c05b0ff470f3a0c7d8679d48217c35c8d473c406d8cacaadd8993073cd60b717

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe
Size 24.5MB
Sample260707-b85phscw9p
SHA256 c05b0ff470f3a0c7d8679d48217c35c8d473c406d8cacaadd8993073cd60b717
MD5 a42b2d741433ad756ab8f23893928b44
SHA1 77f24d5d9d99fbddde12a079f40c41142dc67b2a
SHA512 0257613e0a07b46b69b3278b024aef37e29eb30e2df1acb8c58bed36ca44fd4a40d40a1eac92f67ca93cbb08511a8165e390a70d0547cd27e63b647869824cc1
SSDEEP 393216:VyZ/K0ttYZTEqayZ/K0ttYZTEqBWqQjp3:VyZ/K0ttYZTEqayZ/K0ttYZTEqUfjp3
TLSH
T166477D03F2A841A9E06AD178CE669732EB727C494BF165DF224076D52F33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5872	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{BF213A96-8429-4618-B746-82003FDA5317}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{63E13C03-813C-4B9E-97EF-175C58E66905}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
120	chrome.exe
120	chrome.exe
5876	explorer.exe
5876	explorer.exe
120	chrome.exe
120	chrome.exe
4348	chrome.exe
4348	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
120	chrome.exe
120	chrome.exe
120	chrome.exe
120	chrome.exe
120	chrome.exe
120	chrome.exe
120	chrome.exe
120	chrome.exe
120	chrome.exe
120	chrome.exe
120	chrome.exe
120	chrome.exe
120	chrome.exe
120	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	120	chrome.exe
Token: SeCreatePagefilePrivilege	120	chrome.exe
Token: SeShutdownPrivilege	120	chrome.exe
Token: SeCreatePagefilePrivilege	120	chrome.exe
Token: SeShutdownPrivilege	120	chrome.exe
Token: SeCreatePagefilePrivilege	120	chrome.exe
Token: SeShutdownPrivilege	120	chrome.exe
Token: SeCreatePagefilePrivilege	120	chrome.exe
Token: SeShutdownPrivilege	120	chrome.exe
Token: SeCreatePagefilePrivilege	120	chrome.exe
Token: SeShutdownPrivilege	120	chrome.exe
Token: SeCreatePagefilePrivilege	120	chrome.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	120	chrome.exe
Token: SeCreatePagefilePrivilege	120	chrome.exe
Token: SeShutdownPrivilege	120	chrome.exe
Token: SeCreatePagefilePrivilege	120	chrome.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	120	chrome.exe
Token: SeCreatePagefilePrivilege	120	chrome.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	120	chrome.exe
Token: SeCreatePagefilePrivilege	120	chrome.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe
Token: SeShutdownPrivilege	5876	explorer.exe
Token: SeCreatePagefilePrivilege	5876	explorer.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
120	chrome.exe
120	chrome.exe
120	chrome.exe
2352	sihost.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe
5876	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3460	StartMenuExperienceHost.exe
6068	SearchHost.exe
5876	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 5664	3880	2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe	89
PID 3880 wrote to memory of 120	3880	2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe	90
PID 120 wrote to memory of 236	120	chrome.exe	91
PID 120 wrote to memory of 5872	120	chrome.exe	92
PID 120 wrote to memory of 4788	120	chrome.exe	93
PID 120 wrote to memory of 4788	120	chrome.exe	93
PID 120 wrote to memory of 5636	120	chrome.exe	95
PID 120 wrote to memory of 5636	120	chrome.exe	95
PID 120 wrote to memory of 5724	120	chrome.exe	96
PID 120 wrote to memory of 5724	120	chrome.exe	96
PID 120 wrote to memory of 3976	120	chrome.exe	97
PID 120 wrote to memory of 3976	120	chrome.exe	97
PID 120 wrote to memory of 4268	120	chrome.exe	98
PID 120 wrote to memory of 4268	120	chrome.exe	98
PID 120 wrote to memory of 5488	120	chrome.exe	99
PID 120 wrote to memory of 5488	120	chrome.exe	99
PID 120 wrote to memory of 3240	120	chrome.exe	101
PID 120 wrote to memory of 3240	120	chrome.exe	101
PID 120 wrote to memory of 2084	120	chrome.exe	102
PID 120 wrote to memory of 2084	120	chrome.exe	102
PID 120 wrote to memory of 3944	120	chrome.exe	103
PID 120 wrote to memory of 1864	120	chrome.exe	104
PID 120 wrote to memory of 1864	120	chrome.exe	104
PID 120 wrote to memory of 3384	120	chrome.exe	105
PID 120 wrote to memory of 3384	120	chrome.exe	105
PID 120 wrote to memory of 2676	120	chrome.exe	107
PID 2676 wrote to memory of 4424	2676	chrmstp.exe	109
PID 2676 wrote to memory of 3528	2676	chrmstp.exe	110
PID 3528 wrote to memory of 4548	3528	chrmstp.exe	112
PID 120 wrote to memory of 4408	120	chrome.exe	113
PID 120 wrote to memory of 4696	120	chrome.exe	115
PID 120 wrote to memory of 4408	120	chrome.exe	113
PID 120 wrote to memory of 4696	120	chrome.exe	115
PID 120 wrote to memory of 1716	120	chrome.exe	114
PID 120 wrote to memory of 1456	120	chrome.exe	116
PID 120 wrote to memory of 1716	120	chrome.exe	114
PID 120 wrote to memory of 1456	120	chrome.exe	116
PID 2352 wrote to memory of 5876	2352	sihost.exe	117
PID 120 wrote to memory of 2900	120	chrome.exe	123
PID 120 wrote to memory of 2400	120	chrome.exe	124
PID 120 wrote to memory of 4264	120	chrome.exe	126
PID 120 wrote to memory of 5376	120	chrome.exe	125
PID 120 wrote to memory of 2900	120	chrome.exe	123
PID 120 wrote to memory of 2400	120	chrome.exe	124
PID 120 wrote to memory of 4264	120	chrome.exe	126
PID 120 wrote to memory of 5376	120	chrome.exe	125
PID 120 wrote to memory of 4520	120	chrome.exe	127
PID 120 wrote to memory of 4520	120	chrome.exe	127
PID 120 wrote to memory of 4040	120	chrome.exe	128
PID 120 wrote to memory of 1608	120	chrome.exe	129
PID 120 wrote to memory of 4132	120	chrome.exe	130
PID 120 wrote to memory of 4040	120	chrome.exe	128
PID 120 wrote to memory of 1608	120	chrome.exe	129
PID 120 wrote to memory of 4132	120	chrome.exe	130
PID 120 wrote to memory of 5476	120	chrome.exe	131
PID 120 wrote to memory of 3344	120	chrome.exe	132
PID 120 wrote to memory of 5476	120	chrome.exe	131
PID 120 wrote to memory of 3344	120	chrome.exe	132
PID 120 wrote to memory of 5940	120	chrome.exe	134
PID 120 wrote to memory of 5940	120	chrome.exe	134
PID 120 wrote to memory of 5052	120	chrome.exe	136
PID 120 wrote to memory of 2128	120	chrome.exe	137
PID 120 wrote to memory of 5916	120	chrome.exe	138
PID 120 wrote to memory of 4348	120	chrome.exe	139

