844 wrote to memory of 2116	5844	chrome.exe	84
PID 5844 wrote to memory of 4244	5844	chrome.exe	85
PID 5844 wrote to memory of 2328	5844	chrome.exe	86
PID 5844 wrote to memory of 2328	5844	chrome.exe	86
PID 5844 wrote to memory of 3560	5844	chrome.exe	87
PID 5844 wrote to memory of 1760	5844	chrome.exe	88
PID 5844 wrote to memory of 1760	5844	chrome.exe	88
PID 5844 wrote to memory of 3560	5844	chrome.exe	87
PID 5844 wrote to memory of 5156	5844	chrome.exe	89
PID 5844 wrote to memory of 5156	5844	chrome.exe	89
PID 5844 wrote to memory of 5192	5844	chrome.exe	92
PID 5844 wrote to memory of 5192	5844	chrome.exe	92
PID 5844 wrote to memory of 4208	5844	chrome.exe	93
PID 5844 wrote to memory of 1564	5844	chrome.exe	95
PID 5844 wrote to memory of 1564	5844	chrome.exe	95
PID 5844 wrote to memory of 2136	5844	chrome.exe	96
PID 5844 wrote to memory of 2136	5844	chrome.exe	96
PID 5844 wrote to memory of 4728	5844	chrome.exe	97
PID 5844 wrote to memory of 4728	5844	chrome.exe	97
PID 5844 wrote to memory of 3996	5844	chrome.exe	98
PID 5844 wrote to memory of 3996	5844	chrome.exe	98
PID 5844 wrote to memory of 2964	5844	chrome.exe	99
PID 5844 wrote to memory of 2964	5844	chrome.exe	99
PID 5844 wrote to memory of 3720	5844	chrome.exe	100
PID 5844 wrote to memory of 5324	5844	chrome.exe	101
PID 5844 wrote to memory of 1832	5844	chrome.exe	102
PID 5844 wrote to memory of 4580	5844	chrome.exe	103
PID 5844 wrote to memory of 4580	5844	chrome.exe	103
PID 5844 wrote to memory of 3596	5844	chrome.exe	111
PID 5844 wrote to memory of 2780	5844	chrome.exe	117
PID 5844 wrote to memory of 2780	5844	chrome.exe	117

C:\Users\Admin\AppData\Local\Temp\Quantum Entropy Candle.exe
"C:\Users\Admin\AppData\Local\Temp\Quantum Entropy Candle.exe"
1⤵
PID:2228

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1482dcf8,0x7fff1482dd04,0x7fff1482dd10
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2016,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2084,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2348,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3212,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3256,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4104,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4184 /prefetch:9
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4612,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5276,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=4864,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5488,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5680,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5564,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5544,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=212,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5320 /prefetch:14
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=3452,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5532,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4304,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4256 /prefetch:9
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5460,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5464 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --string-annotations --field-trial-handle=5624,i,1102012076917281245,15611188061201991619,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3208 /prefetch:14
  2⤵
  PID:2780

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc
1⤵
PID:840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc
1⤵
PID:3248

