3cacdbc8f4ee587340e0033cd3859b9f08cab4db3742b3e271ce4c941eeb7895

Analysis

user interaction
yes
max time kernel
689s
max time network
687s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/07/2026, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
helloworld.py
Size 16B
Sample260701-j39ehsby6v
SHA256 3cacdbc8f4ee587340e0033cd3859b9f08cab4db3742b3e271ce4c941eeb7895
MD5 78fd49a81753bac0140b51c87ca9d9eb
SHA1 ab407a7c9a863c7a746e10669b8520156d5c70d2
SHA512 b4e1d4a90f8436c047cc99debc89f32f87c6b4759ae420ada9ec68eae1118f0a5f9471efc2c31b32db562c2ea33094c13e3373a3cb32b5e1f41c224919ed8b65
MD5 SHA1 SHA512

Score

10^/10

credential_access discovery persistence ransomware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 30 IoCs

description	pid	Process	procid_target
PID 2248 created 2948	2248	Bonzify_Exe_Download.exe	89
PID 2248 created 2036	2248	Bonzify_Exe_Download.exe	91
PID 2248 created 2680	2248	Bonzify_Exe_Download.exe	92
PID 2248 created 4396	2248	Bonzify_Exe_Download.exe	93
PID 2248 created 1944	2248	Bonzify_Exe_Download.exe	94
PID 2248 created 2084	2248	Bonzify_Exe_Download.exe	99
PID 2248 created 3924	2248	Bonzify_Exe_Download.exe	105
PID 2248 created 1236	2248	Bonzify_Exe_Download.exe	117
PID 2248 created 3472	2248	Bonzify_Exe_Download.exe	118
PID 2248 created 2300	2248	Bonzify_Exe_Download.exe	119
PID 2248 created 3496	2248	Bonzify_Exe_Download.exe	120
PID 2248 created 4716	2248	Bonzify_Exe_Download.exe	121
PID 2248 created 1784	2248	Bonzify_Exe_Download.exe	123
PID 2248 created 1840	2248	Bonzify_Exe_Download.exe	124
PID 2248 created 2948	2248	Bonzify_Exe_Download.exe	89
PID 2248 created 2948	2248	Bonzify_Exe_Download.exe	89
PID 2248 created 2680	2248	Bonzify_Exe_Download.exe	92
PID 2248 created 2680	2248	Bonzify_Exe_Download.exe	92
PID 2248 created 5720	2248	Bonzify_Exe_Download.exe	131
PID 2248 created 5508	2248	Bonzify_Exe_Download.exe	132
PID 2248 created 5364	2248	Bonzify_Exe_Download.exe	133
PID 2248 created 6112	2248	Bonzify_Exe_Download.exe	134
PID 2248 created 4148	2248	Bonzify_Exe_Download.exe	135
PID 2248 created 6008	2248	Bonzify_Exe_Download.exe	138
PID 2248 created 5796	2248	Bonzify_Exe_Download.exe	139
PID 2248 created 4912	2248	Bonzify_Exe_Download.exe	140
PID 2248 created 5720	2248	Bonzify_Exe_Download.exe	131
PID 2248 created 5720	2248	Bonzify_Exe_Download.exe	131
PID 2248 created 5364	2248	Bonzify_Exe_Download.exe	133
PID 2248 created 5364	2248	Bonzify_Exe_Download.exe	133