C:\Users\Admin\AppData\Local\Temp\2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Users\Admin\AppData\Local\Temp\2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-06_a42b2d741433ad756ab8f23893928b44_amadey_cobalt-strike_emotet_hijackloader_icedid_luca-ste.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b8,0x2bc,0x2c0,0x294,0x2c4,0x7ff6d10fb618,0x7ff6d10fb628,0x7ff6d10fb638
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xc0,0x134,0x7fffb727c728,0x7fffb727c734,0x7fffb727c740
    3⤵
    PID:236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1512,i,13865452069236029436,403511181877942683,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,10783551164786947342,13386506273649453708,262144 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
    3⤵
    PID:4788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2248,i,17441340628755279619,13255715811530851072,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:13
    3⤵
    PID:5636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,4786111026100214127,13506108614227164875,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:5724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,242605506987088876,3473792612467451983,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:3976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4660,i,10451730791429573567,1337166821825654564,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
    3⤵
    PID:4268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4840,i,6226932456079317408,14970478930695063485,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:5488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4860,i,12200782013848338227,9444669977429517068,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
    3⤵
    PID:3240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5184,i,7287131152671583413,6723450827704108818,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
    3⤵
    PID:2084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5448,i,3641609213743301341,9801020319425830912,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:3944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5460,i,15663106856490267171,1306511725174092910,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:1864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5496,i,14993139233400530879,14037962451971474081,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:3384
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x244,0x29c,0x7ff6923155a0,0x7ff6923155ac,0x7ff6923155b8
      4⤵
      Drops file in Windows directory
      PID:4424
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:3528
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff6923155a0,0x7ff6923155ac,0x7ff6923155b8
        5⤵
        Drops file in Windows directory
        
