0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9

Analysis

user interaction
yes
max time kernel
992s
max time network
992s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Size 565KB
Sample260522-pc1btaav5k
SHA256 0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9
MD5 a36f861a8130cfa1937cafb2d3c18c6e
SHA1 af0a364917ff5becb8e3d6258981fec0b8124991
SHA512 dfd2c80ae42c33f3b893a9838475da90346f4d18c19c996a13463076075084691a85449579829e1c9803d3100c34d4d672a1d81b13961fd51579641aee1c3008
SSDEEP 12288:84rWxeLp5Rae0GzdsQZx9HHfPwaI9RfZ1Da7mcNx5qSUWHlpmGYDD64hL:xr1bx0G1Zx9nf8f7uacNx5qyCv64
TLSH
T1E0C402467AC48B52D6C48671C8E7891143F7E9CB6BF7C3073A480A8B1E907F2DE19789
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware collection discovery spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.lnk	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key opened	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key opened	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key opened	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key opened	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key opened	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key opened	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key opened	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3428	chrome.exe
2948	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239256659036880"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0 = 2b010000250100eeebbe17010400000000005900000031535053537def0c64fad111a2030000f81fedee3d00000005000000001f00000016000000500061006700650043006f006e00660069006700750072006500530065007400740069006e0067007300000000000000550000003153505330f125b7ef471a10a5f102608c9eebac390000000a000000001f0000001300000043007500730074006f006d0069007a0065002000530065007400740069006e0067007300000000000000000065000000315350538727bf5ccf480842b90eee5e5d4202944900000019000000001f0000001c0000004600690072006500770061006c006c0043006f006e00740072006f006c00500061006e0065006c002e0064006c006c002c002d0031000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\NodeSlot = "12"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "11"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 0c0001008421de39050000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\5ec195365592e128fca869cd5d1ac51a75c204261e3bc928d0a76892046244ef.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\2b2293a0cd9ff8648a95a9a46e6999c9e9961fc281ff5d0b698a22755974c621.zip:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5248	explorer.exe
5248	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
1412	chrome.exe
1412	chrome.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
2496	chrome.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeDebugPrivilege	2496	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe
Token: SeShutdownPrivilege	5072	chrome.exe
Token: SeCreatePagefilePrivilege	5072	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1412	chrome.exe
1412	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe
5072	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5772	OpenWith.exe
5856	OpenWith.exe
5916	OpenWith.exe
3336	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 1412	4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe	82
PID 1412 wrote to memory of 4372	1412	chrome.exe	83
PID 1412 wrote to memory of 1888	1412	chrome.exe	84
PID 1412 wrote to memory of 3428	1412	chrome.exe	85
PID 1412 wrote to memory of 2496	1412	chrome.exe	86
PID 1412 wrote to memory of 1132	1412	chrome.exe	87
PID 1412 wrote to memory of 4960	1412	chrome.exe	88
PID 1412 wrote to memory of 3120	1412	chrome.exe	89
PID 1412 wrote to memory of 2124	1412	chrome.exe	90
PID 1412 wrote to memory of 4956	1412	chrome.exe	91
PID 1412 wrote to memory of 2324	1412	chrome.exe	92
PID 1412 wrote to memory of 4924	1412	chrome.exe	93
PID 4860 wrote to memory of 2496	4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe	86
PID 4860 wrote to memory of 2496	4860	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe	86
PID 5072 wrote to memory of 4484	5072	chrome.exe	98
PID 5072 wrote to memory of 1196	5072	chrome.exe	99
PID 5072 wrote to memory of 1196	5072	chrome.exe	99
PID 5072 wrote to memory of 2948	5072	chrome.exe	100
PID 5072 wrote to memory of 224	5072	chrome.exe	101
PID 5072 wrote to memory of 224	5072	chrome.exe	101
PID 5072 wrote to memory of 4368	5072	chrome.exe	103
PID 5072 wrote to memory of 4940	5072	chrome.exe	102
PID 5072 wrote to memory of 4940	5072	chrome.exe	102
PID 5072 wrote to memory of 4368	5072	chrome.exe	103
PID 5072 wrote to memory of 2172	5072	chrome.exe	104
PID 5072 wrote to memory of 2172	5072	chrome.exe	104
PID 5072 wrote to memory of 4732	5072	chrome.exe	105
PID 5072 wrote to memory of 4732	5072	chrome.exe	105
PID 5072 wrote to memory of 2984	5072	chrome.exe	106
PID 5072 wrote to memory of 4072	5072	chrome.exe	108
PID 5072 wrote to memory of 4520	5072	chrome.exe	109
PID 5072 wrote to memory of 2724	5072	chrome.exe	110
PID 5072 wrote to memory of 5016	5072	chrome.exe	115
PID 5072 wrote to memory of 3332	5072	chrome.exe	119
PID 5072 wrote to memory of 3332	5072	chrome.exe	119
PID 5072 wrote to memory of 3980	5072	chrome.exe	120
PID 5072 wrote to memory of 3980	5072	chrome.exe	120
PID 5072 wrote to memory of 4512	5072	chrome.exe	121
PID 5072 wrote to memory of 4512	5072	chrome.exe	121
PID 5072 wrote to memory of 4440	5072	chrome.exe	122
PID 5072 wrote to memory of 4440	5072	chrome.exe	122
PID 5072 wrote to memory of 3128	5072	chrome.exe	123
PID 5072 wrote to memory of 3524	5072	chrome.exe	124
PID 5072 wrote to memory of 3524	5072	chrome.exe	124
PID 5072 wrote to memory of 580	5072	chrome.exe	126
PID 5072 wrote to memory of 5676	5072	chrome.exe	153

