agenttesla | hxxps://github[.]com/miles0804/N-mero-de-pedido-25-08526/raw/refs/heads/N%C3%BAmero-de-pedido-25-08526_pages/N%C3%BAmero%20de%20pedido%2025-08526[.]z

Analysis

user interaction
yes
max time kernel
98s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 19:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/miles0804/N-mero-de-pedido-25-08526/raw/refs/heads/N%C3%BAmero-de-pedido-25-08526_pages/N%C3%BAmero%20de%20pedido%2025-08526.z
Sample260702-ykawkadw6v

Score

10^/10

collection discovery agenttesla keylogger persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.transotraval.cl
Port
21
Username
[email protected]
Password
vIZ2P]dt&a!d

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
4036	Número de pedido 25-08526.exe

Loads dropped DLL 1 IoCs

pid	Process
4036	Número de pedido 25-08526.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
15	raw.githubusercontent.com
30	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
75	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4036 set thread context of 4932	4036	Número de pedido 25-08526.exe	119

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\LOG	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_2	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_metadata\computed_hashes.json	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Network\TransportSecurity	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\History	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\ClientCertificates\LOCK	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\GrShaderCache\data_1	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Feature Engagement Tracker\AvailabilityDB\LOG	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Network\NetworkDataMigrated	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\DawnGraphiteCache\data_1	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\GCM Store\Encryption\LOG	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Service Worker\ScriptCache\f1cdccba37924bda_1	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\1985d0b9-1b6d-4fa0-b8c5-8c77eda0cee0.tmp	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Login Data	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Sync Data\LevelDB\MANIFEST-000001	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Site Characteristics Database\000003.log	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\parcel_tracking_db\LOG	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\GraphiteDawnCache\data_1	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Service Worker\ScriptCache\4cb013792b196a35_s	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\CrashpadMetrics-active.pma	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Web Applications\Temp\scoped_dir4536_805516477\Icons\256.png	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Last Version	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\component_crx_cache\bf828d1b-d1d0-4711-ba3e-f4378f4b3ac6.tmp	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\PersistentOriginTrials\LOG	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\discounts_db\LOCK	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_0	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOCK	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Local Storage\leveldb\000001.dbtmp	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\shared_proto_db\metadata\CURRENT	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Local State	Número de pedido 25-08526.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Site Characteristics Database\MANIFEST-000001	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Segmentation Platform\SignalDB\LOG	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Extension Rules\000003.log	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Network\Reporting and NEL-journal	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Cache\Cache_Data\data_2	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\ShaderCache\data_0	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\DawnWebGPUCache\data_3	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Network Action Predictor-journal	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\temp-index	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000001.dbtmp	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Session Storage\000001.dbtmp	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Extension State\MANIFEST-000001	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\WebStorage\QuotaManager-journal	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\ShaderCache\data_0	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Site Characteristics Database\MANIFEST-000001	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Top Sites-journal	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\shared_proto_db\000001.dbtmp	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Web Applications\Temp\scoped_dir4536_2047427210\Icons\64.png	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\shared_proto_db\000003.log	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Network\3bb16433-5f67-4ff9-a3d5-bb825b6c2a1f.tmp	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Web Applications\Temp\scoped_dir4536_1830635594\Icons\128.png	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Web Applications\Temp\scoped_dir4536_648138772\Icons\64.png	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\ServerCertificate	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\ShaderCache\data_2	chrome.exe
File created	C:\Program Files\scoped_dir4036_845312098\Default\Extension Scripts\000003.log	chrome.exe
File opened for modification	C:\Program Files\scoped_dir4036_845312098\Default\Cache\Cache_Data\index	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4940	chrome.exe
3976	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274954188364862"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{DFF20505-B08F-455B-AD70-4FBD055088E0}\LocalServer32\ = "C:\\Users\\Admin\\Downloads\\Número de pedido 25-08526\\Número de pedido 25-08526.exe"	Número de pedido 25-08526.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID	Número de pedido 25-08526.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{DFF20505-B08F-455B-AD70-4FBD055088E0}	Número de pedido 25-08526.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{DFF20505-B08F-455B-AD70-4FBD055088E0}\LocalServer32	Número de pedido 25-08526.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3376	chrome.exe