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004C0
1⤵
PID:4528

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d14f34a0d7015533d41abcd67de5818950f77dc7bdcf71ea7d6567ade685e8c8
MD5 fa15cfe3ef7fcc8bb2b5f58f8cfc3ce4
SHA1 4db996d3ea9403d645c6468cd6331feeeb469184
SHA512 a4ad5b4d3a71b3110b544f7b25872d15db821d3ee1a4d5d4ba87b8bff6dc03a2f267b2ccfa438f721696311f7713988c0b8fe9605f6c9e59922ab722d795b7b5
TLSH
T11FE0E5A6C961A82B09FD175D60640346E79113562A809D4F3A3CA20D9F71B6A4549C5C
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8d75978209bfb79e08484d06662f567d0457b39051317462dffdbeb23c544ec6
MD5 3fd2266a4b2ffbc732fa6725683915de
SHA1 ffb3adb22ef64301c48b223e948493bd6246bca5
SHA512 083e6500bda934cf93d8ccc4fbfe75bfbac7a9539f8af97e71f1a1584f15744cc51ce41a261f91c2fe9b00ea732bfb6e42617fdc3ed1b45e6118370adc69da15
TLSH
T1D751ABB3C3D486AE854256E86A216F2FDD6D4A24431C3D16C8D8AF4F43F2972E31128E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 0585c6bdd1a7c36d7386c3bcc2155fbe7fb1a1209f5dd7df4d0a8ab52fc9a726
MD5 588ac9766795b90da582a941abf310b2
SHA1 e9667bb450a6ef5b2875ea6f73e77763ca352bbf
SHA512 92bff15845a21e9ceebe642b8bc6d552095112ee888e2544e0418add87d20fecb03b2fadd2eba382e3eb6855fac130de5c8ff9ec0a67da6f83bbcbd705d493cc
SSDEEP 192:yY2W8Ce8oYBuZ7TCnPRpPcZKHS+WN4zgoLy2JHbmdMkwYQhIpQyIsnA/g4:yYf8CspOXMecLoe2JH6+92Z4
TLSH
T17432E65DAD28597F4CCAD61AFE157B46D7F8102221903E84EBFCCA1D14E76DC222750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 91bf7f13f89a6aecd1a289af79fb92cc55dd2b93c343fadc546daa990328b53c
MD5 e69fc822d6ec7f8a61a6fcc61091b74b
SHA1 172c58988244626fa4a1386a0a6d15e442703acf
SHA512 e772b37527d1f5b96a4def4bf7b9136b1139f9b1a4d6d5344063db2311a997f0c6ea20177de092eaa86a56750ec4f60fe4691f75bc76ae914ffbd702a5694def
SSDEEP 192:yY2W8Ce8oYBHZ7T0PRpPcZKHS+WN4zgoLy2JHbmdMkwYQhIpQyIsnA/g4:yYf8CsaaXMecLoe2JH6+92Z4
TLSH
T1C532E61DAD28597F4CCAD61AFE157B46D7F8102221903E84EBFCCA2D14E76DC222750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 18KB
SHA256 0a5da97168d439d08c0d69edc27876de20e80361457904717d7009e3b0ecd3b4
MD5 f211269a0c7d778e80aaa133adbcc9eb
SHA1 a4798871a734c7a75b97edd5d2b57c6d64eb8cfd
SHA512 03d5b80e2ab3e2c58fe608a682691e236045d10a8d33e744d52a4a8464e5b7c421051e1bf584889a7bc2ccb5b89d9e2871718e5a2d0497a8006fa9b04d7c9434
SSDEEP 384:cwkG7pLuLcjH7pLuLcghExXazPkXqKf/pUZNCgVLH2Hf1AxrUf7HGYrJ:cFG7pLuLkH7pLuLpmVazPkXqKf/pUZNk
TLSH
T16182D6A77C089E774F90CAC8D92A7A4FADB5124B55DEC4A583FA983703D0EDE01051EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 70107a291903e643556c82f3758cc459d69075f2fed9f9167710af78a5405f2d
MD5 e400246efa5569c378c3d5c1eb3e007c
SHA1 4667e5195c2e2255ba3ee2e550e448a9380af376
SHA512 772c8861efc15cb9cab545eaf199f39af6d9f85ab34057f500df5b2c356e12214f029e230d99d95ab2a847d3ef6959366f4c75f61a63337edbf76b8218f10072
SSDEEP 384:cwB77pLuLcSjExXazPkXqKf/pUZNCgVLH2Hf1AxrUf7HGirZc:cY77pLuL/oVazPkXqKf/pUZNCgVLH2H6
TLSH
T13172F967784C9A7B4F94C9CCDC2A7F4FACB5025B56ED889483FA582603D4ADA01051FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e460b43c8fd38c7f381209df32978b717d4e471bbd52e01148936182df9da95f
MD5 b22b9fd2813119adff5ac7ea62940511
SHA1 c29210d78297b9e17abc1c654e9596ef0ad9f7b4