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
2248	Bonzify_Exe_Download.exe
5456	Bonzify_Exe_Download.exe
4616	Bonzify_Exe_Download.exe
6340	Bonzify_Exe_Download.exe
6540	Bonzify_Exe_Download.exe
5540	Bonzify_Exe_Download.exe
6840	Bonzify_Exe_Download.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2680	chrome.exe
5364	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Bonzify_Exe_Download.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Bonzify_Exe_Download.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273672138786293"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{E60E2046-4B4A-4269-B945-2B4665889534}	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{5D64F12B-8F8D-4350-8F66-297CCA86B806}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
7152	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2080	chrome.exe
2080	chrome.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
5456	Bonzify_Exe_Download.exe
5456	Bonzify_Exe_Download.exe
5456	Bonzify_Exe_Download.exe
5456	Bonzify_Exe_Download.exe
5456	Bonzify_Exe_Download.exe
5456	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
4616	Bonzify_Exe_Download.exe
4616	Bonzify_Exe_Download.exe
4616	Bonzify_Exe_Download.exe
4616	Bonzify_Exe_Download.exe
4616	Bonzify_Exe_Download.exe
4616	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
6340	Bonzify_Exe_Download.exe
6340	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
6340	Bonzify_Exe_Download.exe
6340	Bonzify_Exe_Download.exe
6340	Bonzify_Exe_Download.exe
6340	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2248	Bonzify_Exe_Download.exe
2996	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
408	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2036	2948	chrome.exe	91
PID 2948 wrote to memory of 2680	2948	chrome.exe	92
PID 2948 wrote to memory of 1944	2948	chrome.exe	94
PID 2948 wrote to memory of 1944	2948	chrome.exe	94
PID 2948 wrote to memory of 4396	2948	chrome.exe	93
PID 2948 wrote to memory of 4396	2948	chrome.exe	93
PID 2948 wrote to memory of 3816	2948	chrome.exe	96
PID 2948 wrote to memory of 3816	2948	chrome.exe	96
PID 2948 wrote to memory of 1964	2948	chrome.exe	97
PID 2948 wrote to memory of 1964	2948	chrome.exe	97
PID 2948 wrote to memory of 4720	2948	chrome.exe	98
PID 2948 wrote to memory of 4720	2948	chrome.exe	98
PID 2948 wrote to memory of 2084	2948	chrome.exe	99
PID 2948 wrote to memory of 2084	2948	chrome.exe	99
PID 2948 wrote to memory of 2160	2948	chrome.exe	100
PID 2948 wrote to memory of 2160	2948	chrome.exe	100
PID 2948 wrote to memory of 2968	2948	chrome.exe	101
PID 2948 wrote to memory of 2968	2948	chrome.exe	101
PID 2948 wrote to memory of 3992	2948	chrome.exe	102
PID 2948 wrote to memory of 3924	2948	chrome.exe	105
PID 2948 wrote to memory of 3924	2948	chrome.exe	105
PID 2948 wrote to memory of 1168	2948	chrome.exe	107
PID 2948 wrote to memory of 1168	2948	chrome.exe	107
PID 2948 wrote to memory of 4800	2948	chrome.exe	114
PID 2948 wrote to memory of 1260	2948	chrome.exe	115
PID 2948 wrote to memory of 4836	2948	chrome.exe	116
PID 2948 wrote to memory of 1236	2948	chrome.exe	117
PID 2948 wrote to memory of 1236	2948	chrome.exe	117
PID 2948 wrote to memory of 3472	2948	chrome.exe	118
PID 2948 wrote to memory of 3472	2948	chrome.exe	118
PID 2948 wrote to memory of 2300	2948	chrome.exe	119
PID 2948 wrote to memory of 2300	2948	chrome.exe	119
PID 2948 wrote to memory of 3496	2948	chrome.exe	120
PID 2948 wrote to memory of 4716	2948	chrome.exe	121
PID 2948 wrote to memory of 3496	2948	chrome.exe	120
PID 2948 wrote to memory of 4128	2948	chrome.exe	122
PID 2948 wrote to memory of 4128	2948	chrome.exe	122
PID 2948 wrote to memory of 1784	2948	chrome.exe	123
PID 2948 wrote to memory of 1784	2948	chrome.exe	123
PID 2948 wrote to memory of 1840	2948	chrome.exe	124
PID 2948 wrote to memory of 1840	2948	chrome.exe	124
PID 2948 wrote to memory of 3568	2948	chrome.exe	125
PID 2948 wrote to memory of 2080	2948	chrome.exe	126
PID 2248 wrote to memory of 5620	2248	Bonzify_Exe_Download.exe	130
PID 5620 wrote to memory of 5720	5620	msedge.exe	131
PID 5720 wrote to memory of 5508	5720	msedge.exe	132
PID 5720 wrote to memory of 5364	5720	msedge.exe	133
PID 5720 wrote to memory of 6112	5720	msedge.exe	134
PID 5720 wrote to memory of 6112	5720	msedge.exe	134
PID 5720 wrote to memory of 6112	5720	msedge.exe	134
PID 5720 wrote to memory of 4148	5720	msedge.exe	135
PID 5720 wrote to memory of 4148	5720	msedge.exe	135
PID 5720 wrote to memory of 676	5720	msedge.exe	137
PID 5720 wrote to memory of 6008	5720	msedge.exe	138
PID 5720 wrote to memory of 676	5720	msedge.exe	137
PID 5720 wrote to memory of 676	5720	msedge.exe	137
PID 5720 wrote to memory of 6008	5720	msedge.exe	138
PID 5720 wrote to memory of 6008	5720	msedge.exe	138
PID 5720 wrote to memory of 5796	5720	msedge.exe	139
PID 5720 wrote to memory of 4912	5720	msedge.exe	140
PID 5720 wrote to memory of 5796	5720	msedge.exe	139
PID 5720 wrote to memory of 5796	5720	msedge.exe	139
PID 5720 wrote to memory of 4912	5720	msedge.exe	140
PID 5720 wrote to memory of 4912	5720	msedge.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\helloworld.py
1⤵
- Modifies registry class
PID:4820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffc4fe3c728,0x7ffc4fe3c734,0x7ffc4fe3c740
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1636,i,6796048248867109366,14157677536741155447,524288 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,3432112621992426099,10117105128417782812,262144 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,3423355898990304230,9042979216129075849,524288 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,3753029423616787897,1047892200811379927,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,9879728326137721117,5429961245735922292,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3964,i,12771841737420891860,11721010970442679598,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,937251926257753571,17152870466283628594,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,7054103591839943268,8948332043355451388,524288 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,7358033122245703952,3692680995111509957,524288 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,3456963225916393340,5550883822996771554,524288 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5816,i,3663781681716060453,17081294533944729985,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3420,i,2506573171018485677,2116413019459118471,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,9465623074428972024,412374027585839182,524288 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3440,i,11296648105326597460,6336311329178480638,524288 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,2541103745870263319,11572553204458371611,524288 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4504,i,6040599634583711813,9159604832177679347,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3444,i,6425649989823591278,17768471643513970,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3436,i,6196287323698696363,11463722633715550808,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,9027608241181370816,10463069913968549447,524288 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,14895928507693867370,453392949799450580,524288 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6184,i,6348028977607877550,15933834278554014087,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6372,i,3139147072500917444,9080262367663849814,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6208,i,1129997855273065642,2604788297823936166,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6752,i,3594743583030533542,14816749807588927320,524288 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6180,i,16087362449534537733,4213315632653583958,262144 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3148,i,11088387904175791228,4673985932996723351,524288 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:7100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7028,i,5001186819796410114,5316458846456606561,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:6868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7260,i,4512801516468178253,13798632329629695686,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:6700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7192,i,16811739266239247458,17692426784546536019,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7220,i,11648135174944899770,14256854148231271367,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7300,i,5936820660007083063,14008496666471277306,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7376,i,12699801885665398008,17451302116180154458,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7304,i,388944109410651550,3608202002185196189,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7644 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7096,i,10623137256389188996,3833872728475231934,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7316,i,13265608476426091999,8033794402207286309,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7356,i,5928477440195722049,13679784584494591524,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:6964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7796,i,2337795488105888494,3739953934995757038,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7936 /prefetch:1
  2⤵
  PID:7084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6332,i,9698185851214057758,2156452194932474165,2097152 --field-trial-handle=2088,i,3111312877561719016,3482393188740452336,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:6476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4816

C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe
"C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu --edge-skip-compat-layer-relaunch about:blank
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ffc49d3c188,0x7ffc49d3c194,0x7ffc49d3c1a0
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,8586000026957497952,15870636916312002008,524288 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
      4⤵
      System Time Discovery
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1696,i,18015053586151325869,7417576876485279121,262144 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,16819601999337081094,8018546321908622063,524288 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,14185195818696649981,16309964121540702317,2097152 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,13463727556115911842,15791753665951274997,2097152 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,17781786840562555768,1049778816887846802,2097152 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,10373342466796453065,359970869905186174,2097152 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,1255315993770098996,5685142194643995216,524288 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
      4⤵
      PID:5572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,17656531466207055818,4706438371648885997,524288 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,9989118392621840560,2762634308881976576,524288 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,2385789802788383675,9001290088937651369,524288 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3123464530330268953,4207826930291708388,524288 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3123464530330268953,4207826930291708388,524288 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
      4⤵
      PID:6720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,15480451524629989653,8155803961139277978,524288 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,9906749085423535530,6141808816272657753,524288 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,15368678353602191643,11959513530549935314,524288 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
      4⤵
      PID:6848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,11515750659961417294,11271704131684652205,524288 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,16360986716195447201,13535443277863275529,524288 --field-trial-handle=2304,i,10657424129569378746,18434321797061217258,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
      4⤵
      PID:6524