3376	chrome.exe
4536	chrome.exe
4536	chrome.exe
4932	regasm.exe
4932	regasm.exe
4932	regasm.exe
3376	chrome.exe
3376	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5412	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe
4536	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe
Token: SeShutdownPrivilege	3376	chrome.exe
Token: SeCreatePagefilePrivilege	3376	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
5072	7zG.exe
4536	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe
3376	chrome.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
3064	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe
5412	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 5036	3376	chrome.exe	86
PID 3376 wrote to memory of 4940	3376	chrome.exe	87
PID 3376 wrote to memory of 4816	3376	chrome.exe	88
PID 3376 wrote to memory of 4816	3376	chrome.exe	88
PID 3376 wrote to memory of 2112	3376	chrome.exe	89
PID 3376 wrote to memory of 2112	3376	chrome.exe	89
PID 3376 wrote to memory of 892	3376	chrome.exe	90
PID 3376 wrote to memory of 4360	3376	chrome.exe	91
PID 3376 wrote to memory of 892	3376	chrome.exe	90
PID 3376 wrote to memory of 4360	3376	chrome.exe	91
PID 3376 wrote to memory of 3444	3376	chrome.exe	92
PID 3376 wrote to memory of 3444	3376	chrome.exe	92
PID 3376 wrote to memory of 4732	3376	chrome.exe	95
PID 3376 wrote to memory of 4332	3376	chrome.exe	96
PID 3376 wrote to memory of 2376	3376	chrome.exe	104
PID 3376 wrote to memory of 4916	3376	chrome.exe	105
PID 3376 wrote to memory of 4448	3376	chrome.exe	106
PID 4036 wrote to memory of 752	4036	Número de pedido 25-08526.exe	118
PID 4036 wrote to memory of 4932	4036	Número de pedido 25-08526.exe	119
PID 4036 wrote to memory of 4932	4036	Número de pedido 25-08526.exe	119
PID 4036 wrote to memory of 4932	4036	Número de pedido 25-08526.exe	119
PID 4036 wrote to memory of 4932	4036	Número de pedido 25-08526.exe	119
PID 4036 wrote to memory of 4932	4036	Número de pedido 25-08526.exe	119
PID 4036 wrote to memory of 4536	4036	Número de pedido 25-08526.exe	120
PID 4536 wrote to memory of 4176	4536	chrome.exe	121
PID 4536 wrote to memory of 1544	4536	chrome.exe	122
PID 4536 wrote to memory of 1544	4536	chrome.exe	122
PID 4536 wrote to memory of 3976	4536	chrome.exe	123
PID 4536 wrote to memory of 4740	4536	chrome.exe	124
PID 4536 wrote to memory of 4740	4536	chrome.exe	124
PID 4536 wrote to memory of 1932	4536	chrome.exe	125
PID 4536 wrote to memory of 4708	4536	chrome.exe	126
PID 4536 wrote to memory of 1932	4536	chrome.exe	125
PID 4536 wrote to memory of 4708	4536	chrome.exe	126
PID 4536 wrote to memory of 3056	4536	chrome.exe	127
PID 4536 wrote to memory of 1852	4536	chrome.exe	128
PID 4536 wrote to memory of 3056	4536	chrome.exe	127
PID 4536 wrote to memory of 1852	4536	chrome.exe	128
PID 4536 wrote to memory of 5248	4536	chrome.exe	129
PID 4536 wrote to memory of 5248	4536	chrome.exe	129
PID 4536 wrote to memory of 5472	4536	chrome.exe	131
PID 4536 wrote to memory of 5472	4536	chrome.exe	131
PID 4536 wrote to memory of 5668	4536	chrome.exe	133
PID 4536 wrote to memory of 5668	4536	chrome.exe	133
PID 4536 wrote to memory of 6120	4536	chrome.exe	136
PID 4536 wrote to memory of 1392	4536	chrome.exe	153
PID 4536 wrote to memory of 1364	4536	chrome.exe	138
PID 4536 wrote to memory of 1392	4536	chrome.exe	153
PID 4536 wrote to memory of 1364	4536	chrome.exe	138
PID 4536 wrote to memory of 5492	4536	chrome.exe	139
PID 4536 wrote to memory of 5500	4536	chrome.exe	140
PID 4536 wrote to memory of 5492	4536	chrome.exe	139
PID 4536 wrote to memory of 5500	4536	chrome.exe	140
PID 4536 wrote to memory of 5568	4536	chrome.exe	141
PID 4536 wrote to memory of 5568	4536	chrome.exe	141
PID 4536 wrote to memory of 5952	4536	chrome.exe	142
PID 4536 wrote to memory of 5948	4536	chrome.exe	143
PID 4536 wrote to memory of 5952	4536	chrome.exe	142
PID 4536 wrote to memory of 5948	4536	chrome.exe	143
PID 4536 wrote to memory of 5972	4536	chrome.exe	144
PID 4536 wrote to memory of 5972	4536	chrome.exe	144
PID 4536 wrote to memory of 2132	4536	chrome.exe	145
PID 4536 wrote to memory of 1436	4536	chrome.exe	146
PID 4536 wrote to memory of 1596	4536	chrome.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/miles0804/N-mero-de-pedido-25-08526/raw/refs/heads/N%C3%BAmero-de-pedido-25-08526_pages/N%C3%BAmero%20de%20pedido%2025-08526.z
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd9b71c728,0x7ffd9b71c734,0x7ffd9b71c740
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,11912790403627568181,6132039147192961326,524288 --field-trial-handle=1964,i,16719850472256051097,6002619110467106752,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,1119113166838740480,18064021095765746720,262144 --field-trial-handle=1964,i,16719850472256051097,6002619110467106752,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,9480327821219933702,13964473693696563140,524288 --field-trial-handle=1964,i,16719850472256051097,6002619110467106752,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,15797745169445823318,1396394052058006891,2097152 --field-trial-handle=1964,i,16719850472256051097,6002619110467106752,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,7221051935219961300,3179928648864923167,2097152 --field-trial-handle=1964,i,16719850472256051097,6002619110467106752,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,10923835953826557854,9973126583317439263,2097152 --field-trial-handle=1964,i,16719850472256051097,6002619110467106752,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,13897097016630753053,3686000961294689640,524288 --field-trial-handle=1964,i,16719850472256051097,6002619110467106752,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,3595738862975785374,2185292963097930003,524288 --field-trial-handle=1964,i,16719850472256051097,6002619110467106752,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,13672283219427346171,9516799559524359739,524288 --field-trial-handle=1964,i,16719850472256051097,6002619110467106752,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,7368354360541697927,15852093688930679670,524288 --field-trial-handle=1964,i,16719850472256051097,6002619110467106752,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,17196030228160751576,9737419966709801872,524288 --field-trial-handle=1964,i,16719850472256051097,6002619110467106752,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:4448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:740

