5427ccadb45a2d13d73b0b868311f71639f0e5e5d8ea613a235492c53b2752b7

Resubmissions

29/05/2026, 15:14

260529-smrzzaev917

29/05/2026, 14:57

260529-sbqyjafy7r7

29/05/2026, 14:47

260529-r5tqvadw9y7

29/05/2026, 14:34

260529-rxhcvae19l7

Analysis

user interaction
yes
max time kernel
929s
max time network
920s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/05/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fas2lsp.exe
Size 969KB
Sample260529-smrzzaev91
SHA256 5427ccadb45a2d13d73b0b868311f71639f0e5e5d8ea613a235492c53b2752b7
MD5 b11f932a786da9d44ee31abc0f92aa7a
SHA1 6a3881056914da405426b126edb0e66a8a392374
SHA512 05c0295d5400996e1cf83b5873223ee20c698031f562f2705596ad2b294db6efe140ce02b007af8be98a8e46ad8ed75c0d845011ab26a5c89c8e03c9a0ff50e5
SSDEEP 12288:UVF98VgifPrtI+1PCJ4orfzl7//c55tR78PlAYzqiTsv+ck8xSMrdHxP:fgifZfm7z9/055T78Plj24GZSMRx
TLSH
T1A025D081B682C571C0BF0A720531E21DB37414258765EEDFAFC561E83F736C1A93DAAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
6084	fas2lsp.exe
4796	fas2lsp.exe
4704	fas2lsp.exe
6088	fas2lsp.exe
5740	fas2lsp.exe
3252	fas2lsp.exe
6012	fas2lsp.exe
2172	fas2lsp.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
79	api.gofile.io
81	api.gofile.io
146	api.gofile.io
155	api.gofile.io

Enumerates connected drives 3 TTPs 8 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	fas2lsp.exe
File opened (read-only)	\??\D:	fas2lsp.exe
File opened (read-only)	\??\D:	fas2lsp.exe
File opened (read-only)	\??\D:	fas2lsp.exe
File opened (read-only)	\??\D:	fas2lsp.exe
File opened (read-only)	\??\D:	fas2lsp.exe
File opened (read-only)	\??\D:	fas2lsp.exe
File opened (read-only)	\??\D:	fas2lsp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fas2lsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fas2lsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fas2lsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fas2lsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fas2lsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fas2lsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fas2lsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fas2lsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fas2lsp.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2192	chrome.exe
3924	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245413064000887"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	fas2lsp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	fas2lsp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	fas2lsp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	fas2lsp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3"	fas2lsp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	fas2lsp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	fas2lsp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	fas2lsp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	fas2lsp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	fas2lsp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	fas2lsp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	fas2lsp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	fas2lsp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	fas2lsp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	fas2lsp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	fas2lsp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	fas2lsp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	fas2lsp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	fas2lsp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	fas2lsp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	fas2lsp.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	fas2lsp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	fas2lsp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	fas2lsp.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
208	chrome.exe
208	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2504	7zFM.exe
3252	fas2lsp.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4724	fas2lsp.exe
6084	fas2lsp.exe
4796	fas2lsp.exe
4704	fas2lsp.exe
6088	fas2lsp.exe
6088	fas2lsp.exe
6088	fas2lsp.exe
5740	fas2lsp.exe
5740	fas2lsp.exe
5740	fas2lsp.exe
3252	fas2lsp.exe
3252	fas2lsp.exe
3252	fas2lsp.exe
6012	fas2lsp.exe
6012	fas2lsp.exe
6012	fas2lsp.exe
2172	fas2lsp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 3344	4712	chrome.exe	96
PID 4712 wrote to memory of 1964	4712	chrome.exe	97
PID 4712 wrote to memory of 1964	4712	chrome.exe	97
PID 4712 wrote to memory of 2192	4712	chrome.exe	98
PID 4712 wrote to memory of 3348	4712	chrome.exe	99
PID 4712 wrote to memory of 3348	4712	chrome.exe	99
PID 4712 wrote to memory of 5608	4712	chrome.exe	102
PID 4712 wrote to memory of 3592	4712	chrome.exe	101
PID 4712 wrote to memory of 5608	4712	chrome.exe	102
PID 4712 wrote to memory of 3592	4712	chrome.exe	101
PID 4712 wrote to memory of 3936	4712	chrome.exe	103
PID 4712 wrote to memory of 3936	4712	chrome.exe	103
PID 4712 wrote to memory of 8	4712	chrome.exe	105
PID 4712 wrote to memory of 8	4712	chrome.exe	105
PID 4712 wrote to memory of 5364	4712	chrome.exe	107
PID 4712 wrote to memory of 5664	4712	chrome.exe	119
PID 4712 wrote to memory of 3852	4712	chrome.exe	120
PID 4712 wrote to memory of 2436	4712	chrome.exe	121
PID 4712 wrote to memory of 212	4712	chrome.exe	122
PID 4712 wrote to memory of 212	4712	chrome.exe	122
PID 4712 wrote to memory of 2872	4712	chrome.exe	123
PID 4712 wrote to memory of 2872	4712	chrome.exe	123
PID 4712 wrote to memory of 4580	4712	chrome.exe	124
PID 4712 wrote to memory of 4580	4712	chrome.exe	124
PID 4712 wrote to memory of 628	4712	chrome.exe	126
PID 4712 wrote to memory of 5448	4712	chrome.exe	127
PID 4712 wrote to memory of 5448	4712	chrome.exe	127
PID 4712 wrote to memory of 4704	4712	chrome.exe	128
PID 4712 wrote to memory of 4504	4712	chrome.exe	129
PID 4712 wrote to memory of 4504	4712	chrome.exe	129
PID 4712 wrote to memory of 1096	4712	chrome.exe	130
PID 4712 wrote to memory of 208	4712	chrome.exe	131
PID 4712 wrote to memory of 208	4712	chrome.exe	131
PID 4712 wrote to memory of 3748	4712	chrome.exe	132
PID 4712 wrote to memory of 772	4712	chrome.exe	133
PID 4712 wrote to memory of 772	4712	chrome.exe	133
PID 4712 wrote to memory of 2544	4712	chrome.exe	134
PID 4712 wrote to memory of 1792	4712	chrome.exe	135
PID 4712 wrote to memory of 1792	4712	chrome.exe	135
PID 4712 wrote to memory of 1800	4712	chrome.exe	137
PID 4712 wrote to memory of 5932	4712	chrome.exe	138
PID 4712 wrote to memory of 5932	4712	chrome.exe	138
PID 4712 wrote to memory of 4684	4712	chrome.exe	139
PID 4712 wrote to memory of 5800	4712	chrome.exe	140
PID 4712 wrote to memory of 5800	4712	chrome.exe	140
PID 4712 wrote to memory of 2872	4712	chrome.exe	141
PID 4712 wrote to memory of 2600	4712	chrome.exe	142
PID 4712 wrote to memory of 2600	4712	chrome.exe	142
PID 4712 wrote to memory of 2588	4712	chrome.exe	143
PID 4284 wrote to memory of 2880	4284	chrome.exe	167
PID 4284 wrote to memory of 5868	4284	chrome.exe	169
PID 4284 wrote to memory of 5868	4284	chrome.exe	169
PID 4284 wrote to memory of 3924	4284	chrome.exe	170
PID 4284 wrote to memory of 5944	4284	chrome.exe	174
PID 4284 wrote to memory of 5944	4284	chrome.exe	174
PID 4284 wrote to memory of 1276	4284	chrome.exe	172
PID 4284 wrote to memory of 1276	4284	chrome.exe	172
PID 4284 wrote to memory of 2044	4284	chrome.exe	173
PID 4284 wrote to memory of 2044	4284	chrome.exe	173
PID 4284 wrote to memory of 2596	4284	chrome.exe	175
PID 4284 wrote to memory of 2596	4284	chrome.exe	175
PID 4284 wrote to memory of 4040	4284	chrome.exe	177
PID 4284 wrote to memory of 3140	4284	chrome.exe	181
PID 4284 wrote to memory of 3140	4284	chrome.exe	181