        PID:4548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5780,i,14016457746271362737,759951021828536010,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:4408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5772,i,7013905575438432762,12851413833044067770,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:1716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5748,i,1132380266113035813,5519995361032400944,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
    3⤵
    PID:4696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5636,i,10518595125651054827,9733972033242172099,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:1456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5472,i,3852370157848861022,8794062186182230115,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
    3⤵
    PID:2900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5460,i,13288499646009601550,12736357578365569176,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
    3⤵
    PID:2400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6376,i,1922020042668216463,3150663122735204850,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:5376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6212,i,6022452882896128662,8729783579580553572,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
    3⤵
    PID:4264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6548,i,15555043677585848078,5598331815992102211,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
    3⤵
    PID:4520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5772,i,6115776621637255507,16896688494919695147,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
    3⤵
    PID:4040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6512,i,11405783987419828846,15952493162024206818,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
    3⤵
    PID:1608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6528,i,4698357826361438103,5687321364729472754,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
    3⤵
    PID:4132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5468,i,8250171883162826928,17189737175208303294,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
    3⤵
    PID:5476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6424,i,2340111246847286018,12210773943003338233,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:9
    3⤵
    PID:3344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5548,i,16076255959885353102,6104331466809706930,2097152 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:9
    3⤵
    PID:5940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6416,i,5594027618080010581,17895173667420930375,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
    3⤵
    PID:5052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6440,i,13577174488638325806,11316017644898379042,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:2128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6428,i,2570431554672955735,9555296928464688295,524288 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:5916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5916,i,5084569608376671470,8689718435607709703,262144 --field-trial-handle=2040,i,422014686314077388,2703676422482425581,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1244

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5184

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3460

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2676_13427862614704965.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2676_13427862614704965.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