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2656

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Número de pedido 25-08526\" -spe -an -ai#7zMap2295:108:7zEvent31920
1⤵
- Suspicious use of FindShellTrayWindow
PID:5072

C:\Users\Admin\Downloads\Número de pedido 25-08526\Número de pedido 25-08526.exe
"C:\Users\Admin\Downloads\Número de pedido 25-08526\Número de pedido 25-08526.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7877.0 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff600bc9af4,0x7ff600bc9b00,0x7ff600bc9b10
  2⤵
  PID:752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - outlook_office_path
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --disable-features=LoadLowEngagementPEHFeaturesToPrefs
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files\scoped_dir4036_845312098" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\scoped_dir4036_845312098\Crashpad" "--metrics-dir=C:\Program Files\scoped_dir4036_845312098" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd9b71c728,0x7ffd9b71c734,0x7ffd9b71c740
    3⤵
    PID:4176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1908 /prefetch:2
    3⤵
    PID:1544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Drops file in Program Files directory
    - System Time Discovery
    PID:3976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2320 /prefetch:8
    3⤵
    PID:4740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:1932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:4708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:3056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3752 /prefetch:2
    3⤵
    PID:1852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:2
    3⤵
    PID:5248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:5472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4876 /prefetch:8
    3⤵
    PID:5668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5472 /prefetch:8
    3⤵
    PID:6120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:1392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5612 /prefetch:1
    3⤵
    PID:1364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:5492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:8
    3⤵
    PID:5500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:1
    3⤵
    PID:5568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    PID:5952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    PID:5948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:1
    3⤵
    PID:5972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:8
    3⤵
    PID:2132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6248 /prefetch:1
    3⤵
    PID:1436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:8
    3⤵
    PID:1596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:4188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:8
    3⤵
    PID:5540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --force-high-res-timeticks=disabled --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6428 /prefetch:8
    3⤵
    PID:5928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:1
    3⤵
    PID:5448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5728 /prefetch:2
    3⤵
    PID:5508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4036_845312098" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=1912,i,8830905646050964140,13669853379814676706,262144 --disable-features=LoadLowEngagementPEHFeaturesToPrefs,PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:2
    3⤵
    PID:1392