C:\Users\Admin\AppData\Local\Temp\fas2lsp.exe
"C:\Users\Admin\AppData\Local\Temp\fas2lsp.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcdbf0c728,0x7ffcdbf0c734,0x7ffcdbf0c740
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,3664434903644423829,17650183438281657369,262144 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,6956815129945647530,5979527923069084205,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,13888588703373246613,7345400755687434107,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,822625333817649478,17103771994251531050,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3448,i,14578622651161818974,14365260649675590013,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,17928114836224069013,17928850279556958878,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:2
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,9152565901227832383,14519525067868893349,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,9422433743109011200,922598360327496768,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4464,i,16427634188024101579,13674974447208858133,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,7212855475888802570,5025272656714016098,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,13464008160207592345,15986681719649469295,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4448,i,533133008566973832,10239799285450625313,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5884,i,13299165689381267711,9270536528348658222,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3708,i,7294729948804279042,13141488031735827173,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,225789676097368500,13420120126139946264,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5616,i,15491878751998941787,14426313404709630045,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4240,i,16167321519635418345,11260945753324805703,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3672,i,3118888005627370807,7031175375991919204,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3952,i,10339970695386562400,10439840492941691019,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3836,i,3114173023002354387,16415808261809745131,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3680,i,8957270349711869062,7181252570117915896,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4740,i,8434245759672115165,5425825692029145926,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,14988692507412103947,12687498489006179080,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5432,i,6073041667514474959,16583596027832472733,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,4892821345846725558,18070795818212862438,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3560,i,18153989756958138965,16777812947880134120,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3952,i,17794447750498023379,17967692122189218561,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=868,i,16822559651584535997,4637703420134387193,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3616,i,14183115350488336606,14228986531872111774,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3104,i,16890058215632467327,14890311049409432987,2097152 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3564,i,1416943273945106455,9470862609891272678,524288 --field-trial-handle=1916,i,16931853943366063785,2003616208791159583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  PID:2588

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3812

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\fas2lsp.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2504

C:\Users\Admin\Desktop\fas2lsp.exe
"C:\Users\Admin\Desktop\fas2lsp.exe" C:\Users\Admin\Desktop\GEO_DEV_LEVEL.fas
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6084

C:\Users\Admin\Desktop\fas2lsp.exe
"C:\Users\Admin\Desktop\fas2lsp.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4796

C:\Users\Admin\Desktop\fas2lsp.exe
"C:\Users\Admin\Desktop\fas2lsp.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4704

C:\Users\Admin\Desktop\fas2lsp.exe
"C:\Users\Admin\Desktop\fas2lsp.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6088

C:\Users\Admin\Desktop\fas2lsp.exe
"C:\Users\Admin\Desktop\fas2lsp.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5740

C:\Users\Admin\Desktop\fas2lsp.exe
"C:\Users\Admin\Desktop\fas2lsp.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3252

C:\Users\Admin\Desktop\fas2lsp.exe
"C:\Users\Admin\Desktop\fas2lsp.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6012