3528_13427862614679428.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3528_13427862614679428.pma
Size 696B
SHA256 9d1cf6c77ca188e114bbaf2ec86ee9d45c6f8b0034caab020bcb628e8c7a6aa8
MD5 4362ad481c2cc439b57f907300dc3895
SHA1 3fd9f2b551c302e3dd1d02d6175b4bd4655bef12
SHA512 8fbbea7cd5d35a85c4f99734319c0a076b9659e26b5e2ad54b9364d35096f93caad0182a814bbb76d15a7a31aed75c3912959c5787590198002605a9db274852
TLSH
T1E201054563144F77CC468D35C4FE27552BB4FA502B4217FF7710714F2E011C89E99164
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a5a415c73cd7abcf3bdcede5e657d6e1a4082dc5117d34b59edba4e2ec34127f
MD5 1b1f4a29bf1e9582629bb9bd8c324d84
SHA1 ef930e6d76d22160ab97b5204d05fce9b7d64af7
SHA512 cd0251435970c9766feca24ba99196271d196306d555e48ae522b585e0cb1208d7c98d00ac93eea0fee49f4630b7ef60c16037353500135a4e3171e8fa19d43b
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\service_worker_bin_prod.js
Size 129KB
SHA256 5de9e74058524e92c88ecfc5e25dee0f3d9f8af92179b33eb52638eb98022965
MD5 a884d818bbadad175baf9bee571fa66e
SHA1 d5d657d1fc86188857246cfb43e28d9e81b55c8c
SHA512 89225dd0b9e62cebc85fc66c80b3c2c4c1315ad47c2be08e1bd94058bec2d6988a96d03e2a09581d3fa7e1146d9d6050d10b117edf3aebf53f8da8c9c9331d5a
SSDEEP 3072:VkbKlHeCWDKPB/UrdJqdwgJSLIH6BTylEeRetlUGo:+oqAB6gbH6BTyGeYt6Go
TLSH
T15ED3D9CDB7A574224363A5F5002F000BB23AB8AAE44C85A8F188D9E97DB546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 612b4035cf2996bbaee08399e0b964f093cb52347741bbde568496b31c51ec2d
MD5 6b8fe1828caf0f961cbc3067c0b32ee5
SHA1 633a0c8ed8581a2530b00525a53bd2bf80d71490
SHA512 a43cf352b86c972d923e15fba13a177bc1084a9dd3e1c4753f3ff1d1928f13f03a26dd40c07ebfb69698a0f77d2303c66eecd4a582a004b9412dc9fd17b3623a
TLSH
T1CC519DF3C3D8867D880152F4AB217E2FDD2D0E24422D3C62C9D8AE5F53E2872D21064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 9670fcdf1df54f23c51373c6f09962a8b256b741fdd240423240597674fb0540
MD5 23b07e177aadc0aaeeb3a2ad03a1d951
SHA1 41c66c74de3fead9a8b89e02d34c90869a7c8bce
SHA512 f9866dfd3ec0e66cc482ff0d5c44a072714cf4d81dc953906442cf4baa70c839c247e3a3909553a02946b12ad4a642993c6f43f1622ddb751feba2bfca5d3300
SSDEEP 192:2R8Bi8Lv79pAPRp2HXsb+WNnOk2ahiyIsnAUgR:2R8Bi8zhUXMXwJ2XR
TLSH
T1AB12952EAD64753B4CCBD26EF9A57763E7F5202521D02D88E6F88A2C12D79CD2313117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 8e787a0085bcbbc78d0441da811f6a99ad90dd2c5ba415f2ee6a10f3f8d1b247
MD5 9e0d41a572835d3fc9df5d497e589b35
SHA1 16c068929b59e42dbc3170eccaeccdcbf7ae0a76
SHA512 2ee6e14ba4abd3af9dc00b31022c2ccf8ccb077ae5ae1ca0a2dbea335c83152d8cec07b8b5dba503993e7728568c31b9ae31c087d6efc1fef31f7a03a18384c1
SSDEEP 192:2R8B/sd8Lv79pAPRp2HXsb+WNnOk2ahiyIsnAUge:2R8Bkd8zhUXMXwJ2Xe
TLSH
T19622B52EAD24753B4CCBD26EF9A57763D6F5202561D02D88E6F88A2C02D79CD3317217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 42c1ac04f55e19a7dad610f41a8b4ddb44c26dc6ab81b7017cf6e4910dea31b4
MD5 3f3223bafad582e1623d45008201982d
SHA1 58316d6c25bd2b75ec4a7679f79918febf417d30