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe

C:\Users\Admin\AppData\Local\Temp\0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe
"C:\Users\Admin\AppData\Local\Temp\0783585328aa96695c4412282b96cb03dffe79a1c5e68625bbad983ad9ef24f9.exe"
1⤵
- Drops startup file
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff978edc728,0x7ff978edc734,0x7ff978edc740
    3⤵
    PID:4372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1592,i,13178282673962288792,3453333084754550751,262144 --field-trial-handle=1904,i,15297263077275770608,5522579163801690456,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
    3⤵
    PID:1888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2" --force-high-res-timeticks=disabled --metrics-shmem-handle=1988,i,16567344772617970880,2218385678824149451,524288 --field-trial-handle=1904,i,15297263077275770608,5522579163801690456,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2" --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,6282394051044264075,12555969581180079258,524288 --field-trial-handle=1904,i,15297263077275770608,5522579163801690456,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:13
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2916,i,13673107263370946204,694696692475440896,2097152 --field-trial-handle=1904,i,15297263077275770608,5522579163801690456,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:1
    3⤵
    PID:1132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2924,i,7744617324647459371,5808285039138962720,2097152 --field-trial-handle=1904,i,15297263077275770608,5522579163801690456,262144 --variations-seed-version --mojo-platform-channel-handle=1608 /prefetch:1
    3⤵
    PID:4960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3132,i,1059643013414060391,18046902048356216436,2097152 --field-trial-handle=1904,i,15297263077275770608,5522579163801690456,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:3120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3120,i,8868076941548098824,2022358922428104978,2097152 --field-trial-handle=1904,i,15297263077275770608,5522579163801690456,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:9
    3⤵
    PID:2124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3764,i,14394057753988228637,13498510654739584236,2097152 --field-trial-handle=1904,i,15297263077275770608,5522579163801690456,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:9
    3⤵
    PID:4956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3836,i,2479405991838084183,1910219853652127141,2097152 --field-trial-handle=1904,i,15297263077275770608,5522579163801690456,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
    3⤵
    PID:2324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2" --force-high-res-timeticks=disabled --metrics-shmem-handle=3180,i,4958379036976712706,11757097606503570876,524288 --field-trial-handle=1904,i,15297263077275770608,5522579163801690456,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14
    3⤵
    PID:4924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff975bfc728,0x7ff975bfc734,0x7ff975bfc740
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,1880911423985593324,16515157842457170174,262144 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,17021368251768254099,10790733425761346634,524288 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,16119045048778088679,13677592835161214170,524288 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,10546329301637477517,3684218954056536436,2097152 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,14102369296394345121,15412100065224766158,2097152 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4064,i,518597460813451619,2717374068530197470,2097152 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4080 /prefetch:9
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,1330715994161371766,6151436037716296644,2097152 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,2289659161835616422,15095215784022742917,524288 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,6236832756262044514,5827795925922953951,524288 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,9226314064848856220,5106235988641149557,524288 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,11420864157811795294,5538925898436148525,524288 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5492,i,2992845362808956312,6543886395127194606,262144 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:10
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3100,i,2956772242429953286,11558311548193473810,524288 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:14
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5932,i,703506089819770129,4821053293780039549,2097152 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3596,i,12203594723180800094,2787177118691113459,2097152 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3560,i,16337760012809188166,10187443309779235873,2097152 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,175146088331555119,4830665861300590711,524288 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1596 /prefetch:14
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3068,i,12318247088474156409,10756241206690657362,524288 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3712 /prefetch:12
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6448,i,16313619571669075931,13449817714421748816,524288 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  - NTFS ADS
  PID:580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6480,i,15120062619673712773,6897105040182649354,524288 --field-trial-handle=1912,i,11918172881037842426,4706382141433639246,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3352 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4116

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1520

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2504

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5204

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:5248

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5376

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5772

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5916

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
PID:4572

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 9ff7a715f2044f077b99baa428e869ab74460cbead0104fda07c47d7c3987fd3
MD5 9274b6ce6ee188fd14bdaabe0b1e871e
SHA1 a96956605aa5fc908590fa4465c7794e3d22d76b
SHA512 90cce6a52c13d38d552676302c8d90846cf15699de179e43f3c5a06a26e671167222d81b4039bfed2bf6c2aae45a538324cc3aa6730c793ecb41e9623c673325
TLSH
T1EAF0F9AAD9219C3B08FC2B2970A5174BE75013672780584F3A3C920C4FB553B458691C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 d83576c6a0dea1ec44a5600d7bc19ada080d7c75039b27998e5e4495c53afab1
MD5 3fa309533c1c5cdeac86846ddbd299dc
SHA1 4087a7ef9f3ae3da7cff6b099268d357b53fdc09
SHA512 5ecd968b6778d4338db8c6485e4a68cb432944d794dd4c693155240a05f44a038ff61eb4813fdbf2ff691c67302d8401e34564d108d46905d964d93c8631ec76
TLSH
T13431CB556D938D27CBE078BD8C36BFCC1F21120EF946CBC731AAD1321652EE09A59705
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 d293cbbaad0d47bc4108213992415c4c95facd8089fe01e7bc721ce2251e6ca5
MD5 94ae2f1207a8293fc53ac3fe221442d6
SHA1 6151188e1c764cfa5a8501e4df76b8c3bdf92293
SHA512 d9746d325e6b3d4a37fee94b267be424c93599d4f265a965bb3accee308890ac580621672864076b43c996b444272168c879206eec5f9918c0570e100ec088fb
TLSH
T15D01E1982E115D23CBF149FEC47B5EDC1F710B06C2091FD831A1847666430E1CF28419
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 523867f628d0fd070375a481fa2646af1aedce191843e8349692c254fb626aea
MD5 ee3b590b7475962adb0df6a219eb20fc
SHA1 45d8356e232c21b0b7aabd00e2d3f28d79302daa
SHA512 833627abaf36a61e34a5098c491d5f317ca4cef7a041ff5ae25c9b5032d5a548b1102238f23dd46f3ab1c59da4fd21870e30cc45d19cd2c523693d9f09d5a6e9
TLSH
T1C221EB816D538D27CFE078B98C32BFCC1B22020EFA46CBC731AA91351642EE1DE09709
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 6910f161cd88c4f5a6e880761e3a8d2a2019ad24403576b784850f3e613a6cfd
MD5 70fd40d321fa07a977e2f19a690917c9
SHA1 e015c8ceb695dddaba691ddf0fc0452e8bb560b2
SHA512 b602baad51dc17b31ef7193a0650ac0903697cc6a7dabc69deee490cec61ca945dc9a16a796fce9243c4701699c3574abdd05efb44f5cdb62ad10efefb9846fe
TLSH
T11921CB816D538D27CFE079B98D32BFCC1A21020EF946CBC7316A90351152EE09A49615
MD5 SHA1 SHA512 TLSH