C:\Users\Admin\Desktop\fas2lsp.exe
"C:\Users\Admin\Desktop\fas2lsp.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcdbf0c728,0x7ffcdbf0c734,0x7ffcdbf0c740
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,1156346707539241341,9591832687426825868,262144 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,8893619226106094405,14450498413748458532,524288 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,13889341277163749159,13322390860020003367,524288 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3088,i,16729169493409182810,5873808443237672291,2097152 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3092,i,14984063259761914990,10626216187601123619,2097152 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4520,i,1768802274414232667,13052670616553078263,2097152 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,3132449051716421693,11403587272390258360,524288 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5424,i,17886362989836576676,3351371246607658456,2097152 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5332,i,6772173993652409394,11094063479794021898,2097152 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3260,i,5362380700845026263,6921980833699202713,524288 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3248,i,1360494783957844932,12423911577735664985,524288 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=3268 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3124,i,13134377756374380891,8495914384178694612,524288 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3288,i,10847598030721692529,18201149290496116356,262144 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1296,i,11125658043954493673,8916476093493602670,524288 --field-trial-handle=1964,i,2421243257799353706,6197609184158440927,262144 --variations-seed-version=20260529-010033.350000-production --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:4460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3f940089-75c1-42af-8a97-c1f5f88e115f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3f940089-75c1-42af-8a97-c1f5f88e115f.tmp
Size 115KB
SHA256 1c98f509218f5bfc3d000610e74877b182c00b4629d9745be55e5f2f8e448d1f
MD5 d8615b4e90b80b0022829123ec31c49d
SHA1 34a14a773205208f2ab2af0d68fbfe2f217371b8
SHA512 9c2a2edf779b3633eded02d592d67857b930187a240df1b4fd5d929f9e9ae46afa10d75233690c3d4b5702fc65a42e1add4ca7978aed26f8cb6c02e4521086f0
SSDEEP 3072:hGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:wm7Rkm1tYpBeh2BAo3
TLSH
T14EC312275E71E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 5a8e6ff32f6bb6427cc0998fb314ff95032429cb54b3783865bbb1b06bf3a624
MD5 265e8a637128e13bedd26cb6ea29215a
SHA1 506e234cbc82bb4f90f406f0de318dd61285d40f
SHA512 bd40a74648a5cf88b68bad0eb66885aaf33cc08534b9d26f2fe7ee59d19dd0e4778b4ea0a1c80b6e6a5af14c3c6d0bdde483ecce38be9f60002d94f04ba83a6f
MD5 SHA1 SHA512