SHA512 248373daf6fe9b07eecccdb187103743c3efaafe36c71abc5e00904bc93316e19a09f822e8ddbd5c9e8937c86506a0eac83675715b185db9df472998f922c85e
SSDEEP 192:2R8Bjesd8Lv79pNPRp1HXsb+WNnOk25MiyIsnAUgE:2R8BjDd8zhbXlXwJ2TE
TLSH
T1FF32C42EA920753B5CCBD26DF9A57763D7F5202521902E88E6FC8A2C02D79CD3313217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59cb55.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe59cb55.TMP
Size 3KB
SHA256 e64273f0d211874735e9d6085912427f1e6d701d4b31c0a4abe8a4757550b4f7
MD5 ad0550e059719c4600a17513fe00452b
SHA1 cd41e19e659a27fa2c61ee4933a53fd014169ed2
SHA512 d443a4469acaabc9d4695dbfd3f3d7b8ab535f590bd5fe90d33a83b725caeab494df76d87d15dc5b3a6b0339042016bce1d9af73148d58e962b103f252464a75
TLSH
T150613F1AC5384CB71DB566B5786A4B81FA5243BF038118073C3E15CC4FB3A6B8182F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 7f670b636d17d594854b0f1ae6292f07e636ecfb5dafdd1636d31b6f2d00e1b1
MD5 e2eeaffb5f641b6241c27abf0a16db9d
SHA1 617d93c636f93c8b57ce9e9844568814699ef3df
SHA512 276f4ebc8d18aae842f0cd6004d1d0d79b111c4c136ab6b926de89bcdda3295939e29869bddc02f22f83047fa498abb969b053ede833e89c987b16734c60ba82
SSDEEP 192:eOl4K66E7KxkXqK4I40pUZNCgVLHrKHfFKslE5WMXzKD/bC+ErUkKN9ZognF+c3J:vljpE7KxkXqKf/pUZNCgVLH2HfgslFME
TLSH
T1DA32D917684D9A7B4FD8D51DCC136F4BADB502D773780C2492FB6D0803A678E224A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 969fbb6282e5570496303fae19f1a7a93b41e485c5f5f6f6e5aaf4b29e5756a7
MD5 56b9a649ca44700fdcbd941b60af3eb4
SHA1 7c2fe7718937bec402466c71e1bc221594a02e67
SHA512 f82141a18c611fb1c03ec2c39aa81908540f871b219e39bcc2a0adaaeb5d558434712246fc61754b220bbcc3805f56264bd09760525455b1a6ef0afbd8931c01
TLSH
T1D4B01219804A3B02C85045742506508C33219F3590012743DAD05DC5CC971F04263204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 cdadc09cdf1fd3f877922530e4180c87e65bfc50b5bb88ccb558517e10a9d576
MD5 d1711bc96d91895b76e3743c5e9b2236
SHA1 fc6636dab2820ca8b6ae2c673b2ccf4408d1e599
SHA512 224948e136e1862e213346c6fa6f01c5cb698468424c098fb01308722b1feec0db01f6d5591dcffb81695b735d2c2c895547737bff6aa4da2780bb9cdf30e2f4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 08c9068de35eff9fb6c6ab1e2cf68714ab60e828a91c29547440d9d8593daa19
MD5 d0ded21ddbf3fa98b2ff36b87897a0e4
SHA1 366102efb66d22ca4adb9948b7c89d3f1cc8cd07
SHA512 39a7a808380d64b1cbeca7f18b97d4e3e8c6dd5f8247d47c7a933659f780c72f419e4e42d77ff6ef64cc20b3dface9dfdf7656a13e36e5023e8397d682c620cb
TLSH
T13FA00220C9C01967CF04C6707061055172A1C8355AD15303DCF2194DA99F6C04923501
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 95ea523c9f6856f93339491047cdcc93ea95c081d9e891e391255fb5118a2214
MD5 2cb3e63a8075bc4198cb7d68c6960016
SHA1 f0820d1f5411e47cc49e9377924ce113a2533709
SHA512 d120f3461ccc91109e2c937bedf0ab6543664564fd003468795d33c5438b6f293f124a77e50c476a2ec319e53f44b20a210cf236a91923ae7a1af2b1adc1023a
SSDEEP 3072:/R2NIta4ve9auPH/zCcZNql396Yl4XEZABtcgOtgQB71:J2saoajPH/Gc7qlgYl4XEZcK1
TLSH
T16EC312325E2A5AB15CADA0A370031F0FDDDDE221F0A1CA554BB70312EA82BDFC685995