C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe
"C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1720

C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe
"C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4616

C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe
"C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6340

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Bonzify_Exe_Download\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:7152

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2996

C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe
"C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6540

C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe
"C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5540

C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe
"C:\Users\Admin\Downloads\Bonzify_Exe_Download\Bonzify_Exe_Download.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f885e20eb80b160b3a068dd8ad804c2b6c1250ff427c3873b1ecf79a12465689
MD5 55e271987b9eca66a364cdcafd69bdd8
SHA1 a81b393533c66211c3ea569388bd8c55e9e157c4
SHA512 c37e249638d7fa557187330d0d4b52235d17b85b1ad70347ad7db15daad9fa51a4ddde92bc826132bc6f05ade0d01aadba9d1936dbdc87d496fc87ea661f30f9
TLSH
T199E02BE6C821DD270DFD1B1960A08A52EB5123671B408D1F3B3CD1088FB673A4A9681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 21KB
SHA256 abe68a2d6d6e808ce07fb5c2dd0d3b0b33fa562c00e7d034d98a727933d37868
MD5 b2f34e72fa18b6333aeabff2d5ec2b89
SHA1 e5f0510ec55de37eced78d80313ad6c5092e89d0
SHA512 952b8fbefd14c5ebbc64233dbb2387894eae1a994d4769e701e6b7cab2b78217aa8709770be46bfa68267236f4ec53cc419a1fcacaee18de220245dca2add93d
SSDEEP 384:IFXKehyxzB3h60aoRdZNQtJw2tWKjWxyoQO9/CcRb0D3a8nnkqkole7DRmSg:qnUzBx60aoR9QtPjsI2eD3a2nLNwRm7
TLSH
T177A2E181F5B2618130C7FE9C9DCABF09C059CF36E91574BA286B6B71F99114058C3F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 374KB
SHA256 9e58eef4c759e0f11538b7483cf06db0eee77e2f759477f430c0a0336baa7e5c
MD5 26636c6b0f19d3f091c8f9eaf16988a6
SHA1 301472ed6eb13e36e86ce7a9c30ca1158b1ff632
SHA512 b9377375bc95d52ec1615f5d87694ac9a7b9d19099630410ef159823fc8a31e2d6ebb8fa6242dfad2e8a0df673616604d0812d0574be8e0bb281935a1f3996d3
SSDEEP 6144:2MWU4MrvT1tBu/ARRfkKGM32RzlqKs/LXaMhXrO7ugO1KeiTxttKWK:BWYrvT1tBu/4GKNgRqKs/LqMhbO7j7er
TLSH
T13A8423DDA074E58D2A056560AB2DAF05B1FB435ACDD8A390CAF1BCB0FDC80F6E55842D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 f010c64648198720d493e5cd4278fc6e87caf3838fd8fb707fce4df3c17711a2
MD5 e055441a3a52b739c5058ae58d10eb99
SHA1 9b4534c33304cb42386ad9cdc5f99fa0582cb509
SHA512 bc5ee3db15b3c56e2eae99e97f4228f0889a926aa7b46cb0dc4e615173a7e3c3be2eb60289b2b64fd53be6186643720f2d77510fe86aae98c65dc26b93272297
TLSH
T18DF0DFFE70850002CBE0227534B21B9EA12D44386029723A9438EF556453EBD5A698A6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4f3f9503fafc9090224ed2f5ad81ad129a3939197fbb59028230c59418e5ab26
MD5 2665be8459880ff1c838a0ae22502d37
SHA1 25add1a0d4a900eb9a498b6d3682428bf956ca40
SHA512 6662999aef392116b76aeaa165df1cbdc7310fb4e3eb336c75c8729050923149e644afb219502aec9d25022c1045c681443a79d8e010083aadd5bb15a5317a7c
TLSH
T1A41125E6F2885083CBE5593A74E03FBD712C40FC005A773A4174CF686913EBC79A9915
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8db624bd65bdee6f733544bc6bd0dfe11f4e3790d94af8d028bf481f5a10071b
MD5 fb9a7f90529405e8c5b293b37408ab2e
SHA1 234419ff81c0d0f12284c26acf90c6cfc3a728db
SHA512 d760045b61abec99cc70fea010a0af223640c7c39b7bdc52d235cd837bbf401d4a439267e71eeccc05f8f1c377bf0267ab9252b9839a9f20b8753558270b20a5
TLSH
T12851526A72429647EBA848B774901B35F50901FA284B773F8224DDB4F907EACF621B31
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 f512c5baf4c03bb1246e43f6da1ea576c90f1eb46e71a96ab756387c9992eba1
MD5 634d76a9f340ba734387a07aeb62e1eb
SHA1 e2245782dea6e9c3c6027d120e1382e4bf3a5e4f
SHA512 1213e1e5ce156779430f89430587986b129715f3c8496313984e49e28285911bbe707210d067738c8016215c51ccaabed5679e62684c2683fa4f82236bdee0b9
SSDEEP 384:cyBJw8UgS/tIkUI3ijVYWNkqpsU9OD1qK7JoW+FZy:1Jwz764idkqOU9ORqK7JoW+FZy
TLSH
T122F3966F1F11B612CDA9D17A68A6B2EB4A2FF01F8B0295D17C2004B5DDE2663604C5FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 38KB
SHA256 1e6e0f4236cf6f2af5eef867d15463aadd660f76680a31e1b22ee62536b4e3c1
MD5 bddb53bfe25f7307d8723966e1114540
SHA1 5d6447814303ef2e3ca7cc3f39f076dfc6750bb2
SHA512 c279077ce6a00167f700202bb2a3237704d1cd58c02696b0b730c0802d8844a1110887b39ea23ac64ff9542c53751519c98a0274f29047ab9b919a1911954bc2
SSDEEP 768:7qRt0Wzp/mzuoClVpScBf3KOuvFakMaHAgD4y1kX6CEp6ulgY:fCp/mioClVpj1KOYJPAgvkqJculV
TLSH
T1D803CFBB9A58C09A4F1E40F12277313E8DDEF17A7ACCE798EEC58819E1D08685D2C570
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 e7707f9427ef4f8bd1498953422a6cb6f00de67a96966a92e49dd0fbed8173ca
MD5 750797a39544f034bb778cbc59395f15