Submit Download

9cb475f0-ca58-4b6a-83a4-c68079acaeac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9cb475f0-ca58-4b6a-83a4-c68079acaeac.tmp
Size 12KB
SHA256 d0576b9b94a20d40bc7e15f07c9707f66464d62f3e302a599598746a2a04bcfe
MD5 3c288e31592d8203624b14a1d0b9a144
SHA1 558ab35320d85bdbef4f7b8942df1b6bfa0770cc
SHA512 5007a8f6d260044a7f9ec237d47cd23b38a2465fdd6ebd8547de0ea523a353943ba179d118133b8fb1b89ed91c447acad188cdfa4694dbcbacf433302cfd24c2
SSDEEP 192:kRZJZvt67v71hhAPRp2GlK92Hsb+WNnzA3Qf2n62He88VyIsnAUgraJ:kRZJeDBh8XGQws4262oe
TLSH
T11D42E86FA920697B6CCBD62AFE217757D7F5102221E11E80EAFC8B5C15DB5CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 2a37093e972d688d29a22669f66f365402998ef404fd6c0e0cf5300ca48edf88
MD5 5e799505f7480da6e0e45d59e35065d1
SHA1 a8648a09d1b35266ec78c76240b5832cc7aa6ae5
SHA512 bf4fce237021029b906c2ff62252f550076726f0b1a3f17caf9a3bcabac1fad6834dbccfa79b30e98aefa7c9c6ed19c8f7c7b1e96cf1b950ddca412fa96b0645
TLSH
T1B1F044BAC921AC7B1CFD0B2D60640B4AEB51135B3B80848F3A3C864C8FB563B464685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 38a32e8daeec6b3c1e339e8cba87732c200ac7e6a347da5edab4b173071aee08
MD5 58cbc6f3a4a12056db7eab53ba9d768e
SHA1 9ded1ed434cebe04957db726ca049d1901b1cc70
SHA512 dd56eef1ed89f4756c43df87d976abe6febe47c7cf0b98e463bcc9662d48449512925d3a7a80ec9efc0d1d17a815f685a01a8ca21f4be81b4c6d27190c0cce2c
TLSH
T1BF01551204B3BDB5CF206A34A7C17360FA7636200C1FCE2E63518EB0A71B78C0516F68
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 50ba72a7493ba0533fa1bc052dcb5b2ef8fa5523ec933adc603935c304175458
MD5 b3bcd29391d91c9b690202bf2562ad0a
SHA1 109b10f9e5dd9f355dad3f638c1138dd04393544
SHA512 971e1024d1494f8853eb730581840da6361d52da45794a6a4fd2886d34ad149e37d3821b2b0368d79ca3fa50068c0daa250c8188164102ec12018f5c7258977f
TLSH
T19C01FF11A4B3F1F0CF215A34AB5A3B68E92233780E0ECE2E63514AA6B75345C1942368
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 7e74df03012394d93540389f48772a47ae27426db87fa67a50d355c22a906d48
MD5 43d6610d075f77c63e00c85463185066
SHA1 440463cb4df2fd6def6982f118b9706dc8f00c0c
SHA512 a3436d99fff0b948fc603aa6abb04db56f4453cd92c68c9247df96a5519ec17c5202a8b6138c5e005cb1cd4e097b5170e3f4059d9d79da4e75a831a3c50c09c1
SSDEEP 3:MsEllllkEthXllkl2zE/lO:/M/xT02zx
TLSH
T1EE4402046B821416E6001130406193501370D8100A235B47756205225E866800D00650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 47525d33b99ac657269ffff1a58f53732ae974831b1a00022d11e5ade3405f50
MD5 fc92429c6c0ce838d681dfb0f4804bb0
SHA1 dd519304ad26e15a6ffa4f45ae47ec6bded55762
SHA512 fb5a6a3854c321b826efa306a9663051b84618a23fa400168cc82cd8536f9e8fad641c5e43dbe4cc6ba888c356bbed1181618033a25670faa45ed72ad21f5b52
TLSH
T15281ADF7D3E8866DC91192F4AB156E1FDE6D0924432C3C66C9D4AE0B53E2972D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9eaf666fa3a4343f8e28319efa5efb9ded671a5a096ca294398d397eb5c119b0
MD5 8b53f8fb408891d9d882ec709d515713
SHA1 229f90537ff99fe9c3cae05b43ed4df6e2de41ff
SHA512 efb690495d77f04a2acd49f4deffd427d72da341c24d899206f01ab94dc85c6204c467f80180ae1264eed5484d8a935ff3df58adc2b6c81e53f2b6107e15dd90
TLSH
T1B4819AF7D3E8866DC91192E4AB116E1FDD2D0914532C3C6AC8D9AE0B53E2972D24178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1bbd4cf9526bc417708fda885f04e4c63297fb489837b756949c3698bdda3a83
MD5 01c22929d6c6119f07e71362dfd778e4
SHA1 5b28ce66b483140bd9e0e4be16e70a7521d0dc42
SHA512 46b1f6bb29047bdb4a7e63325a999c628f79c9e803f06d155d99d7a612738f8a3579e34dd9434aa4d322e188b7b6c1f89adfc52f942a606c4736e4834bdb7208
TLSH
T1AE719DF7D3E8866DC91192F4EB116E1FDE6D0924432C3C66C9D4AE0B53E2972D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 523ec966316359105999f787a07e35be940fc693c35a6eda52f33298a78eaa89
MD5 90aeed70c7d8b713f15de96476f032e8
SHA1 0032a4c5742f4e4d589d07cc7d31b8df821f5961
SHA512 7504332b7fbd26a56ade18bf6d369046f3f9e337867b2fe6ee6244dbce215a1c2e48c0fbf1854a905d2c43f3a2110b579ffb3c05cb00e314b2b22695293b68da
SSDEEP 48:YALlqXohXEqsqNhSgsrRsafoKsFXLsDsgmzsmFzsd4sVfsIos17SP+psd/dMsq3a:D8olErseFaldmVFl7SP+U/deK
TLSH
T14E917CF7D3D8866DC91152F4AB116E1FCD290914532C3C6AC8D5AF0B53E2972D24078E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 d6cbbf7233ea24a60c0b812deaaff1306f6875d7c3d0094e74cf76267d2675af
MD5 adb15312f60496d77e79e0c528bf3b78
SHA1 20d30f5b20cf57c85680049337c6a3a0387233f4
SHA512 9dd61bdfa26dbd3a025a4345dbdaedd676dafca7a109e53df2f96c3d339911f04fe7596c7a4ad521591f59a3610c597c411f95d2423d2a37552ed053097fc2ab
TLSH
T1A7213DDBF2FFF85F5168886B1D54780A2879E83212E158E5DE5BC16CA1C64F31B12493
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 df67cb6bf5eef42ee09c118c3ca2100e45c6ea21054227be0dbcb9ee5599d5d9