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Número de pedido 25-08526\debug.log
1⤵
PID:5892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5412
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Número de pedido 25-08526\Secur32.dll
  2⤵
  PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Program Files\scoped_dir4036_845312098\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\scoped_dir4036_845312098\Crashpad\settings.dat
Size 40B
SHA256 75870863cc20d4badcd76ba81dd956bec4a1ae6e9ec76194e8f9fbd49159e476
MD5 cb3cfae7b029fa4049b5123f437fe01c
SHA1 cf23a0fabd08a3e13879d3e61065134b143867bb
SHA512 e9323695953d49f190af05d186b135688060bf502a3ba0aaf527c146c5bd9422e750df6dea45f88a3da4bbf3e0243dc8f4070c1bfe77ee687131fe8305ca585a
MD5 SHA1 SHA512

Submit Download

Account Web Data

Path C:\Program Files\scoped_dir4036_845312098\Default\Account Web Data
Size 76KB
SHA256 4f3e18eea355690c25b4de99b18e90f0c81cbb088228ffca12c84a53c6dff98f
MD5 b89fd902b32528a846212c73a9bfbe73
SHA1 b2bc3a06c5bf56df8b8245e2947e7f78fb6a416d
SHA512 ae387b21b2d3801abe3543f23d1705b51982e4f076c923cfee764f3ea525ce276d8360623be00d402ed7c804f801e36ba42b68d32a5f6e856e153d6b96ea750b
SSDEEP 96:pv+kOyOFXmT7i04MDDPtg3IM8n0ys5bSAoFLoeqclNz58rx2n:pln06Ca
TLSH
T15A73224A7A342505EDE28A362CF090F75D7C722D8F01A9412DA73028CDA5897F23A4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Affiliation Database

Path C:\Program Files\scoped_dir4036_845312098\Default\Affiliation Database
Size 52KB
SHA256 4cb381b1a653296a38381f16bfd94dd09b9c900c0ed24eb532d372d647bcb96e
MD5 142456354ac4a1d7e89f037c2ebda0a2
SHA1 60b5e6036da7c3c1e4e10dc04c319e55cd125152
SHA512 cad919e47513bfbc050db3a996811643f5381ecbe3224c5ed34bf7dcfdec993d7a5e0af674f36625648866b4fad55578ab7427be38c17f6d9eb74403da02960d
SSDEEP 24:TL9VAlZGUWEKdPq9XUeS0z8jNvN2HhKroyr0d8D4BmhltoVOq6Uwccm5fBGQww:TbBzdPqJZSm86Uu8baVOlU1cWB
TLSH
T18F33DF061B685434C9ADD23498D90EE279B4126FD9D1E9A42DFC1D190FE04546CFD46B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsSiteData

