4ed12d2ea3bca3395ee52fdec83ec304042d30d0e070233d79299e99809749aa

Analysis

user interaction
yes
max time kernel
326s
max time network
327s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Qivnspkxz.exe
Size 321KB
Sample260712-cd8ncses4x
SHA256 4ed12d2ea3bca3395ee52fdec83ec304042d30d0e070233d79299e99809749aa
MD5 9c61ba236051ecdd0cadb11da84f4f65
SHA1 212e168d0b707be584a56e5fbe0c4a353ae74a8c
SHA512 1c274339019fbed06945f265f66d9d4302d20e885d42ecaa1a72eadb008cdad21c6487e36ec0f29cbf7ec8223bdc86d273d3ec3c0969a1ed5aab180b951fc1b8
SSDEEP 6144:s5XNB2xBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:sJZu3TCIyESY+z8WHH
TLSH
T1D3648D5823ED8A26E6FE62B5E83D440D47FAB51A612EFB4F199010FD6C13B8449017BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qivnspkxz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tcpview.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1648	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	tcpview.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	tcpview.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282951406086023"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "213"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
5108	tcpview.exe
5108	tcpview.exe
3864	chrome.exe
3864	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5108	tcpview.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeDebugPrivilege	1672	Qivnspkxz.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe
Token: SeCreatePagefilePrivilege	2096	chrome.exe
Token: SeShutdownPrivilege	2096	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
5108	tcpview.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe
2096	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5108	tcpview.exe
5108	tcpview.exe
5108	tcpview.exe
2416	LogonUI.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 5028	2096	chrome.exe	88
PID 2096 wrote to memory of 4904	2096	chrome.exe	89
PID 2096 wrote to memory of 4904	2096	chrome.exe	89
PID 2096 wrote to memory of 1648	2096	chrome.exe	90
PID 2096 wrote to memory of 740	2096	chrome.exe	91
PID 2096 wrote to memory of 740	2096	chrome.exe	91
PID 2096 wrote to memory of 4492	2096	chrome.exe	93
PID 2096 wrote to memory of 2908	2096	chrome.exe	94
PID 2096 wrote to memory of 4492	2096	chrome.exe	93
PID 2096 wrote to memory of 2908	2096	chrome.exe	94
PID 2096 wrote to memory of 3340	2096	chrome.exe	95
PID 2096 wrote to memory of 3340	2096	chrome.exe	95
PID 2096 wrote to memory of 204	2096	chrome.exe	96
PID 2096 wrote to memory of 204	2096	chrome.exe	96
PID 2096 wrote to memory of 992	2096	chrome.exe	97
PID 2096 wrote to memory of 992	2096	chrome.exe	97
PID 2096 wrote to memory of 736	2096	chrome.exe	98
PID 2096 wrote to memory of 736	2096	chrome.exe	98
PID 2096 wrote to memory of 3188	2096	chrome.exe	102
PID 2096 wrote to memory of 4508	2096	chrome.exe	110
PID 2096 wrote to memory of 3768	2096	chrome.exe	111
PID 2096 wrote to memory of 4996	2096	chrome.exe	112
PID 2096 wrote to memory of 4748	2096	chrome.exe	113
PID 2096 wrote to memory of 4748	2096	chrome.exe	113
PID 2096 wrote to memory of 5876	2096	chrome.exe	114
PID 2096 wrote to memory of 5876	2096	chrome.exe	114
PID 2096 wrote to memory of 5372	2096	chrome.exe	115
PID 2096 wrote to memory of 5372	2096	chrome.exe	115
PID 2096 wrote to memory of 5720	2096	chrome.exe	116
PID 2096 wrote to memory of 5720	2096	chrome.exe	116
PID 2096 wrote to memory of 3140	2096	chrome.exe	117
PID 2096 wrote to memory of 3140	2096	chrome.exe	117
PID 2096 wrote to memory of 4500	2096	chrome.exe	118