SHA1 a33e0e60c210a6cb09cdf2a4cde18c86b3c51e96
SHA512 e748e76674d3e3071f0949f45646e66fc0ffab7c08106ae86e603e02586fa826e79ad085e2bf43362558855b5d9a750042f825639c6bcf2414e492790503e1a2
SSDEEP 96:HPareMarDEIzjf50YhouhmrbqVpVMVxago1ab2Bf:HParLarD5zjB+uAOpCMgo9B
TLSH
T19392D6CF2F0433A6C1FEC236D8D1C82E1FB9029A5307B5D6A41028F28862D87A6075F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 ae6af4960c1c533739b9951281c1f86b3628e9fdfce73ebddcbb51fe122d9dce
MD5 0a13b495138b988e4a7d1b11878b8960
SHA1 dd6ae45f3d66c0528fb8272da6fa56977438d651
SHA512 5e45ce72bc569aace542fe48fda820f35852308dadb6c7413aa20a97870819ee14e30be6a79359ab51b30cbfe645c40a6f9fd28e5b62ce5b218b4e276a341420
SSDEEP 384:D0BitxwJJ5J0q01aD7ZqxGvd8Ej9tJhxeV+AaIM5EEoUyPq/+ofSgyKyoXyHBbMZ:kDGuyiBk2h
TLSH
T1F6629BF7C3E8C22D895156F4A715AF2FCE290A18432C3D6689D8BE0BD3E2471D21675E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 a7af4dbf743cafd4e6e82db34098b7abb07198dd7240f50a8b2343cd89b5eb66
MD5 c828d32559f1961d686f32483814c433
SHA1 815ade94b31e7251992ccbf65f7781fb93f69cce
SHA512 66fd7a8cc6efa2e02d7b7f331de66fe1c3fd96f63db4e14af85310bbaef889b8f3f841592dcd0457c09b01a4c68f90e380c663c4dc1e16de982cabb6d430244c
SSDEEP 384:Dlad4ZJVJpJ9r56n+FX8cWHtWuQaIM5nEeVUeaXhf1NZ1N7n/bRk1OHgNOnauyda:RvdBPao
TLSH
T19E629DFBC7D9822D895156F4A7267F2ECE1D0A18831C3D26C9D8AF0B93E2871D21564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 0a8a79a49d29302d894ffb383256c1a56fab831ae40d9f06daddfb26c5e3b24e
MD5 a845d322a56013c9dad54d48328990fd
SHA1 6940e2a044193ad0a1590071d9d6c07734114e50
SHA512 d98076a08d204f253717df83ac5ffaab2e33591fe1cbb08a31d67b2753ffcd9b348c90b991095b23ca7c3e1abf1fc2860f0fcef9e96e2033b462bb8e28c84ed6
SSDEEP 384:D0BitZJVJpJ9r56n+FX8cWHtWuk9tJhxeV+AaIM5EEoUy1V/bRcOHgNKyoXmCBbM:vvwQ0iB1ld
TLSH
T15B829CF7C7D9822D885156F4AB257F2ECE1D0A18832C3D66C9D8AF0B93E2871D21574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 dac6bc13e9fffec9d1e0929c09f981efc113fa970d631ae3ba93c0abe7b85a96
MD5 c6441be74a52a89d3fe3d16477a6ff94
SHA1 1311eb8730d9ea118c8cd86ce8f7696fdae6f5d6
SHA512 46142a99e2ac4f352b096e8d8a422745201e306be33e5f43ba82be7fee836da5268590fe33344dcf296d7b557dfbb167404d11587731ffa9e5faceb14374bdc5
SSDEEP 384:D0BitxwJJ5J0q01aD7ZqxGvd8jNl8k7exd+BaIM5EEoUyPq/+ofSgyKyoXyHBbMY:kDQm08Fr2P
TLSH
T107629BFBC3E8C22D894196F4A715AF2FCE290518432C397689D8BE0BD3E2471D25675E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 36d598a3829c361dd802d4b928ffb7d5345d72d0925c0b8be87b62d03268886b
MD5 674c30e06c33ff47c86864ff000e6269
SHA1 41beb9fa5d79ab53efd995810b461a9da540cd1d
SHA512 fa4d64340fc61d541ce10ffa89dce38e4a5303876005c4fc67f5ab6832477222eeef1f5e5aa27ea8cb050944c5d030f67097e7b7ee703a1aa5955ad07a569dec
SSDEEP 384:Dlad4ZJVJpJ9r56n+FX8cWH1aIM5nEeVUeaXhf1NZ1Va7n/bRk1OHgNOnaFbydE4:RvwBPoz
TLSH
T11F62AEFBC7D9822D895156F4A7267F1ECE2D0A18831C3D26C9D8AF0B93E2871D21574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 51ce92e71b00d119ad9f9bb21012b1fa674e10dda192e4532f0cd6dc132017d0
MD5 e31108692f78875f2bec3a5635136550
SHA1 c93e8e8bf3fe2848d93f6446b3655ac0c43e2d5f
SHA512 d7d0c42dd8bbf9c51c03690dd7fee04fbf64c825998eb7bf26a4c935c3a602636d3f921dc1ea0a6560ab914f8ea789011dba362317d48c1c30c7323150dcef17
SSDEEP 96:Dlad4ZRaIM5vfEvDbvAdfM7ui6aPfrbVjfPtNPl:Dlad4ZRaIM5nEvDbvAxM7x6aPfvJfPt3
TLSH
T1D9C1A0F7C3D8852DC94155F4E7256F2FCE290A14432C3C66C9D8AF1B93E2872D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 2757256f43e132a6153836d0fd8a9cdf969465aeab696d1afb135f99a1f03f5c
MD5 66da0ba87406cfc11da760320e97aaaa
SHA1 1199bcb12040c87dcd0f467775f74c5be70a08ce
SHA512 4bf109d1d6036accf27a161aae486c0ae78b52d66a9f6d34aa864a1580ee96f7982a7bedec09011e000ccad50b7c998567a86d2a89b1c5280a90fbc0f7a1bb3c
TLSH
T163319C9B9A7FB42B103948BB1D84FC06A97BB830434264F8DB96C16CF0819F71B5B023
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7e296eca64703be4a7d2ebf78c0678c25dba88f417a69b96814a639ec4400bae
MD5 479d61b19d989d415ce79b33e116dfc2
SHA1 5864071c15b9157f376f52b9f3ac8a15a92bade2
SHA512 e862ca7e3b6c2efd69c5d4ec75a50435347c17ec9c5afc86270f5eaf40540fd8ff31245a400260033636c354afa6cf52ac81be46e7c5e6f4c7d2acc2a1269ff0
SSDEEP 192:3yRVmXcBAYM8SB96qLOSkcjLv7jhv3PRpWq6V2VVVs9/Hsb+WNAV7VUVFoXV47+n:CR4mAmgXLX1X01wuET2IT2C+M7cHZs5e
TLSH
T1B662EA2EBA10597B5CDBC216F961BB67D7F5202211941E84FAFC8B1C06EBACD321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7a70193c2f6b0807492558e5374e2552d3901a18cf6bccaf5bf362c16655c600
MD5 7d6ef6dc87c58edf51f05c957f000617
SHA1 9127cbd5eb8ac6bcfdf070a73180c0e16fd2ef15
SHA512 8f01b6ac3592f9a251a33c2851f4c2ca31131bd797bfd78e5a59f5937a3044dbe0796e94e68fe05029ae58ed343e775d483399270131f85867883bb0b1cb5039
SSDEEP 192:3yRVmXcBAYM8SB96qLOSkcjLv7bhv3PRpWq6V3VVV89/Hsb+WNAVKVeVFoXV47+n:CR4mAmgXLP1Xj1wxET2IT2C+M7cHZs5e
TLSH