Submit Download

57f724d3-5304-4a29-99ea-b065ebd0b38d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\57f724d3-5304-4a29-99ea-b065ebd0b38d.tmp
Size 3KB
SHA256 320ec7ea5035fc689351c73e3cce3f75901e401a27607116fe7a3fb42225016c
MD5 2a47db20f705ed9933b5c640ed33c33f
SHA1 63b2f49b93603f0494876dd91409fed9e409c40e
SHA512 3b959516268ac5d3ed3b5f15c5b385bf34e1482b75b361026f807e2c3869c25ea107c5436c00caaed1bdc52eac88bf2efa77c2758f56f1cee41c167b43cacb6a
TLSH
T16F516AB3D7D88A7DC81152F4AB256E2FCD2D0A24532D3C56C8D8AF4B53E2872D21179E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 3e1410d0e95841205d5d8500fb1b85b456bc2a988665bbb3ec9125ad44464cfe
MD5 105620bd62fcf29538f0b76347c1fa97
SHA1 697fe5acd7dcc19f34584210da860d207f05a828
SHA512 5aacba08930cc6aef62f0de9646935d1707e92d1f9167a8fd92440ca27112eecbd3f73df35984a58daf046e922905fb1a8af45d5edbb9f4fe563f53b193dcb00
SSDEEP 192:DBh1HSZtHQf5kcrA+Txcbx2EDiEd7HW/5KIFImZSkqm82VJtjhncBRbJF:DBh1HSZtHQf5kcrA+Txcbx2EDiEd7HWM
TLSH
T14102CDF7D3E4C62DD91156F4AB25AE1FCE2E0928032C3C66C8D4AE4B93E2472D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 82b9e32f178d7db438670954f055d218be45b34c656fe72b7b746d45f460e62a
MD5 d48fa071aac2afcee1d2c23b33e35f3d
SHA1 90cf94c2d251b7bd662939f2752b018e549240bc
SHA512 0cd179b028de24800ae05b5dd707d316b020b5bcc18bf88e64bf4dd439077999e523836ac1ccc9f459eb625d5b5706d807aeb72499f81d9cc8f33c9227e67151
TLSH
T105616AB3D3D88A7DC81152F4AA256E2FCD2D0A24532D3C56C8D4AF4B53E28B2D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 c99e2e60816c499d63dee360de1d7f371de6a87260a81647b7053bb48747edd8
MD5 e519f55ef3eb80d7e598e4ddc7d0d898
SHA1 29696a4b0497769a918f18620a5c6e184205f417
SHA512 69193980d0eb4f3cfaf5e096e690fb3fb88758b0d7c630ffdca6fea60d1ea7c03f1438681196b41bfab5976e39992a1f1d53d51335158934c2ad9fdd01c45d69
SSDEEP 192:DBh1Hk3h/3sYCaVH93tiDa2EDiEd7/W/5tI0ImIEIr2m+RlaL82Vml+jh5lobJF:DBh1Hk3h/3sYCaVH99iDa2EDiEd7/W//
TLSH
T135327FF7C3E8C63DC85156F8AB257E2ECE1E092853283C2AC8D4AF5B93E1871D25165D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 9927495e2e47194348af94cf604f95208b9766f563d9be167879d22b4378b292
MD5 3fda3a491d26223f2fc4cb4c76efdac9
SHA1 0f73fb42febc5ce2efd1d4269703b68d483a9393
SHA512 d4818a6e64ea6e274c47d40958ac5a804c2bf5079f507e7cd6b8f6397cd4058f48e9a2fe90477b9811022114398d5259c05e2c7276e0a8cba3137a6dc6fe0225
SSDEEP 192:DuYr6k3h/3sYCaVH93ti52EDpuzM/W/5tI0ImIEIr2m+RlaL82Vml+jh5dC5a:DuYr6k3h/3sYCaVH99i52EDpuzM/W/52
TLSH
T127328FF3C7D8C63DC85156F8AB257E2ACE1E0928532C3C1AC8D8AF4B93E1871D255A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 4a9f96376d175d24d285c7c21b48b9d43d77e238ec9bcbc54464201e6a75a89c
MD5 c9f760faf6f2c65e9a0cbe7b4623b1ab
SHA1 b5ba44a3ca8c6428ee0969fc86f8624be88b9816
SHA512 423b6bcacc11dc204cc9656bf6559c0214959ee75ff360fe0eab748b50f430357440c8df810fd8cc2f93cff66f428ec26401d4806f34a952cf2d6d248ad988b8
TLSH
T13A31ADE7937DB86750290DBB1D247C292DB9A43A118174F5FEFA857CA0819B30713437
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cfe2059736c55b30ae2d21d90b8f35c7a51a000653c597c340a9bb60d28450bf
MD5 9e9d0d9b6a94da5707ef730c8bcd5128
SHA1 3c1a97ea45835008e20d3364f8364f1034c1335b
SHA512 a3c26e004ed4be03548c0cf9b8d2d3bfca72df37d4799b9f711f4aecd043392d83de0227691eac9e080cf0c0c6200c30d84602f8411029b481ea2fabc04bcc6f
SSDEEP 192:hRbXxPpXRBJv75pAPRp2A98Hsb+WNnIP0QB2qe0AVyIsnAUgtaJ:hRbXZBJVUXLuws0M2P8
TLSH
T14C42C62EBE10697B6DCBD32AF9657767D3F5203125902E40EAFC8A2C14EB5CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 be2be1fe0a31ff843fffe3679f013a09ec4d4171169778f2ce2bd5e8edb8e2cf
MD5 efad1357cb096bec1c8c6f060e639bdc
SHA1 66d66d201a4087d001245738b2710b394e183650
SHA512 8a8f44088a62c104d100c094bfd50351a3a82c230a9b7bb9200fd77682d175096091101e9acf76d9d200abb734da64f6023829c922ca7d2ad593bbfcb6ebc56f
SSDEEP 192:hRbXxPpXRiyv75h1PRpFA98Hsb+WNnf0tbB2qe0+VyIsnAUgraJ:hRbXZieVLXeuwMtV2je