PID 2096 wrote to memory of 3864	2096	chrome.exe	122

C:\Users\Admin\AppData\Local\Temp\Qivnspkxz.exe
"C:\Users\Admin\AppData\Local\Temp\Qivnspkxz.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa5f9ec728,0x7ffa5f9ec734,0x7ffa5f9ec740
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,15986951734673923797,5413869014081302027,262144 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,2686701161486025325,13456872303399624331,524288 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,10062139622438569679,8649987387792036181,524288 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,2821781279377248810,3840067716195623310,2097152 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,5970514730959108471,10870790417360234960,2097152 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4376,i,9952227889990795714,16113707282057620962,2097152 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4576 /prefetch:2
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,341916055354844146,18053029941997893132,2097152 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4844,i,2418201821365002780,5784174206793775907,524288 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,9241668477710450736,16870623881551502299,524288 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,16209681490964339556,13195077202759079019,524288 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,1491842962787304888,18432060945536862068,524288 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,7090406770707475801,3457664503587670549,524288 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,2855383592869705669,6036828659866299437,524288 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5820,i,2788002760998531627,2574549738003144109,2097152 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1228 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3576,i,3899033941633746973,15675811114886398933,2097152 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3456,i,3306640793592646442,13491929928874368321,2097152 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3588,i,11927137005744127608,3493766564524422633,2097152 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4624,i,11796620520719939297,7045614118349548441,2097152 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,1729523164868679060,7434071762037670546,524288 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4840,i,2685880722436350464,10205089189551883521,262144 --field-trial-handle=1944,i,8342281405565514483,4656624845282239343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3780

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5344

C:\Users\Admin\AppData\Local\Temp\Temp1_TCPView.zip\tcpview.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_TCPView.zip\tcpview.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5108

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3962055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d7f7c126f0f4ecd43bb27b2953edf30f4ee6946334a830573e832d5fb7f889f4
MD5 b9c57f6f24cb462177713dc088bde135
SHA1 d556060e5117c57c61fe106e5db88cffba8ac81b
SHA512 e4f0d3441b2b0d6ccf63312d5946bc5b9e3d0df861fae496b9d39d805858ceff7dbbfdb847141e4a38c41ce20bb423fd1b024fefa0c9a19ce405fd25c72c20a9
TLSH
T1CFE0ABAAC9309D2B09FE071834080386F64023073B41851B7A3CC309CFB86761596C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 768B
SHA256 3ecfe28182a7d8104bf0891623714eeae6a4127694336a0cdd42e848384c72af
MD5 542bd4927b51253b0aa96a4bcf69d313
SHA1 833c016ee8ef0dba87dac2af444703e7e8c01635