T15D62EA2EBA10597B5CDBD216F961BB67D7F6202211941E84FAFC8B1C06EB6CD321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a6e45fb55e732b277340d455ccee30716a44e0f404a462aa7cbeeaad8e7f7fd5
MD5 f414a3530055e0fdc643e5b55eda2e57
SHA1 73af9580d61093aff04e28e4acfb7dccbca2a0f0
SHA512 79fe327fedf69eda65ba08943ddf3aca2590a8e018a4edcd06c136e8767cee75bb873983333d5c01ff5931d3d536f9cbf10aedbd7e38cbc7b99a6906461f3028
SSDEEP 384:CR4mAqgXLX1Xe1wXEnT2DT2C+M7cHZs5e:fmAqYjE1w7v2X
TLSH
T1BB62D82EBA105A7B5CDBC216F961BB27D7F5202211941E84FAFC8B1C06EB6CD321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 af0a1bfb13d578857099bb57868a2422cff0d8df24078928b9855f2c345d1b46
MD5 28362ef5da2e86cc7fae85727e150ac7
SHA1 0e623300d195b4bfb9a7271ea77d8841c479bcb7
SHA512 a1f2eb171066273c7f10fbbc827d77f7ddd11a0ef6ae7e5913801d55f38cf26395cb481ad8cf08b4db6d4057a28c853794ccb9084317f1dc492d797ad4b0384e
SSDEEP 192:3yRVmXcBzYM8SB96qLOSkcNLv7bhAPRp26VBVA9/Hsb+WNnVFo4Vit2e94neQT2U:CR4mzmgXZP8XS1w092HT2C+M7cHZsy8
TLSH
T12652EA2EBA10697B6CCBC216F961BB67D7F6202121941E84FAFC8B1C05EB5CD721741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e1734c32a911790c93053cf1301873d9c9202cef2f3e593d73926ffaff2e41a3
MD5 f17c118aabfcc3c9e9a0d4d39d67a874
SHA1 b7186c1d41b0e14d645c27a033eba57de3b6bcba
SHA512 725fc53caed8a961be5b6b58493b5aca8997dc1b2f7985d8a89d7abfc8ec0e486dae9dff0dcf2881305f34cf57211f3973068c0ee297fd106cd10ab336a41acd
SSDEEP 192:3yRVmXcBzYM8SB96qLOSkcXLv7bhAPRp26V3VVVA9/Hsb+WNZVeVFoXV47+Vit2v:CR4mzmgXHP8Xo1wjET2GT2C+M7cHZsFe
TLSH
T17D520C2EBA10597B6CDBD216F961BB27D7F6202121841E80FAFC8B1C06EB5CD721741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 a3baffa53115fd7e7b7ca39a39bd0f2081715609fe17d9fe79fafd35f0624560
MD5 b7493acaf9861b0854949be8cb8e4dd5
SHA1 77a55a1978f75d619a216e8fbcf0a22811b30f65
SHA512 134d0979e8ebecd29cf2fefe09db53e466949281182c30b4a2c38caf6e8e638e432c1ec88381733fbe43c54bd7bd27d1d205b71ae571160fd29567386a669273
SSDEEP 384:CR4mzqgsLX1XR1wOE4IWNT2C+M7cHZs5e:fmzqLjv1wk92X
TLSH
T15262E96ABA105A7B5CDBC216F951BB67D3F5202251841E84FBFC8B1C06EB6CD721701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d0775e1364a57b2fc97cbbc98830b7acd9b7f837a3098ad5d1d7c89397d93919
MD5 a3d54930ffda8a48b102f820184e71a6
SHA1 fee40dfb998c471e97b48b9b0d3f7ff29ce3568d
SHA512 a2437787a7fc19cd182b98df7acd300115396001fb806d89c5a316d8b6b11fc302a16d99800b2b7464154531cbbf7488deda1e3b0a15f438030f28d1e4e7bf8c
SSDEEP 192:3yRVmXcBzYM8SB96qLOSkcSLv7bhAPRp26V3VVVA9/Hsb+WNZVeVFo4Vit2e94n3:CR4mzmgXYP8Xo1wj92HT2C+M7cHZsy8
TLSH
T10152F92EBA10597B6CDBC216F961BB67D7F6202121941E80FAFC8B1C06EB5CD721740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 f5b0e567f9b1468728c73bbbb4e52e6b764ee459feefd99e5274b91f265606fd
MD5 a4694fbcd4ddbe59016629e2a75c878a
SHA1 32bc76b22ff2ea9270ae1b3de6a842589cb45aa3
SHA512 bad8d6539cbb2e7e03c603167d9f24004a024b543a7aa55e6791640bfea0b1978555863f72b22f6254be4f965b7e876df6af0dd29f9432a3f213cc855ee6bf49
SSDEEP 384:CR4mhqg3AX1Xo1wOE47shT2C+M7cHZs5e:fmhqkuO1w9x2X
TLSH
T1A462E92ABA105A7B5CDBC21AF951BB67D3F5202252941E84FBFC8B1C06DB6CD321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 765d1ae93d299ea637cb1effa440a0b5342ef54f2a8d4ec186b23c8e2daaa0a0
MD5 9568516a9b6b4254c7783d3e276233e9
SHA1 ee4d23d460b7b49fdfa2a360a2a89d7a773f4c64
SHA512 c9fdb66ef935303086ccadceb45dc25d28c0fccf396cfa77eb67d6e1b0c3ebcf1c2265fdebb5bb2398da92d2f1aa6e12a5350e64ad8a15868c7ea4bb57a5a4a9
SSDEEP 384:CR4mhqgsAX1Xa1wOE4TulT2C+M7cHZs5e:fmhqLuw1wv12X
TLSH
T12262DA2AB9105A7B5CDBC21AF951BB2BD7F5202152941E84FBFC8B1C06DB6CD321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 e0bde6c90037411439676bdd15f012afa8885d07784e6d398a69fe950ea36554
MD5 5290ed569d2e203676308c6a1b773d58
SHA1 4f37a3387ed015925db888de562a4b59a1921822
SHA512 22825ac70ce2df073beb9b5f9d23156e95ae3fcf04f3cb2ddb4c8e7850c5dd112e57d3ae6f93579b7c50b4df000c147c3dc233a50e9504cce81ae4f0796d84fa
SSDEEP 384:CR4mhqg3RX1Xf1wOE47shT2C+M7cHZs5e:fmhqkZp1w9x2X
TLSH
T1D662E96ABA105A7B5CDBC21AF951BB67D3F5202252941E84FAFC8B1C06DB6CD320741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 49c20a38e36f7e1565dbccf2b2840f473ef28bb0ed78516258cc507c80c74d32
MD5 8762fdd0e97da8aba19f55b3dd54c74f
SHA1 08c5247f5319d098fae05db6197bb34cf562f24e
SHA512 e12494d1515fff706fd6af70f16ce1863f0d5c4e9e12e2122f14e29cdc54f66ea551a1490989b2b60af45d942e2e454072fe027a1957a23b2fe2ccfea3903d91
SSDEEP 384:CR4mhqx3LX1Xf1wOE47shT2C+M7cHZs5e:fmhqljp1w9x2X
TLSH
T10262E96BBA105A7B5CDBC21AF951BB67D3F5202252941E84FAFC8B1C06DB6CD320741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4a8de811b93ad52e9d4022e9fa8a9091cc20b5ffab88a1e0f530f17ec1f4af83
MD5 469645fc081cfe6eb6c54d3ab7d6055c
SHA1 a833172ee1a4cfdf987c031a33c493f52999a2a9
SHA512 e6874d4c0de8dab37c06cfe06c0e7f6a0485f59eca431899ec8c9501c7f2f35d5061c79cd8a90a2176dfdb88432ceb4ee67ce09a6e5a875caf924a573ae28e55