Path C:\Program Files\scoped_dir4036_845312098\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Program Files\scoped_dir4036_845312098\Default\BrowsingTopicsState
Size 414B
SHA256 661bab3a36607640a673b04c99a472ef48b4148401c7dde4b29a009a0ad1a5e5
MD5 eadf3214cc7ee7db93cd257b19ab665e
SHA1 bb7577f9429528b5833e55ce5acbb16edd41b062
SHA512 88d7d865f96439d0f92d59b822a4d7349e7154cbfc0411be12e0f740f5045c9c921fddcc180043cd5398b27241c557449d437327455529b559753c049a6fce7b
TLSH
T1D0E022AAC826EC6718FC4B1964A15796E74403672B418A9F3B3C920CCFB1A37438385C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Program Files\scoped_dir4036_845312098\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 71c38976b662443544496201d012eb54120abfc4ad855cd194edd6e115fa5c11
MD5 938d6fc3a7b255d63aeed1ab36b2fa57
SHA1 b88fff4173d06ddaa7aeec2d7c2d502fc305ddcd
SHA512 aeb8d43eacfc346a1fbea6744424a6f3af0f35cbd94eb5867bb282ff8aa5185f87146a1e055caaf1aafc43f1fe9aac250afb02081c615fa6643727e44a44965d
SSDEEP 6:/FoEXEn+ECkNqirsotZy5UerSl/0lnC9HtUHnZMyB7hMUF:d7XgfnN5rVtkFr4WCjK579
TLSH
T157135E6C898D4F22CF80007C8C0777322372DE84DA3D81330EE069183A40337B08E105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Program Files\scoped_dir4036_845312098\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 f13510bf113a73b64497d61481274a2f3c53d35b6727d18768bb245b73805381
MD5 acd698a22c62badbc3c708de977be349
SHA1 bd45c665a8e401b0a4bc9241c6b6a8509c55f670
SHA512 833d21afd489b610d8ff028cc3ff8e912f12ab4097c01d6635fdf7ff0c8c2f1ff0a5be7c6d58d05066e688f3b9ee2eaceac879c812e6cedb1ed159c2b4e0cddf
SSDEEP 48:W1lvxYm88RAjM1XgyanDvvMmXWN4XsdVEPLVBKWwtl:IvegijuglDXjWWKVOLHKWol
TLSH
T17644A6F71D05EBC6EB258AB45C41E23CCD3283252C59EE76F22884B16591AE331282B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Program Files\scoped_dir4036_845312098\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 17c0a60fd1238692702910a50e11f4d8fa2abeed41f91dc02cfda4ceaa17ea0c
MD5 afa491e4140f56c7f1c55c047ea1ea3e
SHA1 51cbddee5c12da7c2e997376123e4e24d5f75c32
SHA512 f3a6ca56e25ce6f1d868157bf49dcb088fb94db3b2e9333f93d3ad58e705185be365efbfcdd639489624c930903ca7995489668358a1b280a24237c49e7f9281
SSDEEP 96:Hie8n40qV+DkbhbGOCyCBeyZs3V75ceXNB6aNhHhNi:Hsn4kDAhbGGqe66
TLSH
T1FA257D2DE58B629DDA081D35807BAC6CC8DA324C4FF3E3B3448A4E27799F92AA05551D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Program Files\scoped_dir4036_845312098\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 7a09c1bd67deb6cacb409107f412d6fb3b276ae981494348227e74a10fd994fe
MD5 69a2fabb4aa147188ee4d4dab635b3fb
SHA1 0c6076beb56308bcb865cabecd6de6ff3d5bbdd7
SHA512 30927bb5e25d87d86749ed8ecb806a7297bfc2eb224a4a524b542ac7b61f73807237f95c4c847e986499d45b96ac7199bb7377e3b2b8d79ebae2b3d2f5b1e0ae
SSDEEP 768:aUfDPLSgcRUv+y4VUfDPLSgcRUv+f41fDPLSgcRUv+S4iUfDPLSgcRUv+Q4o4Oni:VS4mxBx
TLSH
T120163CA30E64A942DA85EFB0BBCDED1C7C703395EC939892E122927D4AE4FC51BC115D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Program Files\scoped_dir4036_845312098\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Program Files\scoped_dir4036_845312098\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Program Files\scoped_dir4036_845312098\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Program Files\scoped_dir4036_845312098\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Program Files\scoped_dir4036_845312098\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\service_worker_bin_prod.js
Size 129KB
SHA256 5de9e74058524e92c88ecfc5e25dee0f3d9f8af92179b33eb52638eb98022965
MD5 a884d818bbadad175baf9bee571fa66e
SHA1 d5d657d1fc86188857246cfb43e28d9e81b55c8c
SHA512 89225dd0b9e62cebc85fc66c80b3c2c4c1315ad47c2be08e1bd94058bec2d6988a96d03e2a09581d3fa7e1146d9d6050d10b117edf3aebf53f8da8c9c9331d5a
SSDEEP 3072:VkbKlHeCWDKPB/UrdJqdwgJSLIH6BTylEeRetlUGo:+oqAB6gbH6BTyGeYt6Go
TLSH
T15ED3D9CDB7A574224363A5F5002F000BB23AB8AAE44C85A8F188D9E97DB546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Program Files\scoped_dir4036_845312098\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Program Files\scoped_dir4036_845312098\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Program Files\scoped_dir4036_845312098\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Program Files\scoped_dir4036_845312098\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