MD5 319600a466b56ef42072def56a737472
SHA1 3e5712a1f4d140d6d52135561d60e7f1b0bd2993
SHA512 6fe62c8120bc4f48bed7d4c99bb535da5d423397af56688867ac5760dfe60333bca82241f692708bae6b6b79c32be4f8c71d7454a4419185d3dd08f3d97678a8
TLSH
T13331C1DBB6BEF45F11BE086F1D08780A68BAA835068258E4DED7C17CA1CD5F31B16063
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c15ec12c7c0995bd0f141c68e763579b22e2a09f6acad5ef4b24afaca15a0609
MD5 840c9d93db44700571be282d13ae23ec
SHA1 22607cb9768f8af325f3bbfe531356488544e67f
SHA512 2783470727efb935557116090d1abbb6cf779b233242eebbf8d9805b9308ba770008348683af80d09b9d2ea9fb0f7e82cf71c2e6e545088554fa175cdf10553f
SSDEEP 192:kRZJZvtu6v71hpAPRp2g92Hsb+WNnzA0F62He8RVyIsnAUgtaJ:kRZJyWBhUXDQws0Y2H8
TLSH
T1C342D82FA920657B6CDBD62AFE253753D7F5102621E12D80EAFC866C15DB5CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 28ec39c03ec6f710d399954346c0fd8f0d94c35c7df55c12fce8ac16dba7fcae
MD5 b30da9a6e001e549c312b34ef2987af1
SHA1 439088f2a8ff152a0d2c561d17f1e6f34cc5b109
SHA512 2386da6de407bddaafd04791cfba7f7e3eb5a2a318771b761e472f8ad686b4f8a2adc277b63223489f46fda0bb394c4ae7da676a0896ed2afe3a3033876a731c
SSDEEP 192:CRL0ZvtrJv71hVtPRpZGlS92Hsb+WNcpXsYjw/A462He8mVyIsnAUgraJ:CRL0vJBhHXfQwnbYf2ue
TLSH
T1C152D72FA820697B6CD7D629FE257B57D7F5102221E01D80EAFC8B6C15DB6CD222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 37faafd2ee43e847badf35a9119a5a88a2aa2eb1a5f638bf0320ff1b52b34470
MD5 2b33ff333210d1523d907141de1d4b30
SHA1 d4ed6dbe7bed857811a151f192aa1b2c3667a799
SHA512 cc9cf736ed9e64ed11f598d545f6fce6cc556312e6934c50a58de258fbaf0c237f659ebb44fbf0810a408fb16341d1612d7491242d3653cbe063492d75ad20ee
SSDEEP 192:CR80ZvtrUv71hVtPRpZGlS92Hsb+WNcpXsY6J+F62He8mVyIsnAUgraJ:CR80vQBhHXfQwnf+Y2ue
TLSH
T11B52D82FA920697B6CD7D629FE157B53E7F5102221E01D80EAFC8B5C15DB6CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 eed60cb14cd627f80bc5ffef70ca9ed98c5f3cb11dd263588519b5d3553c8003
MD5 8083ff51fc472a315d8e43531f04c35f
SHA1 e735b89e9ff8c8ff77bef71b30e13b8959b9a2a9
SHA512 a1379cd7a41d3c6f96fa4d0fec498237dd010045d47e3d99f39befa207a5ea7aee9077364f8188199a6496b956c65466dbb174ebb02c9895b38e7e8541ecf0a7
SSDEEP 192:kRZJZvt6hv71hhAPRp2g92Hsb+WNnzA0F62He8RVyIsnAUgtaJ:kRZJexBh8XDQws0Y2H8
TLSH
T19142D82FA920657B6CDBD62AFE253753D7F5102221E12D80EAFC8B6C15DB5CD222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 38c3b99176fea544f5435bacffebaedb7819cda12d4113cb3ed894feec3f4e10
MD5 82e63a437c963b7dbd57cade246fdee3
SHA1 5cf856da799849077fc63708914857a49f2fdb17
SHA512 d45aa85e04e34a6bef3ce1c7a0ad784f37485b82ed04eee30c9106f22e076c1daef03aba8312ba83f975425fb12d059d90809f4bffbb30d4980298311f8e61e5
SSDEEP 192:kRL0Zvtt7v71hhtPRpZGlK92Hsb+WNnzA3utYV62He8oVyIsnAUgraJ:kRL0xDBhLX3QwsQYI28e
TLSH
T16D52E96FA920697B6CD7D62AFE257B57D7F5102221E01D80EAFC8B5C15DB5CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a5985063be321fadc5fb2749d5b3b105f99dc62f647227a4bcf0db09acab3566
MD5 ad93eae8765d28dbbb208293dcddf031
SHA1 b522b96430e65c3339195f406936a07c3984c2d3
SHA512 90c49af888e9b1d4d6c16e52cd872a8852df4f4b434b8167623e3dcd55f1b8ad6610c67d8bf2d97fb70981fd6da851762945b34da2e30cc86b312312f04c965d
SSDEEP 192:CR80ZvtrWv71hVtPRpZGlS92Hsb+WNcpXsY6J+F62He8mVyIsnAUgraJ:CR80viBhHXfQwnf+Y2ue
TLSH
T1D252E82FA920697B6CD7D629FE157B53E7F5102221E01D80EAFC8B5C15DB6CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0fcf16d30ce2f2cebd4d8aab7499a469fa8564486c7f72416fa9ee37cbb43c3e
MD5 842276038b9f425c1f2c074e1c04cb44
SHA1 56d918c817c9aaeb950b7440bd078a8fe064922f
SHA512 0594f285ddc177f400126519be86fa0aa184448f6e157d471e7daef45f1975387be57f76a4997e15aec09f741677309e545948db9a3f6be61dc416ab31181515
SSDEEP 192:CR80mvtrUv71hVtPRpZGlS92Hsb+WNcpXsY6J+F62He8mVyIsnAUgraJ:CR80YQBhHXfQwnf+Y2ue
TLSH
T1A352E72FA820697B6CD7D62AFE157B53E7F5102221E01D80EAFC8B5C15DB6CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cc7421c209c1ab09b6063306280a0e8824b9f40dc830c6e08e9f1ed29f340fbc
MD5 b13410f42813e1be4a2839009b89e82b
SHA1 578ef307e1a1bd5ffca465e993536545d772140c
SHA512 f9e3d4bc99387ea2ee2ae3d888673df58ee8d7630305b49dc08b4d11fa507a60b6693e214354518cfddd1cf402eb14019236027e0150b59bcfe1783420f79af3
SSDEEP 192:kRZ5Zvt67v71hhAPRp2GlK92Hsb+WNnzA3xme262He88VyIsnAUgraJ:kRZ5eDBh8XGQwssel2oe
TLSH
T13042D76FA920697B6CCBD62AFE213B53D7F5102221E11D80EAFC8B5C15DB5CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ca1f8d161e17deb65322f151e33c7279481407a4aaca3f39063424eb05072fdc
MD5 ff4f3ea885ba09aa17dd6aa35086cae3
SHA1 6b7a239ca3fcd61cbc2ca6a650480118ab035bb4
SHA512 269d41d9d348f92106004644fda0c800d2def78940dca0857f8a44470e16f7761b0c0a6e0815c61d35d3c04bba935ea23968afeb0f6e07dd47d4be4f62b15374