SHA512 2e0699bd395b266cf9fa5788629aaf72ffad08ff8d1cea2cd15844a021754403a2744a32c1d449a636fb867289f300a4af0f840c0f394f09906b63c78a00dde3
TLSH
T118A0022C05DD1213C901067C344656D22369DD71612117C265919898FCB11419393509
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ad10d2af30a08eb22dd632de2e44564ffcdc13d2dbbf2af5eb49141c03ab42b0
MD5 1b05de460552671b81aa3b468b6c1c48
SHA1 7d5f42df73ef2989b90e0b377ed324c978daf2e2
SHA512 5152c27b349a33fafe86b666804807dcc9b5f81463600d511fa8e2cec44c6a82db2d3d33bb2a9c8fa4b8e18e979d3114e08b7d868c97088bc18660a82cef813b
TLSH
T1B5A0025115548481C8850B709F4705C423508810A922131156E8A479FDB41C4C51A008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b292.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b292.TMP
Size 48B
SHA256 571a84f6c1bea501d7d494828b6d5fd9ab43875266034337ea9e72db29cc4596
MD5 76c29bb5d2fcf84cc66ab859f3461699
SHA1 013bd94d5c6419eaceb8c6033d7e740f35db6d7c
SHA512 ba91e0e820d1bce3a2a17ad365d683389b1795c8d3c35e4503507ea23141ae18a3f58fb7ec6dfbe9a25e8861cd6d7e1b523ff044b8ce0620194ac2d1f075fb38
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 203KB
SHA256 0410883a1215d4e0cfdbea3a2fade6ab53b273ce2a296e9817888d31af7dd710
MD5 155f94e918d4b77f08d38f816cf9677e
SHA1 9f3393a6b7c67d5266c0fd709d45d6a23aa8925e
SHA512 30d376012e3d72e03e8fb94bb50f8490d13d8b04fbc793f6a5c830851485d8e27ae90b2b3cf1b10828bd4047e9934650278db249a6802477fe24278a7ac1c85c
SSDEEP 6144:dppJ1egwfWtrJj2EZHMgS865ISvLWdHXDavpjrc2:dppbeg6kJ2EZH0eVXDavtrR
TLSH
T1B81423F0FF8C0FE724D0851E90627F174DDC6A1FD509EE9A9AE85A4A14A440B3A1FB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 203KB
SHA256 3af62a9620424f64e1302db0c989ee047e3b8c37b19ec8babf0df687e1a1acce
MD5 e307fc3bc6adeb1f14895951146fe369
SHA1 f4d22b30c4d13bdef1f42b490edae2b8ff6eec76
SHA512 6ab3be11656809d0c699347c3ce16be9311ecafa1e82e104feeda994a3e2d8cf0773068b2bc1d6f531533cbd3f879e94f54cfbc5d6912ec8d93f6c56b3067c7d
SSDEEP 6144:sppJ1egwfWtrJj2EZHMgS865ISvLWdHXDavpjrc2:sppbeg6kJ2EZH0eVXDavtrR
TLSH
T1811423F0FF8C0FE724D0851E80627F174DDC6A1FD509EE9A9AE85A4A14A440B361FB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 82KB
SHA256 3810031dd2c043009d52d3593d39ff13604aae642ecaf67571df11f05ed45153
MD5 bf6b1c14c9679cbc825e962f56fd47de
SHA1 f3b6ad565011d4cb285581fcb904a42eb4620677
SHA512 0933b30cded6392291117332786df98ede1f59ecf89c819f18eae617890e25d1edce364d2a937e2272598cd11079509c22e6fedf43b4af930f130791b64ad242
SSDEEP 1536:IU3Oxbytlt+0eqgYswraFwWVS0zo2OYjjPbYtfBqeMc9:baWXtHelYDamOeYjnrc9
TLSH
T171830271BB5C47772AB1520ED8546E5BDCFD298F8402ED469EEC1B0F21E1ACE211E21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 204KB
SHA256 cf19bdfea3a77a3f689bdf2a787c407924108dfca4a633720ca2d240289771fb
MD5 4bdf366f85791e2454766c0211d7a482
SHA1 87a3da3d0328df909ee3204f4f163dc1ca587c45
SHA512 ab778e883a3108291e1831a5b228fc45550d5e219f1e39121db961a8e1fdda45f63a9ba299efc3e201f07a841fc302e0d78789ab1b7f88744b6843b638929444
SSDEEP 6144:AyipJ1egwfWtrJj2EZHMgS865ISvLWdHXDavpjrc2:Abpbeg6kJ2EZH0eVXDavtrR
TLSH
T1F91412F4FF880FF714D0891E80213B174DD8BB5FD509ED9AAAD85A4A14A54073E1FA54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffd8408a-5726-4c3a-9eae-682803e20cdc.down_data