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e2ab3203568d4d0125f4366ab6bfc2bfe870d891bd3583e562e041ca4459fc2a
MD5 81d87a08ba1e0f23c41a975bc27c709f
SHA1 3771bd230903d752ea7598c87f205ce05e027d7e
SHA512 7c130336fd9181c09dc7b40cbc439b888797ba66145460dac67987bd4e3146cb5f8e191f47510d11a587320f373aa0518c0422e258f12964f3b9ab211097d5aa
SSDEEP 96:/C6Gd+d6+YqlHQS6tfaczygHn7fORDotok5aRDiB6OdGyvuXvZVkybhvv4a:/Cpq6+Yq2S6Fyon4DUDMiZwVZVkybhL
TLSH
T14CA10A72A87ADD77597AD48879827E13CEA8626B66216F84ACDD0F0C52F70EC1343213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 dc8c90d34dbd4bd38f2d7daba520ab746678a5e874abcfcccee80a9e73431cf2
MD5 b27c5c7684076afae740356bc13f7578
SHA1 e52fe24b75c57a3911695348be1e6e444d53152a
SHA512 3bd1eedb1353b5012da6214b853a35f42b7e62f155f2dfba8a49cf8c4aa6474646b9c8694e7dd6afbd8f15d85f33a0e877a6c60dfe75445778c4d90684ba9083
SSDEEP 3072:cR2NIta4ve9auPH/zCcZNql396Yl4XEZABtcgOtgQB71:w2saoajPH/Gc7qlgYl4XEZcK1
TLSH
T12AC312325E2A5AB15CADA1E370031F0FDDDDE221F0A1CA554BB70312EA82BDFC785995
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 1218aecd57a4b9d9989a1187c7dc921e7c762cdb84b13df4895714b2cb125c57
MD5 66bf5bd1b23829d3db9a840f19d7c25e
SHA1 ead97171b6098554895fe0b496bcfc4262c1b31b
SHA512 203367d5a69414ebff1a6e7de6b2deea89d3635b07950f3a363ca63fd4842e8d3ca93fdea5a933fbebd61e36ec74052ca4e532781b8bfafe57d0b7006af588bb
SSDEEP 3072:WR2NIta4ve9auPH/zCcZNql396Yl4XEZABtcgOtgQB71:m2saoajPH/Gc7qlgYl4XEZcK1
TLSH
T1DBC312329D2A5AE25C7E61A370431F0FCCECE223F065DE595BBA0312DA81BCEC746595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir120_651530756\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 c48e0cb9259f8b60d68c8df10f2e447c717a38d4cde652a8ef3341d414e9a98e
MD5 7eced2900709d8a4702b7348b09c9594
SHA1 a845c488fd030170a3c3dd684c98347b01cf0f73
SHA512 ec8e51cd93b51d5bee22ab934b26cd9833b7f2edcb654c7b8b992a53e8c1516b3d1bb3df2fee5a9cadbfd31b0cef1eb710648615709ea78d097cda030c818638
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 89009667d29fb06f64b13931486dd6d8cdb1d9e1dfd881544f09d36710873d05
MD5 49d7da0f382c564e86519c95eaedffb1
SHA1 5ffda4d88cbdb9190bd49b4f1046f79dacf8af51
SHA512 b73ea1c5a138d52fae399e60d00999c6611a3f5c7eac78e83d6ff190c1cbaae2a66d1a1891ce80d24c1b67b8695485d060438e2fbc5496c7e44dea4c09a219bb
SSDEEP 96:qeawnKvkXU8BUbHw9sNSDfhK2zK2SGqf1QhvNn7JVZhK3uK3f50:eZG91VwMNbRSq
TLSH
T174D1CFDA8E0648AF7AC18B3B329731915D97140AC7D4A4727BDB8A02F0CA9A4011F5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5876-976-0x000000000F560000-0x000000000F6CC000-memory.dmp

Download

memory/6068-177-0x000002EDBFE70000-0x000002EDBFF70000-memory.dmp

Download

memory/6068-222-0x000002ED943A0000-0x000002ED943C0000-memory.dmp

Download

memory/6068-195-0x000002ED83AA0000-0x000002ED83AC0000-memory.dmp

Download

memory/6068-188-0x000002ED83B80000-0x000002ED83C80000-memory.dmp

Download

memory/6068-187-0x000002ED83940000-0x000002ED83960000-memory.dmp

Download