32.png

Path C:\Program Files\scoped_dir4036_845312098\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 952B
SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
MD5 bf7aa030f9cbc7aba123d10adb3ab321
SHA1 d210f3194a494a65d1e32ade703e24fbbef7b444
SHA512 3be8123811222e1d5aa92e7144d41a8ace20ea1d5b082aa51d11df8f573c17f294ead72ee9e94b31259035ebd0eecb904686cf4bb22f0e5313a02756e210b8a6
TLSH
T1E311889E6EAA8CBDD1C3AE4FBD2D22904F13CE54C534BA1B4C4759573A26E54704B501
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Program Files\scoped_dir4036_845312098\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
MD5 c053b2219c4c9e7e7080cbe4e6e3981e
SHA1 0470cf45babbbe1fad32b4dec3593e8ab7a8ac39
SHA512 1271ac3ef670f3b7104c3f4e678ef4bc9990d9427826b104bfa8d31f904895da50ed0f1b673727d39355428f6270d015c0953521b26d8f10f842854b79ec5525
TLSH
T1E021B7BE5B25DE1B97EEA61F72DA9900D89221E27183A6052ECFCB6057145A33C24172
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Program Files\scoped_dir4036_845312098\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 3772d9c9a6fabba60ac0c7b9c93bf230e3c99ebac9af480efc6c778d9881dd85
MD5 cf9a569f60db18903e86e6612cf90efc
SHA1 379dccdc92399b0e4e658ad8f04276bf99501836
SHA512 58f0b5130318069511452b11b1fbdfd898577c714150f5f88a4a4ff80320b33c287c103e464ef24c8543d90de71713f2ee293f538fb078ec2099f9871cef2caa
TLSH
T132210853AFCF4AAE5834129F565C460FFBA3623E2952D409DB2A41AB08CDC14E8462C3
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Program Files\scoped_dir4036_845312098\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Program Files\scoped_dir4036_845312098\Local State
Size 233KB
SHA256 720f533dd1d1d9d615994f06f1f78be5d33f3a17b8ee3f0733e174e1e92b9baf
MD5 89de9c626c405ee90d758e20d998087c
SHA1 b7aaf3d60edb2a647f352518b525625d433ef911
SHA512 1504212b799b771097b7f9e2ca178edce237b918fbd72e69f437df7b62beccf129a6ef6e2645df087cd7abfba4009f4d0383d12d704624d9222633a632bd6621
SSDEEP 6144:0mg1kQfATCFbzQACjRm7Rkm1tYpBeh2BAo8:gneAh9oBGcAo8
TLSH
T1A934232F4EB09D7F1A655A66608A0E2E36F24F7BCE215ED481D90B4437EAECE0745C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Program Files\scoped_dir4036_845312098\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 9218ece111fd7ff74a91644cada428358010583f7d85a50d1bdbef3b50efc442
MD5 3e641733b1a52c94b6e46b29c94e9f4f
SHA1 9659d61cd39a026d85a1deac797c6b01638b489c
SHA512 3fa76eae69ae74d841926a27e0424de807b23d89d422264957daa69fa5b2a395eee61edaa0154f5cc9cc7d27b3fd53c6eb0a8d6edfc8fc7a1c1f19ceb5d8a542
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1c01acd2e36f149d4cfa4b6c337f4860a99d7cdf7d70abea30ce0ced35e6b1ec
MD5 f09312a7d448881c86d188e4bb201e22
SHA1 b0953584b84e5bfbec09cafa21e733d6fc8f7982
SHA512 8eda2114420199da34b341e1f20cfccb99ba477c62da0a977cf647cbf790338d95e8db1dd78be8ab9fd5d34992540256f68e06c0c10dadad5fbbb867cb1625d6
TLSH
T184E02BAACC21FC671CFD4B5D50904B4ADA60135B1761845F3B3C820CCFB1667028589C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b9839bcced54b5ac7dc26eea67f06971769d8c5a7d16d118e307440620a4e041
MD5 79decad8e6cee8f20d6af695e00819fd
SHA1 f1d526d917af5415962762615d65d5d52bc547fd
SHA512 8186d59ed2af267beb18cd58f7cc48a62307d3496ec0f7e6a714f10ac935fab1c3245cbb11854ce90ea3093bfea97d00cf6e8aa8112122891cb86396e450c03d
TLSH
T16F419DF743B4957E8A1196E4EA146F1FCE7D0524431C78A689D46E1B83F3972E10075F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d440eb831295b98bc23797df95b08031885317e15481578eeae69b2db9d62c77
MD5 39c6d820c858b04ebf1015fbc90d051a
SHA1 c4209396ec350f540a462ad1172172c605a8844f
SHA512 2f2e94cf3dc7c7c458d7cb632dbf049d208a5a00775b8cf4a1d4f81302cbaa4389aa9227ded9304768288e23376b7795f64cd29da36c850cf6ef900fa6e64a38