TLSH
T15152C72EBD20697B6DC7D31AF9657B67D3F5203125902E80EAFC8A2C15EB5CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 44d11f681f4cb5e1c1141abdfab16b1fa4772a15e133cf37d3cfbc9926670268
MD5 7933f37e980d2f313264067d46e0c4f1
SHA1 10cd9762184eb2037dcf43bca92bc54e47797a42
SHA512 03ae165767a8a85901efb999183941c729264203832607660bc9ab6c164ccfc25fc4db4c401aa9814af1b04258ce975a99b48be23bd8eb16a5893cf580db62cb
SSDEEP 192:hRHcBhXxPpXRirv7Kh1PRpFlGU498Hsb+WNM3f0rP9YnB2qe0+VyIsnAUgraJ:hRHmhXZiTOLXmuw9xYB2je
TLSH
T19652C62FB920297B5DC7D31AF9617B6BD3F5203125901E80EAFC8A2C15EB9CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b9cb15602eff6eef48e1079cfc25efbd159292785ea34f8c883648f547b23207
MD5 0c36e57ee2d583184243369db54a886a
SHA1 c25833652d2a6916a500783f537bf925812ce056
SHA512 29c212b910adfd7df41f292d962fe5fe959013b3d438bff65e1142a4e8107743c78f681633e3a57c1eaa43ccd37be36e85e9223be7c086fc48faf6131af8eca3
SSDEEP 192:hRHcBhrFPpXRi6v7Kh1PRpFlGh498Hsb+WNM3f0Iv9MP9YLB2qe0+VyIsnAUgraJ:hRHmhrdiWOLX1uw9CWYF2je
TLSH
T14252C72FB920697B9DD7C21AF9657B6BD3F5203125D01E40EAFC8A2C14EB9CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5470e4835bc32c6cd89a8fac959c5237781d1488d468a816fed405081af4f75b
MD5 cee5e090f840c715515c878214ad7f82
SHA1 7839d412c731db1555d1d7fb97f34ad89aa80f02
SHA512 ac19144acb12c193cd87f44fd309011046ca6d0478b8259b58d4edbaa4bf2d912e5da10c62ea3a1e3c30b204cba69d0f01b9cef617be958b29ccdefb49c5e829
SSDEEP 192:hRHcBhOFPpXRy6v7Kh1PRpFlGx498Hsb+WNM3f0Iv9MP9YLB2qe0+VyIsnAUgraJ:hRHmhOdyWOLXpuw9CWYF2je
TLSH
T11F52C72FB924697B9DD7C21AF9257B6BD3F5203225D01E40EAFC8A2C14EB9CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 87c29c13e28cd83a3445c0aac9e8639e9f5b66050e0ce435994d033b26b76e7a
MD5 712cfc1d688377ced6fe68476bec4305
SHA1 133a8af70190079be484d85e8361edb92937516e
SHA512 4ad73f09fd003feb8f494df664a28cbf323eb879cd5701d2155c8a80df3dfa2010dfcc79a528d4b3a8e3d271639ab4177ee7f95e038bfb89fee4b7472fc01e8c
SSDEEP 192:hRHcBzXxPpXRi3v75h1PRpFlkx98Hsb+WNnf0rUq2kB2qe0+VyIsnAUgraJ:hRHmzXZifVLXouwMd2g2je
TLSH
T17052C72EBD20697B5DC7D31AF9257B6BD3F5203125901E80EAFC8A2C15EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9a9e42dce216c8c520e3accbb24be133af29c3b11c0f4285ce1445298684a3c9
MD5 433f19d0834545ec21eaaa69d6dd264e
SHA1 45e79fc056756900011148ae056020316de2877c
SHA512 a705f2bee0e458b792dd90d37621f515f0a39969ea72e86a036e9782eeda13aed4601b5672cb58d69834a463bab652bba066fb6383233d5783c929a133ff8ade
SSDEEP 192:hRHcBhXxPpXRiQv75h1PRpFlGP498Hsb+WNM3f0rP9YnB2qe0+VyIsnAUgraJ:hRHmhXZiMVLX7uw9xYB2je
TLSH
T18D52C62FB920697B5DC7D31AF9257B6BD3F5203125901E80E6FC8A2C15EB9CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d80b48e3c02702b2334f441eac64e179437265fd60d3b62414d3789beb3aded4
MD5 23b19ed8f5e0bd4e100f4ae10f3ac4ac
SHA1 b79484cc271ddc88950b28dac9f0df9541cf3486
SHA512 766b19b03f800d70e17f4e80210c4f29f1b8c65cad6ec277b8163c25797cdeb44be93cbcb8b92d02e4ad5f6e739cce2303cf7b69e75633fb510c442a4ef0db32
SSDEEP 192:hRHcBhXFPpXRirv7Kh1PRpFlGn498Hsb+WNM3f0I+Zib+P9YjyB2qe0+VyIsnAUp:hRHmhXdiTOLXHuw9GoYW2je
TLSH
T1E652D71FB920697B5DC7C31AF9257B6BD3F5203225901E80EAFC8A2C14EB9CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6580b9be38e043e5d2436ff4ae9296f74b369cbea58296d9af5604bd4b1cc474
MD5 64d379491386bdf9d2b82bfed49740e5
SHA1 522dcfd2f4d188bbcad58538c6461f8bbd43b2e9
SHA512 5d58b317ff66bb8f8373e7f5972247e20a553af50c4ad2756a022edf34ee0bb5688a058056e953d457420c82cddb02044d6062aa1788af614d0c7bcf05ddc3bf
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcSjwxXODuh+ErU37PHG7iK:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17pV
TLSH
T10B72FA67BC4C9E370F94CA8CD9167F4FADF5024A65E9886482FA9C2503D5BCA11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c21c9d6bd377841732d5496ef581f878f1e73a1806923755d01e723a5db6486b
MD5 f0bb0b83cda8a8647e8dd4b1aaee265e
SHA1 9fcb58a5a12e6a02d079c57dcd078897fffba190