SSDEEP 192:CR80ZvtrJv71hVtPRpZGlS92Hsb+WNcpXsYjw/A462He8mVyIsnAUgraJ:CR80vJBhHXfQwnbYf2ue
TLSH
T10452D82FA820697B6CD7D629FE257B53D7F5102221E01D80EAFC8B6C15DB6CD222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c73641d03ea8dc616d1515278b89f5e40d090b5cfc6cef6b3ae8c748fc871c42
MD5 4808f5cc629195c88973abddf7f7c1f3
SHA1 d70dd2e69d20ba961b4376afca91204b5b1af2f2
SHA512 cc9ff456a56c74b93f9e66fbd26f8deeddf9c8018f5fd696e4d5ec8131c22ec741170c4a4d4c309bb205c3697c36c656765e4f1448f51c4553b27f185b4e1d8a
TLSH
T152B01230C0415511C09A02B81556599872145F20970A2B0543E06D63C83D2A1C014190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589b70.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589b70.TMP
Size 96B
SHA256 4848f62791671c5cbccf8e9a63efc6d7ee8d9ee5a3d03d84da8800f6598f9f06
MD5 086b9a9973c8ea8827e4c575afe699f6
SHA1 04e1fa3e692182616827a8ac0db2980c3addb999
SHA512 af36b20fa54123bf20fd90463e136409d6fa0a36756419b2e07b914bbd85068dfdaa94471a846aae77cce00a4fe10c17d4a8f025a19df608da34bf039b48a9ba
TLSH
T139B02280C8023202C00A03B020808BE83020EF20C303022282EE0AA2CC30AB00A28022
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 81e744afd720a07fd6d33f19d67c64bf59e7803f3d8ca2a39d453073edcf3401
MD5 b20facffbfaed4b09603ed033eb8e951
SHA1 2d08601aa6dc5ead6aed13a5c7a02f6a04a78ef7
SHA512 ee08f565423f05e0a9156a2d08475d4aa32c28f134c3df909c017c53a55a2a50bc85b938e01909593b3b9948389558a09d71ab11b5f884a5a2de11a3f7fb43e8
SSDEEP 6144:wOv6dCdmiY+/L+myd+DGDrOm7Rkm1tYpBeh2BAo3:ZvVmit1G+qXJ9oBGcAo3
TLSH
T16F3423272D6A7B3359F4935B600F2B5A1CB19F97C918B6E5A41C5B0872DF2C89E07C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 e033f82b323ed68a682f7cad3fddc1b9eecc69ba395630ffb06102dee6e9d18e
MD5 e6308efe61da9900f40b3a38994cc9f8
SHA1 450c70a8551d3cb55f338c7d5e4a25cd838a12bb
SHA512 67614870662f2873ea2d36a0c72fe8296840224e7c44e81dcc6100003776546e552684e727bdc68d861a5cb3853149bd34132ae78e45e9a3e93b0ad7c4f879c1
SSDEEP 6144:3Ov6dCdmiY+/L+myd+DGDrOm7Rkm1tYpBeh2BAo3:evVmit1G+qXJ9oBGcAo3
TLSH
T1C03423272D6A7B3359F4935B600F2B5A1CB19F97C918B6E5A41C5B0872DF2C89E07C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 37fc3e4ad07b36619ec294bd7729f78e812abcc9b1917af59197df03a33d0d73
MD5 ad838afedb49529fd0f3fc0a1efb03a2
SHA1 fd93020ed50aa8cd691cf314ea2583acd6e17bbf
SHA512 e3644b38d4669cb6cf942bcbafb2410fff6d7cb39e4f72ed6548b991ce84a009220a875390d18651aabad10c4ee56200f71e99289aa99cc529767eb2e225e528
SSDEEP 3072:omMAgV8pqov61TzLb2d98iYNud+uL+my+eTSPYP+DG7tF1JU:BMOv6dCdmiY+/L+myd+DGDrU
TLSH
T1C2C301BA681B2B539AF0835A940E77925C75FF9B8A0C75E8B51C2B09A0CF184DF17C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 288KB
SHA256 58422b4572d0dccebb11cb719633665cd44d3e2a5524dd77251e6ed68ed5d836
MD5 2a90be281a40d363189e329cff47e3eb
SHA1 ead23816216038fc4be6a475571b9d309f75f851
SHA512 ff232123636dc9b53e154f57bc554da0c014b88b4958ee03fcbf9b0a87c74979b7039322e81b87b6db64e2364547afc9c1f78cd6d9dcc4332efedb778991271e
SSDEEP 6144:2w7cYgXiHeY8CrOv6dCdmiY+/L+myd+DGDrOm7Rkm1tYpBeh2BAo3:2c98TvVmit1G+qXJ9oBGcAo3
TLSH
T1885423776C36BA7755F4231AB04E2F0A1CB1AFD78908B5E495185B08B2DE7C49E07E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 324KB
SHA256 47a28de0bf48e0354fc81a24255084d246dd9126912fff62af6674f1f36c2748
MD5 77aa8354eebb483419c52722da7205dd
SHA1 9d540bf77f95b8eabd12688c8f09316e2b7d7b8a
SHA512 eba4126b50dc1c36fefa43c3dfd74f6ae4b5704467042ec4004fadc9aa8835dc64677de20a1d5a822070817dc0a59159d2049fa57097e9cd53aa779708f19c78
SSDEEP 6144:2w7cYgXiHeY8CtyJOv6dCdmiY+/L+myd+DGDrOm7Rkm1tYpBeh2BAo3:2c98oyovVmit1G+qXJ9oBGcAo3
TLSH
T16E6423772C66AA7758F8231A704D3F0A5CB19FC78908B6E8D9545B08B39E2C8DE47D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 212KB
SHA256 79da705bbb6fc6187ef5a033b4a12bc08d9537c00cc09ce186169094c5fc2732
MD5 5fc8f3e3e7979e9444531ab8798219bf
SHA1 64dbefcc702381c5ef779d4e1fda8f1f1743db68
SHA512 059aa51fa0b9779e60e3efc121417d4df8dd19531ee6e4b20b01bc1c6ea55d8dd439905a8696b2959762d99d3c8fd5ed455cdbd590bc928cf208008f85a1987c
SSDEEP 6144:ew7cYgXiHeY8CtydOv6dCdmiY+/L+myd+DGDrU:ec98oy8vVmit1G+qXU
TLSH
T1452422D6285B6A6764E8131AB40D3F468C74AFCB4A0872FCE6145B8AF18F1C4EE53D35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 f009706d85658d0ddd2e20655923442fabf4ea477d69bb514849d2f3ed84f8e8
MD5 7b808b79d7845a519c3832dfd514939f
SHA1 3e7da49b04d0c8e4617cc6f6cf07cfb4a577a85b
SHA512 36dff3ef0120e91df0bb73aab1c8860557d335c0b5c2baf70480f08983ba94620c946bacd5e1f8db2117ceb2be22eaefbfd950d460d41e78d45a344791e5306b
SSDEEP 3:MsEllllkEthXllkl2zE/lzQ+l:/M/xT02z
TLSH
T14E4404047FC31417C50111304051D3D01371D51017135F47355104735FC77404C40300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