SSDEEP 384:RrjNI7KxkXqKf/pUZNCgVLH2Hfgsl4Tv7pLuLcSj/6XODNI+ErU3BtvHG+lGGEVP:RHNI7KxkXqKf/pUZNCgVLH2HfgsmT7pL
TLSH
T13D7209677C4C9A3B0F94C6CCE8177B4FADB5025B26E9886543FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 600a30ed41f412ff5c2bb30872afe55ddb784edcd621e51bfa7ce8bd8b1b589a
MD5 f174cf4be76dc029213a53ee93dc447d
SHA1 87ae36e90b75b20de94b3163fa8e2c97be1798b6
SHA512 c462d7da60496e2f48ff6b13a2a1d63a2d6b79bd9a9f6b64abdf8c89602954d5346a16af50babe782d41bcfd974e67f5383bab832e521ba7aa26c3e1481e2590
TLSH
T1F0B012148041D502C4430AB0128A6CC871545F10D60E1F0553F0A922C8255618018050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f865.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f865.TMP
Size 96B
SHA256 4334cf380d77d663206ece15f89bb190bdb92cc0c53dcab6f6e3cfd021023911
MD5 690ec62680b525ffbd1e6c3237184c39
SHA1 4df903836b502e68cd0c4ef999f57f37df50dedb
SHA512 d4d3b3c5eb8183ec7e45e8e3dcfc4e1b171cd1ec4b3166a638927b6fcc5ac3077b19293dcc010475b56f03f1248f3b97ff45bd5a59b44a4d58a37c2b989601a4
TLSH
T1DEB02200C002A202C00303F02CF0A2CC3020CF20C203230282F08A22CC3023002300F2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 a0caac4f83105d46882ec3e19f1235ab11175e52f0cbf6c37f0682ff6a165e66
MD5 333508a1231124f475ef4063dbd319a0
SHA1 8553a6398044d96356a8851a7c78fcb75999ce3f
SHA512 8c81e5b994b23ef2fad1b7b3065013aafd2eec67548fa33369d8b82c3f16f8f5e9cf97b1679b8b933f16614eb1d12fa8c1e566584bd269d1151a750a9b7ae11a
TLSH
T153A0021451C40C05DD211B7032D102D037318C2257B5C30750A092ECC8932464102B08
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 e0ebf98ba22f8d58abfe7cce79e6f1ad19c01bb545227356ecce0c83a177bc91
MD5 9aa468459d31083b8be53e2c2fe2563c
SHA1 e4f36b8a661b6deae9c2c89203baf5c7e05988dd
SHA512 4c038bd73c370bb0d5b76819d1cda72cab5d2d07dd123446480088b4316f9174859e0150a2f435952ca55d94f6ae4aa25724539e28baccb15aceb46f30337f11
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP24Gk9sVumYml:1nbZeMrv/hG5GMzml
TLSH
T1CAD3774B3A747002EDE59A721CE051BB5E3CB17D8F51A5D428B620588EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 5094766296d4314b99062c6740572128f441273d8b0d1971591cd6d9fe980ba3
MD5 953b2fc41e0221112fba9f16085b8dfe
SHA1 a30dc39773d868d67778a3f110af7116e0e33410
SHA512 5c7991e0afa601fa6bff265990703e177569210fa8073ec21bfeee0c0ab730f3b300cc1017f6c789674082b8ed6af0cc181694992844fae252ef6dda25abf414
TLSH
T1FDC09BE32510895B8FF5DED8211CF21DD51B534CCCD5CDEC94555116317C937442A9BA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5d3849.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5d3849.TMP
Size 157B
SHA256 164bf4c7309fe8e92513d463d94b4865a60dc73d82f655dca40900a53c993d92
MD5 10460f5dd14a8eef5d574fe3f6c901bf
SHA1 a4e6c5526f79cecff2574b7f5cd8092076eacaa8
SHA512 61c5fde1c164c8a2e0037a4e712044c5adc80d66f2e6c27dcdc40d93ab785a21357ef327044bd0617d5c6f7c61855aa7da91279fd411e6039ffa646b3e018434
TLSH
T101C08CD3242049578BB2DDC42128B20CD41B4E08CCC1CCE8841A3006303C923442D9AA
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 cb0be2ad253899c39ae3f695c8430e42365e184399f56a376b2496dceb73cb0c
MD5 d69b51ac173f178a15918c4f577d2a7b
SHA1 f66fcb69d713b0ca8e0679f3a52eca70a483d72b
SHA512 58f13e4d93bcf1f1d0345bfef3032127031b3c5f9142a89a8388e57789900585c5c16ac8fd2eb3710f5923aa4685b87a13e2a168cd1f7f3ce6021c1f5506e513
SSDEEP 6144:Smg1kQfATCFbzQACjsm7Rkm1tYpBeh2BAo/:CneA+9oBGcAo/
TLSH
T1FA34231B4EF05D7E1A255B66708A0F3E3AF28F7BCE215E9481E91B4437DAECA1745830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 d2f041db6b9e552fa48b058f42083c22971a5b5cb808c8387dce8140a6b0247a
MD5 2652ced7d3aa4047bee5a605f58f7edf
SHA1 e4ff23a6d144339d3cd11ebfe0cd8c3acf951d2d
SHA512 858118c85d9ee71dc783545b6729313594483df3ef9fe152e8fddcdd6d4f2b7a12b0882c2f5193f9d3e4146bb77def08ca9b7013d17b18c22e2cfce16b5fe827
SSDEEP 6144:eS3mg1kQfATCFbzQACjsm7Rkm1tYpBeh2BAo/:jneA+9oBGcAo/
TLSH
T15A34232F4DB05D7E0F251A5A208A1E2A2EF19F7BCE216E98D1D91B4477DEDC90B46830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ed6352645800e36ed3fa63a52d5f429f590d6cd1beab40e18b0e57ee0e2bd785
MD5 b1805756426603a1f6b7897d76be7bc3
SHA1 30442c41c2bc664e9fd72e917b575080f3ab63b2
SHA512 698d80e833314a611d08e9bc2bb84a7dca4e3e88310573c59dcc1f49f95b261e9d51916959b57e813a6e18bc2890f981d4ead1536104ecb5d7bc34b5461fda87
SSDEEP 3072:8TGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM1:8qm7Rkm1tYpBeh2BAo1
TLSH
T108C312275E71E9375C79AB4EB08E0B1F1EF149A6C920DE82C8D85B0477FA7CD1A44938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 cae553e24a109b4c80a93fa20190cf756c35953f589eac1f0ee3356b1398a942
MD5 c5cf4bf7a5873f8261a3dd748a50831f
SHA1 607fb7200fd6e11001bcfabe7b6ed89773206f80
SHA512 d47bd4786fd658ba0640882ed1ed31560fbde9df0136802b7b05a077b40cb1c0406a8171753ab7c915fa7630358500835bef979c8db1509cbb2d7aa2eab3153f
SSDEEP 6144:oS3mg1kQfATCFbzQACjsm7Rkm1tYpBeh2BAo/:ZneA+9oBGcAo/
TLSH