SSDEEP 192:IRQYD6l8xBrxv7ApAPRp2l9qHsb+WNnjzPOw2ynkwYDVyIsnAUge:IRQYtrhkUXmkwvPr2ynQe
TLSH
T1F142B52EFE10297B9CCBD22AF9657727E7F5102525812E84EAFC8A2C15E75CC211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 42600cdfadfb382dc157546d8bcd40142562bb3b623d81db3477267fafe562c0
MD5 12d2fb0668d02f14ddbe35ca901529dc
SHA1 b438b40aa74717ee97ac3e14712e4f485829a47f
SHA512 e252df0808a2c685b2db7c747be8f0d2c0b5f8fa656320a81adc138a5e6f3f316325d7656921181602a01558dd6db9346c98afa1020071e882290840ab5391df
SSDEEP 192:IRQYD6l8xBrxv7ApAPRp2l9qHsb+WNnjzPW6w2ynkwYY4VyIsnAUgE:IRQYtrhkUXmkwvPY2yn6E
TLSH
T14D42B63EFE10297BACCBD22AF9557727E7F5202525812E84EAFC8A1C15E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 13ea32a89b3d7c0bc042d7ca469038acc9246ce8d6ef72ed52fc3c92599a74da
MD5 9bfb20f9a0c3556ae1fb382fb28a49a0
SHA1 06a82dccd7b525879a8265f28afc4633457d314a
SHA512 df6acc6f172f9b083f7cf30f2cec74869a76e9af10f79e7ad8dbddea123eee1ac81c98f691565263104a4adfb694498b0d3f7b1e2fdc8c8ff06a8cafff2066e3
TLSH
T10BB0127080025102C05703B011421C88B1249F20E60A571543E46962C8291B18014250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a0cf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a0cf.TMP
Size 96B
SHA256 57c4a79304f448e487b6b9e7b47fc3cc57ccb9c24a031ddf23f284360a798cef
MD5 370814175a1fd39a6684ecc228fa3d3e
SHA1 7f8aeb04f25a2ed51ff7774ca5bd7cb5db48593b
SHA512 09717b62812c03453315bc2d8510957d7be9b7cedae8d8275a140a067559f6dde97c8e80a0f6224a058d27977a57bc2299db16cae3874007ec98c02a84af8f91
TLSH
T1BFB0026AD1166212C04243B025D5F5E872A0DF27CA031323A3E41A7ADC2577145255F1
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e56314f30b2318fc43dbdd9aacd857db668f33672962446561f7718954d41bf3
MD5 da92e1577b21dfb95b2aad1085cbeebd
SHA1 e9858610e1a0463f2a4847707b2cc388447f56cb
SHA512 b649806a4df1f5730bf19a8e91c40c8bccd5f65a59ccb43102615993bd0c962dff6667fa9b3401d1fbdd28be06d35d4285ca63d0a76b2551cfdffdd3c47d09c4
SSDEEP 3072:OkGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Am7Rkm1tYpBeh2BAog
TLSH
T135C3023B5D64E8375DB5F71EB08E0A1F1EF149A7C920DE92C8D85B0427EA7CD0A45A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 27133b4c170065c3367f5f247866b5ba8d5b30f4f308f49ed733f1f104886bba
MD5 99313659f7a2df46acd45e545270011b
SHA1 db531f21c8e86d7836f309ea9bbd9e7718f8b2b0
SHA512 3052ff19cdb91e515dd2ff2fe4b6dc1f6660bbf7f7a2511ce7d0d8aeb02e9fac4bee50d51c3b60cd25a55c2661e689d20586bd754bcba637250591f9b0b99129
SSDEEP 3072:FkGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:xm7Rkm1tYpBeh2BAog
TLSH
T109C3023B5D64E8375DB5F71EB08E0A1F1EF149A7C924DE92C8D85B0423EA7CD0A45A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 eaaef6d273e12ee11a2ad71734b85d32ca3dc64c1dce7f2570643da20c7366ba
MD5 146ff4da8b02e1d0cc8620b175e13365
SHA1 93acceb98d3260add102a1f7398187121a174e92
SHA512 1170a3d7a3c2a17b4a2ff78f81cfae4aa81d8972a34033872f10e35304c418558e23391f9f56cc1d92f064586b95ed3fd7e30f1a6ef5803bc46b8312cf9b88a8
SSDEEP 3072:FSGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:rm7Rkm1tYpBeh2BAog
TLSH
T16AC3023B9D75A87758B5FB0EB04E0A1F1EF249A7C920DE56C8D85A0433F97CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 51b316929e30d64dcb52b35b09f46e4e572089aa954e4e29482c6213318a0da5
MD5 bf3af5b96fc37d1c3dc3ba39dc484b4f
SHA1 0664927ea3bd3ee61eda2955beda568710f77cb8
SHA512 b38916ebd6410a63c1520fed4ced2b65d61bc030e89929a2c835cefbe536d14aafe317ae7ea7a9163767bfa7fb23fed76a75ebcb2a69e19419d89ae3911e850f
SSDEEP 3072:AmGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:mm7Rkm1tYpBeh2BAog
TLSH
T163C3023B5E75ED3B5CB5A74EB08E0B1E2EF149A6C920DE92C8D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee285976-d4df-4eba-997a-f988def06267.tmp