SHA512 93d98c114ef9efd9378bcda0ea793e40084de379b28c52a31b6d0b2c2a17f300a6b54b8f1284f1c7c0413c030d3ff62a39627caeedd4a4047c377022d1cd6682
TLSH
T1DC014675B1B32202EF24513474F249786E785D4E0FC1E7BA8EA7D7446A015B5230C30E
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 6373d8fea41c16ea7e28f6af0efb676c43b91c7fe0a7d87b685344fd5c8b5003
MD5 dfef14143a2948affe5d28eacb9b1efe
SHA1 c3da2743e22e401c1ff730213750f284c9a6b13b
SHA512 2d00851f460580a5eea7319ca6ba4bb23955a94a0c4005f240ddc33f3cc30149aeb458f2cc6df7f02e4ef45832e2e4dabc385498e88ace25ed998b15dbcdefb3
SSDEEP 3:MsEllllkEthXllkl2zExllfKK//:/M/xT02zbK/
TLSH
T140440405FFD04405CD0110304437C3500371D430153157533CF144337CC5540CC10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3b745054b8c2b6f447c55756f43448f7dba661acd8f9605bcfa0c11b2579ea6b
MD5 7da14768598e043b7a1715477fad5e64
SHA1 b111669c2cc41a1164345ad01d1fe61dbfac474e
SHA512 aa4412ac691a584e32c7e4f7de0a91addbb5d0a83acae39b26c4192559c1bc2caa88bf960f7c7467f640c1421ffeb9d6548e85a7150ae0f7f8bb5f4f02c7162e
TLSH
T11E519CF7C7E49A7E851156F4AB156E2FCE3D0A18432C3C6688D4AE5F53E2872D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 ba4f280e08196620c09e6cf7a85ded0c058fc61882c7e15c4fc6c09a49007a53
MD5 f56ff91291c474d8c02ec4fcf3e30bef
SHA1 d32c97222df5dcbcedbbf43afbc6ec2c7df11679
SHA512 0dda5ca3e63cd96ae5d95bd4d7a6f8b702bf84d0208be2240c4555b684aed14be4313d878e5aa0beca0e949345b8f109f0a6892256453b3ab056a8d64270f76c
SSDEEP 192:Dq/tUFQWaIIskqpjhiNbvZ6kkWkKnNPUaPsfP/N5bS5Tj:Dq/tUFQWaIIskqpoNbvZ6kkWkKnNMaUA
TLSH
T17AF1CEF7C3E8952D891556F89B15AF2FCE2D0A24432C3C66C8D4BE1B93E2871E20165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 bd78d431936117648e8f415ecd4c7da1339e29dfb32f7034debbc0acd80ea4df
MD5 014d47385d51a35146a2102843551be3
SHA1 4277e51834aab9100da375ac76db969945aa2bd0
SHA512 a3d0d11f351581dc3e7a95db12fe50a93aeb76b2257afe78f6c484aae780072af5e852422fdf68a0ba673ef67889f5590469c44551375b152d3c85ad41d04462
TLSH
T1A3116BA3D77F741B10BF49AF1E49BC096976BC3551D268F4DA9A833CE0814E70B16067
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 98f05d9cf990f7fc3a6cc84bad55956dd582461fbb6ddb1ec262e2fb918823ce
MD5 3bce683114e024d5210d528d4bbb05e0
SHA1 cf4e02d4003bdfbd342c48b1d459fd0d11bed582
SHA512 1aec93c3f24756cf123b563ea89bb203c61886d5b1778c6c3b53e4985cec062fa4a2889cfbeaa5a7c5b9e1805b579b656250a7f758ac1fb79a726b39364d43e0
SSDEEP 192:9RTcBzGC+Vuses/v72ympPPRprTMGDQy95Hsb+WNqFQmEqn1T2qMvam7eMVVyIsB:9RTmzG3RQdXT7wUt2NamDe
TLSH
T16D52A61BB920697BACDBD219F9227763D7F5106125D42E84EBFC8B1C15E76CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2596f8dc161a035fc3977cb92725f486518c4ab36bf6697ecf1c029281df4398
MD5 0399eccc87bf9360a9f20a600686e8fb
SHA1 311c8b977cac426d74eef080603fece678f9c366
SHA512 284ca23439bf71ce39b323ea41b44832a1169151b304187ac6d16c5e9cd32d0538cb63dafcd8cc9fc2e51943d53517a856a6ffa1933a39664f6bbf3f4bdab86b
SSDEEP 192:9RPGC+VuGex9/v72ympPPRprT/95Hsb+WNnDIElTMvam7eMVVyIsnAUgraJ:9RPGzYdQdX/7wDTlcamDe
TLSH
T1F252A62AB920697BACD7D319FA227763D7F5106125942E84E7FC8B1C15E76CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ffc9c99f67d556834273eee46057f086ef58e2362a295417408201e803e091d5
MD5 550b4eda22dbe59414178151938fdd5b
SHA1 37501c97280f3c92d799b6ad0873ba43168e4b1a
SHA512 dbe72912e254417d5c766c29f099c89d8b8bd6a1691f05516bfd0d570d2a4b15ce0cdafeb9ce1d03c91e31196a04159cc48f2743e0dd4ee07567870c80f0f7a7
SSDEEP 192:9R3G++VuGeuf/v72ympAPRp2/95Hsb+WNnnI4dsMvam7eM6VyIsnAUgtaJ:9R3Gf3QUXo7wnHdnam68
TLSH