BD_DEV_INFO.fas

Path C:\Users\Admin\Desktop\BD_DEV_INFO.fas
Size 4KB
SHA256 ba323609e5152d418009c4786be96d66c591074d9e52af96a3dedefa539f65d4
MD5 4fb262cb7b70e3ba26b31cdcfbe350be
SHA1 d60743a5732de52792e6364e721919ce8328eca5
SHA512 cbd530ffd6c22c6e34b8db4867f0c72fe0822c8811ecd9ae7fc83e7439bc2c2acb2791fa7a1fe9d686629bb5df5e5ca064cfacbf743a715ed24f959ab75676bb
SSDEEP 96:4Rp5g5oKfmB+roqZqcxbdNg4r+mZyaSkk:c50obBrYQ2+kk
TLSH
T13C9164BC80BA40209EB47D5D34AC57348CC97D4F6D2CBFE372A692A315D409368EA399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BD_GET_STRING.fas

Path C:\Users\Admin\Desktop\BD_GET_STRING.fas
Size 3KB
SHA256 6ff514bf8bfd8c6b35c8e01c8550e9c93453c852ec506bad5abf511c0c2bcec7
MD5 c768abd9066f8ddc1e4b7a0a814ceb51
SHA1 83d1771e27515d7eb1a6fc77ea2ddd6a0f49e42f
SHA512 1173b1d7310a91f3312c0d3016aa9bc9183a1a3e0a3d19b7f14f492481375d6ef57670d2c03c21e0723515c03a4ba7c8a5b28668a90e8ae5900db90536b62ae7
TLSH
T16D61E90DE48D6EE308D5184CEA87012348C5BDD34DCEFF563F8ABC12D68992E07565AB
MD5 SHA1 SHA512 TLSH

Submit Download

GEO_DEV_AUDIT.fas

Path C:\Users\Admin\Desktop\GEO_DEV_AUDIT.fas
Size 10KB
SHA256 fc3a926e561e409063a1e4499099c4bf14c2c4b5ec353473fc695436214a3e92
MD5 5ee6e967ad8c76c485b9c9ca57867af0
SHA1 123791c2fc5e3e54a9569bf76f1f1ed3146683ce
SHA512 53b723097b6bf6c658cca9e83e7331f3a9a3ae29915fd8297ad18645f4784a19658bb9022a0c29d4a00160642724a15ba5b1686de8f093620d4cc55bd87ad132
SSDEEP 192:XPtduomhk0AgqqNZ17qXUMKl51QPvDiABYws44AIAkoa0Vz0UBakXI4:XPp6tTLQnDiAfd1v0U4n4
TLSH
T109221A1DFA784832C7F8822BB54F033524D8BC15546C3FD6BBDE35EF66C418A286A546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GEO_DEV_AUDIT_new.fas

Path C:\Users\Admin\Desktop\GEO_DEV_AUDIT_new.fas
Size 10KB
SHA256 5eb746b5b5271dde2c90456eece08b29419ddc420224ab6907fcab13be306e32
MD5 8c812b9051b118574d8b1e9217659e2a
SHA1 616a1e33c5a403696867a6fb2a08dda685f65fc2
SHA512 7e94f02b895d869fbb9d68580584adbcfb1e4f6a46eb5ba2ed27196800bf1f4e94b5f8ffc775116cdb5e2af5c5946c18cd0fbbb2c802634156ccbf7367fecb87
SSDEEP 192:XPtduomhk0AgqqNZ17qXUMKl51QPvDiAMmVwWk8uwu9Fj9fIfCOO:XPp6tTLQnDiAxVswuOfjO
TLSH
T12A22B61EF2349D31CBE88766A44B073624D8BA06ACAC7FD7F2E5B1D65DC40CA146B506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fas2lsp.exe

Path C:\Users\Admin\Desktop\fas2lsp.exe
Size 969KB
SHA256 5427ccadb45a2d13d73b0b868311f71639f0e5e5d8ea613a235492c53b2752b7
MD5 b11f932a786da9d44ee31abc0f92aa7a
SHA1 6a3881056914da405426b126edb0e66a8a392374
SHA512 05c0295d5400996e1cf83b5873223ee20c698031f562f2705596ad2b294db6efe140ce02b007af8be98a8e46ad8ed75c0d845011ab26a5c89c8e03c9a0ff50e5
SSDEEP 12288:UVF98VgifPrtI+1PCJ4orfzl7//c55tR78PlAYzqiTsv+ck8xSMrdHxP:fgifZfm7z9/055T78Plj24GZSMRx
TLSH
T1A025D081B682C571C0BF0A720531E21DB37414258765EEDFAFC561E83F736C1A93DAAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GEO_DEV_DIM.fas.crdownload

Path C:\Users\Admin\Downloads\GEO_DEV_DIM.fas.crdownload
Size 35KB
SHA256 dd7d05edcf3a780385d332609780218bfbb530121d63ecc9d92071996ea92b66
MD5 c485615e865a86efdef5da132bb357c9
SHA1 72f7f3e76771724951913dce35e751c23fb7afcc
SHA512 97539d7fff8928020e9f17d8b1eade15f6c0f8d2c17411e279d0f8fbef7484a5ef310531c0f34e84f14021bc391f64b4b292cdfa34daaaec9893150bbd9bf7f9
SSDEEP 768:1EF5yHezyLeqXcWX5VYoYfVQ0YK6HUnedxHacGrX78z:u+XX5VYDtBR6HhMnrAz
TLSH
T129F2E5637B650231D862991F70FF272F12C16C09381CCF66A35BB9AA71D4BE47C8359A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GEO_DEV_FUN.fas.crdownload

Path C:\Users\Admin\Downloads\GEO_DEV_FUN.fas.crdownload
Size 20KB
SHA256 1e30a6eb70619a08706d6d046324da8c2c47727d2ee6a89e557e8ec0db016e1e
MD5 572a28b9ec17b040a95742d8b2eb1fb1
SHA1 9a01aca5c4b810e105c6da58874c2093cb2d8245
SHA512 e1f5f8b76161fdfa23c9fd25b9fe6532db08133f376825d4bb398089e511491723c7670df9ee0daf132262bfaa1bb4b8334abbc5852fe2ed44c31627a3248904
SSDEEP 384:YcbBzZcb8ewmt7LN61lN5Y+eTV8Z/Ccs1296i8bNrpVzf3+oP5cUFV:YcbxZcb8ewmt7Lwp5YzV8Ziw96vbPNn
TLSH
T1CE92F8E6B7731524E0E6127A74EB373A09C0BE06144CEFA5B39728A769D48C53CB3647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GEO_DEV_LEVEL.fas