SHA512 19a57ad7ce0b7d85fe8241542c97dec748d1f2b7b87e7091db180b2da2d8555c9a2beb2ac5c2c3a5dd781d78129b3d813dba045cb85abcfdeb8798042758cbc9
TLSH
T17FB01240C8015501C40607F4114218887234DF14A70A171143E4B922882615089650D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e9aa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e9aa.TMP
Size 96B
SHA256 137cff7478139d22c41a9f11082e26cf79779ec77c5da391b1dc0008d94cac86
MD5 68076eddaab77631400e294b23fa8450
SHA1 5fc92183990f08f19ead27714d7bc876728ca813
SHA512 9bf7b12316389898492bee120b9048c356ba37c8eb2e68834e0697d93adf40e21adc952c9bec37788c011c99dad8f14a75cccf37047f8b872e58cf717a89d5e8
TLSH
T1D0B00265C5126216C45243B13B9595D87370EF29CB431226A2E01B6BDE256604665574
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 b6cd9edb4f1e74c9ca65e857800c46006a38c9867d160330f4d5ca5d5b6d385d
MD5 8ecb7a1dfd68c5518a0ba4cea446e021
SHA1 9d16b6a3da46421c427509d0f193eb97da845777
SHA512 4ccbe16a74eed3dc4928daf204f69b907d5b18fa00a666fb99de74f86fbf5009eadb530966ea72fd9e5c38c1c0e9ea14907d8222737c26514a46bce03184ef78
TLSH
T11FA0021211D04D21CD318279578102D1231CCE111305870380E911948DBA1628703340
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7b82ff581fa8a8ae699fd7a7e456e88c38fe7499af3add23c81220dacaaa7c14
MD5 0faa660a8699e37e873cbcc81f15c69c
SHA1 d789d76b9f0920fedd62d544fcf6b7db8249ada7
SHA512 24f057f52716388b490982b0e82cfdd1af1f849bbb873db3af9a7c28939e82f2ab3f40e630cebe5ba1098a514288385f358f1a10b3eea69d691d368019a70f67
SSDEEP 3072:iQGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM8:ibm7Rkm1tYpBeh2BAo8
TLSH
T16CC312375D74E8765AB9BB1EB04E0A1F1EF149A7CD20DE92C8D85B0433EA7CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 6569ab30ea7a3dc680c7a133b12caff7e44d1fad95c6705f4a1cffca8174e505
MD5 752f42f68ab52979b640e88a5817ab5c
SHA1 12e344bedd694896524a175fe49c93e1947b67cc
SHA512 873fc0425ed085bc0e042dc7249ad454ef12ff114435c76bd467f01a5235c070f9abe20f5ee2c4953243a52412c0a42e96830371df6075d745c8431b458f62f3
SSDEEP 6144:i4bG6/vkx6N4WXiyF0iWx8rm7Rkm1tYpBeh2BAoZ:rkxsre8q9oBGcAoZ
TLSH
T1BD34233B4D6674FA25A5B76E208F2E0A1EF05E23CE44DC45C4D09F442BDE5C86609E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 35206edbf9588e975233afdf04dde504b7b8a5776aa0dadeb2cdc73d751012ca
MD5 0cf5d7d1e2340ac84935aa92e60f8f3e
SHA1 2c60db34732e89f70cba9fe5c827cf8737c22087
SHA512 318f23de1e67062a8e860f2434631aaa0f2783407a3b428aa1adce1e517b271b13d46b1bae106ea379e09c4d9398b1d387c4525f4cc71f12813827f56539399f
SSDEEP 6144:t/bG6/vkx6N4WXiyF0iWx8rm7Rkm1tYpBeh2BAoZ:txkxsre8q9oBGcAoZ
TLSH
T17734237B4D6674FB35A5B72E608F1E1A2FF15E22CA44D881C0D09F447BDB5C86609E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c3ef0163e7d0bac7f334cebeafdbdbafd55ba7e76257cb8967d1970b9311784f
MD5 467fe3b6c5b4ab0b0cfbd67b09f48a51
SHA1 250b2def7a52ddd52a3f6fbe5dba0a5405142cf6
SHA512 fb2239d0707ba0632c8a79488e263f44e65476003baef078a1d47b42f93ad6c629e125878aa670c96e9f02601a20f229c8c75125eaa238d426e34b723aa23cc7
SSDEEP 3072:LGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:Sm7Rkm1tYpBeh2BAoF
TLSH
T134C3123B5D70A97759B9BB4EB08E0B1E1EF149A6C930DE92C8D85B0477F97DC0A04934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 9112aaf3f0a40e9219e0d76b9aa141bf81ff45ca076af8cd9aeb32d39840328f
MD5 f2d7f72f9cfcd4860e083eb95141571e
SHA1 bbf4a2072b7e991f956786f117073e5c7d6e274d
SHA512 f70838312f6a5e55f54a15758322f03a8408343015941d82d4adcc74fb8a58ac985decb00246711a7dbbca82ed0009de85935de67e178ce5e1f82d7295c28b73
SSDEEP 6144:y4bG6/vkx6N4WXiyF0iWx8rm7Rkm1tYpBeh2BAoZ:7kxsre8q9oBGcAoZ
TLSH
T17634233B4D6674FA39A6B76E208F2E0A1EF15E23CE44DC45C4D09F442BDA5CC6609E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 21KB
SHA256 8aa20b4b85352dac91eb6e840dca70a9e1f4032967da8cbde10a37442e3253a4
MD5 e4e2d7538ac9818b02eea34b7c4e9a87
SHA1 a9916aaea7022b92dff77b95e9d119a310895248