Path C:\Users\Admin\AppData\Local\Temp\ee285976-d4df-4eba-997a-f988def06267.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

485d4650-04f2-436b-a0f3-45bdd01c4952.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4536_1279689027\485d4650-04f2-436b-a0f3-45bdd01c4952.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4536_1573589998\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Número de pedido 25-08526.z.crdownload

Path C:\Users\Admin\Downloads\Número de pedido 25-08526.z.crdownload
Size 2.5MB
SHA256 fc4e69fc28a2af556e3897f9893fef51eb99c0edaddedf94febe12667e5be602
MD5 7d76d25450f6b391fc8e0cbb1caf719a
SHA1 a3179ac2f74f454fe0fdf6f69701b5446ba4ae93
SHA512 900bff1c1ff06a81511b444a8707f45d7e6657625c19774bdf34bf62d157db2c1760a1a2b1b607757e4930f5da84d492f54a28f4747e51fca944bb14f8c88afc
SSDEEP 49152:riY66MOWxGDPVRDFHLeJ9MQTHB+teB9gmRJn1UEV1oLvjCh8InTzPxyEpM:udXEPVjreJVTH4xQvfoLLCF3xZy
TLSH
T1A5C533A27167BFD45DBF8A158C31D141189C3A416E3A70CBEE0D28AEBC9075F8B2F615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Número de pedido 25-08526.exe

Path C:\Users\Admin\Downloads\Número de pedido 25-08526\Número de pedido 25-08526.exe
Size 3.9MB
SHA256 1fae7d654695f7c4e0f4bb8a42a4c33137652effc360b998708c6ffcac1380e6
MD5 bf62f6760a9b86f66822fa59140aef8b
SHA1 a71dc7dff873a5341ee93a254fa43e61f85298de
SHA512 f47af18705dfd6beec15109c227ca614dd314ce7a5dc4c19b10fc5388d07cd5990e5ea09128235cd88b595eef91a7c0e63e091bf8fc9947479f3d5d8167d9d31
SSDEEP 49152:eYqEK9Q8jm5Uzq0LYxjvOPg+BgAiyg8xK90g/u8KwQ61PwST3:lwQD0LYxjvWa3mz8NB3
TLSH
T1A1168C17F68903F9C09AC1749B579162F626BC2A2B3562DF364CB2141F7AEE04B7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secur32.dll

Path C:\Users\Admin\Downloads\Número de pedido 25-08526\Secur32.dll
Size 3.2MB
SHA256 23d5cc5a66ddfa82bb8d28e985d2671548d39ed267d4d7919801ef9632d9b99c
MD5 f9b1412f6fe30486ca2fac65573cea09
SHA1 01fac7fdd4bdad616dc3c15f444d8a0e7cf7047e
SHA512 5c5e900b9cf1abfb06921d2be766351cd4a4deced2ced0169c9904246ba18d555a45192ee015498d6c5eb6ed8490da059f48007c093f95ab027972f7bd19747f
SSDEEP 98304:rI/nu1Tn6TRKUTBcLrmIg+yFTGIxzNgzv:8uoTRhig+yFTGIx5
TLSH
T164F5AE05F7C806A9D66AC678CA1BE723C3F1BC570735A19B1692335A1DB3F925B3B201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\Downloads\Número de pedido 25-08526\debug.log
Size 1KB
SHA256 2b1273f42c11a64730963b6d492775b27a40dc5c30e52d94f3c1805cb533f8d1
MD5 0643841a9ab7edace00b1b154374fbd3
SHA1 4c334106aee354041651380ca484e1a84f111415
SHA512 1ee2d48e9f2fd88bc758e5bf446b27c5d4f25c556e0d95fe86616ab935c0cb7592372d1c973ea4254af98d44110f45a4fc2d961ba923e1dc71a154bc36fe4976
TLSH
T184412029ACC0F21BA1B7412BE7608283EE768763454B4078F0CC076B2F7508B6147E27
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4932-253-0x0000000006610000-0x000000000661A000-memory.dmp

Download

memory/4932-250-0x00000000064D0000-0x0000000006520000-memory.dmp

Download

memory/4932-249-0x0000000006430000-0x00000000064C2000-memory.dmp

Download

memory/4932-218-0x00000000052B0000-0x0000000005316000-memory.dmp

Download

memory/4932-125-0x0000000005680000-0x0000000005C24000-memory.dmp

Download

memory/4932-105-0x0000000000400000-0x0000000000442000-memory.dmp

Download