Path C:\Users\Admin\Downloads\GEO_DEV_LEVEL.fas
Size 33KB
SHA256 14a0eb14601d72547694e17a8e3a646fbbf2c60df1aaf8b6c73c06a928bd1094
MD5 7133b84f491633c80125129c7babbaf3
SHA1 61bcc116468d9d6f5f31fc78321bd5dd158a0a59
SHA512 135bd3c427da7ea8f8524a866d993014ffe32e28a7f4c09b4cbd7ab68446d42572e092b0e086b73db332bee52e149d3ea44491d2b38e3cc6c2a1834b99bf093a
SSDEEP 768:yUVT/R6LjvYSP6G07nnIpRdatu9UM46zJ/R/dy75D:DY6GannIpRM5Mpv/dU
TLSH
T1D0E228667B615671E0B2491770EB1B3E09C08C9915ADCFC8F2EB718678E4BC2BC1760B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GEO_DEV_POINT.fas.crdownload

Path C:\Users\Admin\Downloads\GEO_DEV_POINT.fas.crdownload
Size 47KB
SHA256 0f08655b455cdf17c0559df3a88f3d3d1bdba2383b1b0f6657df1d3ef2c9f276
MD5 fe7a5873e1f4f25d77abe80136905419
SHA1 506547674d3594ec4f6e10f73f7a8a8657be615c
SHA512 1dc54bd9b8b84fe93d3c38df868f2fd59dbc4f3c9cd0d3adec6ebecef6540ec97d23c821c98828ffa1ab2d204444d7c6e773e4a80ddeaacd4e99b8bd7c995afb
SSDEEP 768:x5zzG7YnbTUWzcH/Yv7RYv36wYv7RYJPZ4edcXYPNoR6/CV1lr31QAtKhk9NWV9Y:x5e7YnbTUWzqeK/6XNR6/KHrG84krWVC
TLSH
T1C5233A637255093081168907F1FF8F7F12C16F4A251CEF84B35AB6A635C67CA3D62A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GEO_DEV_VERT.fas.crdownload

Path C:\Users\Admin\Downloads\GEO_DEV_VERT.fas.crdownload
Size 48KB
SHA256 06f33872a6fbe7a18b9bcbf8340c193a6bc21bcd2a20951d737f3fbb8d98ce38
MD5 41c75eeda5d1624900bbd6ba0f427af3
SHA1 234f255ce68c85643754e29b323609ab7b0de6f5
SHA512 ca2e4777dd6dc19142035d961cdc35fdf149357a8f339e9e9e2b7fda7dfe9200aa6070b74376f1ba7588de073fd084b05d727e467cb9883b6fa06c8cf6d68304
SSDEEP 1536:k8hjYedVLwiuKJ2nchnaRhCm39m1/RKQMuts2zfYUtH9f:pwXKJ2nchnaRIi9+/R7tlLF
TLSH
T11623F762BFB0107442524946F2FFBB3815C19D06290ECF81E36A75A5A8E1AC53F935EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fas2lsp.rar.crdownload

Path C:\Users\Admin\Downloads\fas2lsp.rar.crdownload
Size 533KB
SHA256 0f85999ec6396aee4a1355b60caa1dc6e9adba1e46915d7bbd53ce28e2906f1d
MD5 241cec2b4a2d676949e71238b728d9a3
SHA1 5504de838714c227e0fcf8eb0215f4cea48948f7
SHA512 f3d9fd643cb49af96fec9ee2512137ca587553d895f3ec69803ab02b89132151dae4249f158051cb96975f3c028bb7cd25b20a97ad1475bee45b19f0871f1625
SSDEEP 12288:nd47RCi47+szq23e+DOqyXyQd1TV9ByBqDmzfRYbm:d4dx4m+GXyQLTz7mz5
TLSH
T143C4234833333E259CC2E0059A6F4B971566BA60FCB51C8978752C32914ADE39B2DB7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vfl.set

Path \??\c:\vfl.set
Size 100KB
SHA256 6d78d30c6f099c1029ae940126b719fde4492ce56a590318e0261986c409c811
MD5 b9abfcb03b0d49fcdd5b6a4cbe29e3ae
SHA1 2ed2b8ee40220bdf314597c0a6164bae5cb14142
SHA512 d87acf5ee134ce0e0646b13e7c630107608f4be87da20b930ef9b7ebfccffa90dbb10c115a9e707a7f1ad6c64f0a5601f08e9f14dfcebe0e5183f6aecfa54f37
SSDEEP 1536:NpKUcDRqAhVFeNftAdW+AMdd7oh4chHchTDK9BhmymBF6XGyYRV:bjiUwVFGtHMdi8yMAWtV
TLSH
T152A3C6CC6585DE66C47E89370970560903F9193E9382F69C2FE7A6F82F73681890CDB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2172-415-0x0000000000400000-0x0000000000B45000-memory.dmp

Download

memory/3252-403-0x0000000000400000-0x0000000000B45000-memory.dmp

Download

memory/4704-384-0x0000000000400000-0x0000000000B45000-memory.dmp

Download

memory/4724-1-0x0000000000400000-0x0000000000B45000-memory.dmp

Download

memory/4724-42-0x0000000000400000-0x0000000000B45000-memory.dmp

Download

memory/4796-378-0x0000000000400000-0x0000000000B45000-memory.dmp

Download

memory/5740-394-0x0000000000400000-0x0000000000B45000-memory.dmp

Download

memory/5740-397-0x0000000000400000-0x0000000000B45000-memory.dmp

Download

memory/6012-409-0x0000000000400000-0x0000000000B45000-memory.dmp

Download

memory/6084-369-0x0000000000400000-0x0000000000B45000-memory.dmp

Download

memory/6084-372-0x0000000000400000-0x0000000000B45000-memory.dmp

Download

memory/6088-390-0x0000000000400000-0x0000000000B45000-memory.dmp

Download