T1D334232F4DB05D7E0B251A5A208A1E2A2EF19F7BCE216E98D1D91B4477DEDC90B46830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 5c9453b3f146320f192b71b111184e1b2feb5e59cc67f77d9d709cf2a6520b62
MD5 5bca9fba69c1160bc3e4f570d1d9fb2c
SHA1 b90be2d4d0ddeddd88f81c08ac6eec5910321abb
SHA512 4de21cfbb049c500efd2f6baf11e1701c3a45cb7c0f704ab0ec918314ba46802db3b097cee8f2f6943deb99d9bc86f0017dd9edff2264e0f9af2322c8e2c5ee5
SSDEEP 6144:+S3mg1kQfATCFbzQACjsm7Rkm1tYpBeh2BAo/:DneA+9oBGcAo/
TLSH
T1EC34232F4DB05D7E0B251A5A208A1E2A2EF19F7BCE216E98D0D91B4477DEDC90B46830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 4eb9723980e25d73ca893ade7bf5b2c6c933131e594c3110f2362d9fb24f1433
MD5 e32fb102988e60f1caa6c1abed5dfb7b
SHA1 c7163bd6d5772f809861f0a33edc7878ba0b4e73
SHA512 d2b9209a4a02332f2efda18dc41df5cacaf349dcdb54ba3aa4489f6c91b5710e94794800e0025b64f5cf2f89ab504b5f8ad4ab86cda19c924fb8f3e438ce2b04
SSDEEP 6144:rmg1kQfATCFbzQACjsm7Rkm1tYpBeh2BAo/:/neA+9oBGcAo/
TLSH
T18134231B4EF05D7E1A255B66708A0F3E3AF28F7BCE215E9481E91B4437DAECA1745830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25702f00b9ae3e59191c9934c14d23ed967e0529851788b808888646dea4d732
MD5 ffa356b657a3409019fc8a239c32c6a4
SHA1 0d51c84aa86ab7959c598cad1154ad13f00af759
SHA512 c83ea8fc753dc36b208df6ad992709ac8598c211965482ecabbc7cb3003aa09cf7cf7dd16ddb5bb30a93ef60e91ddc256b634830a8856ba86888c4fe6d173b24
TLSH
T126D080367B5EB404E71BC231A42EC701DB1A59F014968B07E254D42C97F40DC63EF593
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9991c48ed8914879dae4effcec150d36bec17d010668f447d8f9cade2568ef52
MD5 2b78928af0525d555cba6be0800700cd
SHA1 c47480c0d63ca33a357bdeae4e0a2b4778e4464d
SHA512 6bc6c0cf883cc43a054d194fde4d18e99c2cbbeb4a8d8d02877029180da59e5d35cf8681da958469d6f20c0b488cb0657a9b8230375256327c3a614ac9ee7298
TLSH
T18AD01236BA1AA404E61A8231A42E87019A1A59A014964B06A254D42C96B409862AF593
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 46574754b8fa2f9c98653c23cd3c8fa11694abda424439787bd2eafca56204f0
MD5 a747e796a8809e2a4453f71c35bf06ff
SHA1 69a762471018e7181f669ffd2f2301389247809b
SHA512 0611f824e8ee35478c2e60c8457e96e18cea420236004a4d77b979e67f56ecd76a4a131935ced71f2b5cd26260418e15800947f0333246ded1c196dae27f9ab3
SSDEEP 48:KsWT8Ae0k1VIRIIqo1K3E/u1r2lQ58VIdKuA4Xy5+IvKvK4c1i7PF/DnWrR:KwX+KUsyV2KuAS6+cKvKV1i7PF/DnWrR
TLSH
T19E910306307E020338FD284C96A59A379E46319B7534A57F3FB854A64A26E126FFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 e33636ed6045c51d2d96a82e51e1d960db6eaa85ca02fc47f110a312c13bbdd4
MD5 928b2a6a4895a4d824902e875a32369a
SHA1 f8304130a8ccc87ac1401179ed6043f888f22eab
SHA512 48b27ae97b4bf9ebaee2e9c4333a1654f55fd7bd728fd1c7bebc75836df65651ceb02530cc250063972e63b33beda27dc5b0f9b396be63926762c16949b470d7
SSDEEP 192:P+xWM/fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxrfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T18024740A7B747001EDE6D9721CB080771E3CB16ECF22A6915DB654698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5a30a0ff114eae6d9d8746af9bd311834cc5aa4cca2fd57bfdbbb4d82cce9e15
MD5 0c0a6ee9472eb0e574f4aa1d709d2b54
SHA1 420350c59fd52771aeb8c1ae4d8be13e3d4b024d
SHA512 c432c84adcc86f5edce5cc4d84124e21b9bab5b3737569017903b484a8a1a98c40a3501e4629f7ddcec29a16cc5c56d3be4125b158206f75473c58c7895d1c72
SSDEEP 192:YONt6LCWtDQmiUyV2VCILSuOCzpgmsEip1RU6:YONt6mg1KImuO8KmybU6
TLSH
T12702E93AA8786C779EB36E44B8873B175FA4213BE9902F54DAE81F0C05D764C1306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5e9556e8ed315190e25596f32e67a8d928a2a46073964798a7ab908482763cc2
MD5 5a2a568f21088f28232f05a1afe51daf
SHA1 f4e7d074b3e8279c48ce18359fc27d13c61b6f1b
SHA512 b714d6b86f5e821601500936e1ecd50cba32a76d72d489768ac15caa8e0e4f7e2fff1cc769f315d97f28109a36378de35b5d1dbab3b3e87ae82f4197fafc3280
SSDEEP 192:f3ONrp6LCWtzQQmiUyV2VCf3LSuOCzpgmY3zEI/ipCqiZOU6:PONV6mgEoPmuO8KmYPydU6
TLSH
T16412F936A868EC275DE6B940B4C736135FA82137ED812F54E6D41F0C05DB78C270E92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 845fc1dbf00117d857c8cb38bba7dbfbceafdabeb131587365f2c4737bf7a331
MD5 ff08a1ce3e914a4943232895e5a09ead
SHA1 ee73cf9551ae7f2d68552fcbcc75a12613d38d28
SHA512 22c14ea80011ab46c499a49315d2149fd6c702ab5a5dcb771816965ae5c0df60a697f1030de28395beccf85ec6443059b2541cc65f747bf1035416cdb9cf68a9
TLSH
T19B410958A6E91148B3B36F5A9BF6A96E487B7D372F07C45D00010E4E4A67A00CDB2B37
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 07974006e39ba89d5047ebc682cce3fe311d63dc88f39705556562abe360f45d
MD5 e4c29a220575e61d3ba74b376328c1dd
SHA1 3956c03a99455c907eb41ce7b3a50fd892be365b
SHA512 ac2c72dd334682a900a5760a4cc5531a5d9b7550a46e4c76c5e1b5d722e5947da394e441e3f1ef016e0ff1d87a2716bd2077db9f87603f2d3d5bebf3d2444e9b
SSDEEP 96:JdPbqoJxlTNgSKiouSGOObZzyXhSq8vbdBJW:JduGbTNhKi5lahSq8xBJW
TLSH
T125D2D956F408EB02DD492C33AFDAE6EC22317E1ADD1A031379C4B77F49BB8C04959489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