SHA512 c80a870dc864b0bc40ab17a3f5cda576b96fa77c8ead4b9c2a228a85d09a4bde5fc5c9d377825aeeff942f82013d6719a7c39b57640b7e4ea7e300ee7d2f5b32
SSDEEP 384:oJWJGVca12krtuVm+gglBOVjeQ8RJoP5ghvjUkBWa5PGm5x+GDa50XYScm3iYXEr:k+GVcWrpl8RJI5gZjUkBvPx+GDa50XYL
TLSH
T19AA23B743AF51315F3F29F759AF1A95A643AB866AC00DB4D0162028D0977D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_dvezy2jv.ubf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dvezy2jv.ubf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Crashpad\settings.dat
Size 40B
SHA256 2f768bc99247da4937cc1fd26e54f151bc7e7db1c739b19c6f5a2d876eed951e
MD5 7c034d9c5f41c95b41e7bb6456e41b94
SHA1 8a98e4e106af12e90f77a9597288a573fe6f4c66
SHA512 58a36ebc7ed7a3247d2552edf8e46e8a8902d4cf084c0a7ffd32bcf913ce70106d3d100854daf6dadd98568043739cfd5a8375377acfc4ef9e4e7d583b2f76bc
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 17603d05e1acd5d8f12ecb2fa91c47a3c402a0cbbbf5f36e2a1fb65fe7f71c95
MD5 0a9dbd1df9413d69b0218f5233d10d11
SHA1 e115bcc36b2de615a6a432dded1b39679a04b1df
SHA512 ed3bcf7c23bde5d625cdb41e37ae72367b4361b1326aac63d47e7733a1024ce334d0f2371d8c1f745a0b68e523b1e078959a5a1cce28f9b6addad769281e132e
SSDEEP 6:/FoEXEwT17NwB9HgK+B1YV51E3zQOTkF14kEX6JYVKDOkllExWj:d7XHB7NwB9HgK+7451QQke14kELKDj/
TLSH
T1CD13176CED9A1F2AFD8034BD9DCB1BB14BB08005C12A8393BA602521638DB220859169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 8dd6d9bdd6627509ac37068191e4ab0ff1982b3f71473f8249df6734ad40ca4a
MD5 5c8fc2ebbc2650f662a68e0a7658aacf
SHA1 ac7f638a194a2c6d912222a0621aa4279e35df38
SHA512 e077216ea1559c8c3de6758515f952bb5ce4af8df21e9bd703f7763468ce17484cec62e5a68a82e2d24af5b3a5379d3d259b697ad7d4de1f8790d3b4a717ca1f
SSDEEP 48:/4LlFYgIvR2gM1XgmC0X9LMmXWveRydVEPLVBKWwtl:6igkUgugmn9LjW26VOLHKWol
TLSH
T1CB4486F75C41EEC7EB15DBB86C41A22CCD324A261D9AEE75F63844B21150AF7312C6B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 7eb584df3c1dd5140da09f04448d26ffa06b0bb59ad82157ab432101412b8701
MD5 828fa368be9787d1afa8a020746241f2
SHA1 80adb3e8dcdbc5035074ee2ffed0e8482cde2eb1
SHA512 f6394340903ea89ca3e604ece53f8f8f415b84264879725a5c1a201a1fc35710996e5182f3142fd7ea63a1e6c1a053fb0b9348cb0ad1decf2461ef6f75726cb8
SSDEEP 48:ppxoZkYK2pS9oBF5g8dKeuvx1GUrGafgo0xHrDFv99X0lZH9/Aufwjj0wf5:90zoeV5dIvx1GUrbmLDFvDX0Vxwj4A
TLSH
T1B3250AF6FE18183BC04355BA4BC17D8BCBE58321C05954534A785518BE19A85C5522AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 4f733ada853024f9bc58e70a631253eafa740faf020f3d31563017726783cf4a
MD5 e7c1258e5f8241dc3d9126ae730e35d9
SHA1 384456cbf00b327dda2ca76a1fe15012f738dc54
SHA512 d7e8867cdb0e0424adab4a4f8f42df0e50f05a12df3ea12e04a079333932ef90f5ee77eb0ad2fb3e5fbbc1db9ae52e32f0abb02eda2e6acc042302e01b27eb45
SSDEEP 768:PUfDPLSgcRUv+iahv49eUfDPLSgcRUv+cahv4MfDPLSgcRUv+kahv4PUfDPLSgcI:IaN2LaNjaNxaNKyigCk
TLSH
T1F6164BB24F286D42EB45EFB0BBCDDD1C3CB12296AC975C82E52292691EF0FC41B8515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 602a23e74c1f3e1fc9059c51cb9d25085d38af36dfc3cd68322f4ce30b88047e
MD5 03c63a065f42d5775fe493414bb4566c
SHA1 5cfc5f7316e327d2945a7717320eda7d182315f8
SHA512 189d8fafa491383cd4d3fc6c23fce9eae82480ac5b7c21bf2f3a51cbe150b19a43cf9e4b9e9a2f1f5c44e78c70941513ca9e885f17dc693eb65dfadf38892999
SSDEEP 768:ZkdxonAJvDdu14caxGRuQZqatXU2xg25sD42syEkB9+Yr:Ccmdu14RxgH/RUfD42sWoY
TLSH
T105F2022CEC0E35AD1A2D2B7056FDDADE90BC2832B9B3EA38709519064DD817E11C8E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Cache\Cache_Data\f_000002
Size 67KB
SHA256 8f9a1d2362f66337acbc53b184b0d2357181e528b07deda233bb523975d7a150
MD5 ff494801761ad6200f0dd1ff4a1271c4
SHA1 35f4c6c2ffb330a8f4b524fe605b1e5095a317c2
SHA512 685c2aed797913d1262e8884976fbb1326bcc71936e39c08692f0e0bf6234dbcf0881e30b62732d19c6ffe7935effa819f16ebd0d0ae6f46803fad2a802186c5
SSDEEP 1536:CMZwRZMNj/XLaLeY8MPvAXlkV/xEZh+HfkeRt3nIyXs40eM:YZMR/z6QXCPEAvjs5eM
TLSH