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\ffd8408a-5726-4c3a-9eae-682803e20cdc.down_data
Size 555KB
SHA256 855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
MD5 5683c0028832cae4ef93ca39c8ac5029
SHA1 248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA512 aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
SSDEEP 6144:m4W6OWkK0An6PtQ3VG7Gz3AW/ZPfMKUPIbs7aGU4toNNQQPi/+sMT/TtpNkppXsb:hW6O/k1zQWZz/QtGo2saBKZIxWoOu
TLSH
T19FC423910369E888C6921D7E1DE13734E7CF41786CBB42748C02DA76EF8695FC6EB520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

APPX.m3ohd51fstooh_ue4k1exu7af.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\APPX.m3ohd51fstooh_ue4k1exu7af.tmp
Size 1KB
SHA256 b64efcb638291c1e1c132ed5636afbb198031cee44384f3ecf67d82b73accecc
MD5 4085b7b25606706f1a1ad9a88211a9b7
SHA1 31019f39a5e0bf2b1aa9fe5dda31856b30e963cc
SHA512 9537559523839e3e708feabe8c04f40236add7d200ec36bad00c10a69337a15001103c17093dcc0d8cadb4713d911f39a6411624c1db4cbf1ea1af272a716168
TLSH
T126210046F0C40AB046B3646517759657F73E93C7346D0184FCED724B2F6938A0227364
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.s0veh8ruetr5ii6uqt2_5v7de.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\APPX.s0veh8ruetr5ii6uqt2_5v7de.tmp
Size 2KB
SHA256 4112d529734d33abda74478c199f6ddc5098767e69214a00d80f23d2ea7291ff
MD5 530f1945913c81b38450c5a468428ee6
SHA1 0c6d47f5376342002ffdbc9a26ebec22c48dca37
SHA512 3906427ffb8f2dfea76ba9bb8cac6bd7dece3ebee7e94ea92da5bbdb55d8859c41260a2bda4e84fab7e1fb857ad12a2e286694ea64d00d0aa6cab200fbbf64f0
TLSH
T14A51FAA0163DBC36418D4BFD8F94B1002C7158372727AE5ADCAF91B618BB9A34F630E5
MD5 SHA1 SHA512 TLSH

Submit Download

APPX.wvh2v1dtavesnv2w_m34k7_pd.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\APPX.wvh2v1dtavesnv2w_m34k7_pd.tmp
Size 9KB
SHA256 92a7d7d3b0bfac458ddcef07afcdad3646653ba7f4ad048fdd7a5ec673235923
MD5 24ebdb1228a1818eee374bc8794869b7
SHA1 79fc3adb42a5d7ee12ff6729ef5f7a81e563cd2d
SHA512 63764d99a0118fac409327d5bf70f2aa9b31caf5277c4bc1e595016a50c524cd6c3d67924321b0fcad12cd968de1a62bd292151e35fd907034efd0f40b743d6a
SSDEEP 192:vWULwu0Sc2HnhWgN7aIWuAE/uuOiqnajls4v6:dD/HRN7q1ilm4i
TLSH
T157124AD28D6C8847DD673C4053E8E89B7C3C93C72810955B196EFAA51DE3BC2E72862C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15643328-6d30-4bdc-8d65-0d6506c392c0.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_2010782669\15643328-6d30-4bdc-8d65-0d6506c392c0.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/840-481-0x000001DC9BFE0000-0x000001DC9BFF2000-memory.dmp

Download

memory/1680-808-0x00000216A1B00000-0x00000216A22AE000-memory.dmp

Download

memory/2228-0-0x0000000140000000-0x0000000140894000-memory.dmp

Download

memory/2228-1-0x0000000140000000-0x0000000140894000-memory.dmp

Download

memory/3248-491-0x000001562AB60000-0x000001562AB72000-memory.dmp

Download

memory/5636-25-0x0000026BB8D50000-0x0000026BB94FE000-memory.dmp

Download