292ce21b-ecce-40cf-9f28-132bfbb9ed9c.tmp

Path C:\Users\Admin\AppData\Local\Temp\292ce21b-ecce-40cf-9f28-132bfbb9ed9c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5720_1630582582\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bonzify_Exe_Download.zip.crdownload

Path C:\Users\Admin\Downloads\Bonzify_Exe_Download.zip.crdownload
Size 1.5MB
SHA256 aed7f009ae76add2378e712e4fa270881597a883244a4bed078f20db4228f924
MD5 015ecae7c091e61da635065200577c98
SHA1 52a9fb94bf69373edf101c98c079d4721dd28372
SHA512 14f70b744ff85896926aff25752c7a2f212388e80a99aa21394e471a854720ecadc31df52ae8c1195bb745c3cddbc74c4c6ee33366be5b1cd923947c8f3ab73c
SSDEEP 49152:g08iygbqB9t9apUkMDNi7LSfXHr06vOva:g08iygbqB9tbkMDcL8XLb5
TLSH
T1A87533C59C78AC8A495835DDC2E48C603057AC9E80F9C9592BFC3D69619DCC92BBFCE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2248-388-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-604-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-505-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-504-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-503-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-497-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-501-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-485-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-483-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-479-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-478-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-433-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-432-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-431-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-430-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-429-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-428-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-427-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-424-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-422-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-438-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-421-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-420-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-539-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-609-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-603-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-610-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-608-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-607-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-606-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-605-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-516-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-519-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-522-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-540-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-541-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-542-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-543-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-544-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-545-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-546-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-547-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-548-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-549-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-550-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-551-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-527-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-506-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-489-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-461-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-435-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-436-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-434-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-399-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-397-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-396-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-395-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-394-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-392-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-390-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-387-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-385-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-384-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/2248-383-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download