T1EA6302F5BA6DC5AE730A0D76A5CF8003F87A6697223508D58883D13F2DD1798BD602C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Cache\Cache_Data\index
Size 256KB
SHA256 8b9b6902dd8bfa4371b2ed89ae608a76da7505f6806dd2866cef6cade71083c5
MD5 3aa5c4e52fa9154f812a6f08b7a12b23
SHA1 dc49e44064ac7dc95de03bc899db5868db2708f9
SHA512 68f53b504a176bfc5c3b291b899e1b37a3733364b500b5efdcd9a88320e8b8d63308e9685d6f56f3bc4f927405d93738643afcfe7627fcc89a6b7ad25876d6bb
SSDEEP 3:LsLllFlklNllklkXl0bVAllLll/mltnllll/JNtlmNtl3Nl/lell//QlNlXl:LsRa3lP0bW47lllRkNHklt
TLSH
T1AB44016ED3866E1ACAC902FEC5478B606379D809DA8FCB47176426207DC17A12E1F168
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 5326db933b0a4dabe258a0dd8f097a0319581b9aa689e7fb7594406d05df114d
MD5 44217a90e8e31fa74e23fd37bf802553
SHA1 9c62a7a9cb2ad2bcdc35f5636aa998733d66bc9b
SHA512 2785e32b676466bbb1f6bb2bf076c6170d5585033de52cec80c62e26145e1f0f1455692bbbf28f41763c52f47476018b893e2c45dc358f6ae6b714e0b575330d
TLSH
T1BBE02B81864C0F0DD32D96F7CEA643044A0A42C42ABE3A03AC80C2C237165241249122
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 f75867e5bbc39ae82ea5026414caba5fab8223f6f049333bfb6638d232a0bfa1
MD5 dda18bcea5f596760c9a866971eb8377
SHA1 a2148fc91b01e22bbe0fc59c777f82ca3abe042b
SHA512 29e7e18ac6122022b78c61ff5c9f17a28775a9e1f83aae3429f13ac66d9f23c7197cef8c934353a3517cd89c4dd7ba12999364b4a94a4a45ccb73e881f4ec349
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\DawnGraphiteCache\index
Size 256KB
SHA256 314d9d0b722baa67b433e51df2c7e02174b7cfd8d30fcfe83cfc8d2cef4427a5
MD5 9ae1a9e7dc0c70b22e7738f6100457be
SHA1 f16cb9578df311add4e73988291a1b8d63f289cd
SHA512 4f18a8feadf2ddf67d7ff1da3ca92bbb10fdef0b220ddbff2ed41cfd8ab5d0692cad448945f572b9453166dcee8d280372e08265c462530e697f8e1ade71da3d
SSDEEP 3:LstlNllklkXlBiKXl:LsX3lPEK1
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\DawnWebGPUCache\index
Size 256KB
SHA256 a587b0aac91d5f39a62a0d4031941f36906948cd0f30387ba1a7523ca494385b
MD5 40bfba5c9bda7baa6d2d0c081235c45d
SHA1 36ad93e0019ba993d4b03dfd8db26a035e80f768
SHA512 ca0652406f71601fc49ce71ac5f3f3d9b0e1a1238d623914c7822668d189e8b049cd59c60a140694dde0caaf2a7e17beca216e52a53fb7ef3f668700df8e0540
SSDEEP 3:LstlNllklkXlHVKXl:LsX3lP1e
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\GPUCache\index
Size 256KB
SHA256 35a9d5f97cf629e090d6aa5c71db1eaa32eed55eb2bda633aaf1b29b932e986f
MD5 3fe515aeaa646f19a514bc4bc13e5b8b
SHA1 8ded40f92b12bf5ef6bd5bb2940152b2fc562701
SHA512 21571d609869c5b1815e3e7bb76ec03cc0d97b3e4d08674e3b79953175d0d57525484adcffb03b4073c546c1c069e34c992c03f8831db8e47f71a5914c494a3f
SSDEEP 3:LstlNllklkXlUYVql:LsX3lPBg
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 30a3386453729cf24d972d5281d2365fbd0daaaf5d9d900e2111451fa4168204
MD5 702f6a46a3430575956415f5e90da5d3
SHA1 6f09edab47e2a3ccfdc14691a68c524d0b3d4cd6
SHA512 c79b03c868cefbc5b5460b200f1536d803b3cee98720876f232b8a9b47623f8a6b7a22fb5de854e3e893348fa047fde5d1e8f0b3df66f2627e4417a60d557fe7
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 88291aeb12ec2d4b05863665f5d52051f4ef5483a85341a6e82dc7665ec6cf27
MD5 0fa61d826ae3ee3c8c88430a9ceab60e
SHA1 68dd56cab8fcef1bd7e5bfb3015e07e0a72dd06b
SHA512 8247e1b0c5d1cff9d64f52453e0806e5ad9caab26a186cff40b6dca987c58999ef880e28ba50f0cd64e649e3080476e4e5e81a8c84e18adbc34c399980cd6e12
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bexr4y04.us2\GraphiteDawnCache\index
Size 256KB
SHA256 b23d28eb1fbf72ddd6b38d5c1a47c13b9c9c8e8de112f388eb9c960b382c365a
MD5 abd8604c495389f06200ccacd11ac511
SHA1 a470ee885f42d4fda2f294fec5f9b211e340a060
SHA512 a64d57c9b910016e2fe6c8e4485261fb060e8411ced655a60d0b7787ff371830130aecf287450a2eef7f1c8acd005ad9f8c5563a9294057f290f974926348e01
SSDEEP 3:LstlNllklkXlqAtl:LsX3lP3X
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2496-153-0x000002629BB50000-0x000002629BC7E000-memory.dmp

Download

memory/4572-752-0x0000015BAE200000-0x0000015BAE222000-memory.dmp

Download

memory/4572-753-0x0000015BAE750000-0x0000015BAE796000-memory.dmp

Download

memory/4860-150-0x0000000005240000-0x0000000005250000-memory.dmp

Download

memory/4860-152-0x0000000000D60000-0x0000000000E60000-memory.dmp

Download

memory/4860-151-0x0000000000D60000-0x0000000000E60000-memory.dmp

Download

memory/4860-156-0x0000000005240000-0x0000000005250000-memory.dmp

Download

memory/4860-215-0x0000000008330000-0x000000000834E000-memory.dmp

Download

memory/4860-214-0x0000000008910000-0x0000000008986000-memory.dmp

Download

memory/4860-213-0x0000000007D40000-0x0000000007D52000-memory.dmp

Download

memory/4860-12-0x0000000007F00000-0x0000000007F50000-memory.dmp

Download

memory/4860-11-0x0000000007C70000-0x0000000007D02000-memory.dmp

Download

memory/4860-10-0x0000000008360000-0x0000000008906000-memory.dmp

Download

memory/4860-9-0x00000000071F0000-0x0000000007256000-memory.dmp

Download

memory/4860-8-0x0000000005240000-0x0000000005250000-memory.dmp

Download

memory/4860-7-0x0000000006E60000-0x0000000006E6A000-memory.dmp

Download

memory/4860-6-0x00000000072B0000-0x00000000078C8000-memory.dmp

Download

memory/4860-5-0x0000000006B50000-0x0000000006C7E000-memory.dmp

Download

memory/4860-4-0x00000000054A0000-0x00000000054EC000-memory.dmp

Download

memory/4860-3-0x0000000005350000-0x0000000005428000-memory.dmp

Download

memory/4860-157-0x00000000068B0000-0x00000000069B0000-memory.dmp

Download

memory/4860-2-0x0000000005170000-0x00000000051EC000-memory.dmp

Download

memory/4860-0-0x0000000000690000-0x0000000000724000-memory.dmp

Download

memory/4860-1-0x0000000005240000-0x0000000005250000-memory.dmp

Download