T1B742B72EB920697BACD7D319FA227763D7F5106521D42E84E7FC8A1C15E76CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 604bd86c2cebcab0334f943bcdcc7f6dba471c6da70047a1eb752e3f67120fcb
MD5 c4e2f7a6407e54c241b91d2f625524b0
SHA1 2919afb9987ba4424b79940a966c29b7ae19f50e
SHA512 32543c5c4d49ec6451bd641d73d332e10c53f5a4f2c979b2f5af01bd9e60863fffcf7361f9b5846a49e34741774424931fe4c3afcb3e77360c1b6087910acb33
SSDEEP 192:9R3G++VuGeN9/v72ympAPRp2/95Hsb+WNnnI4dyMvam7eMRVyIsnAUgraJ:9R3GfodQUXo7wnHd1am3e
TLSH
T18042A62AB920697BACD7D319FA227763D7F5106121D42E84E7FC8B1C15E76CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 723e834c82dac7dc11410f06da1f674db1fd1735cd85e4cb4e18bc89aff4f69c
MD5 adf221ddc3b438160eecb42bce032565
SHA1 df91f04a51b0d3bbbc5cea7df8beda337c37ab55
SHA512 4c655aa7d2db2b8e81618a666b89ce3aab3da8692bee1dbffd9e86dc5459e40355bc3f8c875ad9afb41c2f0a3cc897bdce9a809f43fa04cff35ef922d0bda35b
SSDEEP 192:9RV9cBzqC+Vuses/v72ympPPRprTMGDQy95Hsb+WNqFQmEqn1T2qMvam7eMVVyI6:9Rvmzq3RQdXT7wUt2NamDe
TLSH
T19652A61BB920697BACDBD219F9227763D7F5106125D42E84EBFC8B1C15E76CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 32ad8ebe7428d27250bee50ed7f1963aa33b8f6a544d4a6eba23ab0e7b32357f
MD5 5130571c202120d517a69e76bc350197
SHA1 a49124cc978aaf0a7fe1cf619619a4e59e153085
SHA512 0b218273147037663cda250f90ebfbeaeafb0b34d4843b52ff80d4439820b45dedbe8513fc5d8ce0fdf8f6a5f67d3a07fabd667ce3beba4a3d6983f6bcf12ed8
TLSH
T133B0124080426541C14203F4154724887114DF11960A2B0193E0E92288251908525050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589e3f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589e3f.TMP
Size 96B
SHA256 f408b0c0ed242c75bbea2a2ddd5c40d66edec866b8ff0d44d852dc356cfa5a49
MD5 ca31eaf3313a3e355ef6a3d90096e7f2
SHA1 2679cb2a87c1e9ac00d64395d4ea8742b592ce4a
SHA512 b818e931decfb6b75ef3884df9a9561b90b526897873b992132ed737f0b7272cd1d33cec3b77fc9f436ed0a77ad4cef176b2d874a9297564e454d51e69187f52
TLSH
T156B0220AC00EB222F00203B03EC080C8B020CF20CA03020B82E00E2ACC322E02CB2030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 3644efcd7e37b388f57cca8aac6e2d6ea0ca55b4f3e41f2c1152a2a016072f95
MD5 70e60d7c2bb756cb82ed63771955581b
SHA1 d81737d02acd793e758ad9a7220649e27da9fc02
SHA512 be012f940fa235122af9667c117daa65f0ede708e191351a8f1d7cb13af29e40ed9bbcd35416c02124101c7100f53e3114278c1c0f402474dc539a2c1e3f202a
TLSH
T133A00219A64002D7D903027467920A5527258A346321165982A24085CD509A68697B0D
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 1428788571307277341757a1de6b58db671448ee8b6456cce8bb1cdc92289027
MD5 0b8b8eaf7d8551d7e4a5ffdcb75278fc
SHA1 113a579daaacacb7beebb260b1dd6ac393e4ea6b
SHA512 95621b36cb99a68ce2fe3c6d0af28bf312b3528e5952fbd63430e7bf6092392cd9cc9620f9601c838e20863d0ecad44e4354eb431631adee3c7ea6a501fa78de
SSDEEP 3072:AuVLZKc2P7Wmxbd0+91k3WDAMhLONNd1cyYrye5eVqfd7NtZL8cHQRZEQ6SpsqJ:Ab7WmVGS2WkNRdYAVqZ/ZLW3ExqJ
TLSH
T151341237EF920F370E96D63C76172B273BF25D59D064C204FB6C3AAB98435A468058AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 3a849fdab17f73c753784d1285aa8ebb0ba3dcfee2c18e43c312b2c383a914b9
MD5 3171f17ebd02082a8ea559a644ef96d8
SHA1 a2765371ddece94f5a46ef7f6265c932b93f020f
SHA512 965d51227b199d5cb20c55c1b763ef4fe5bcf04eb044d0e387c6da21a38aeb7482ef7b435855522560e84e56ddf0b1f9407f08065df33c0882649ce292d5beac
SSDEEP 3072:DNVLZKc2P7Wmxbd0+91k3WDAMhLONNd1cyYrye5eVqfd7NtZL8cHQRZEQ6SpsqJ:DA7WmVGS2WkNRdYAVqZ/ZLW3ExqJ
TLSH
T1E3341237EF920F330E96D63C76172B273BF25D59D064C208FB6C3AAB98435A468054AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 5cbced88d35a9e33f6df572703f3d01decaf7e444581e00a4716650f60e50fd4
MD5 0a6eba51f099f27bb941364e52acc6ac
SHA1 f9e45311f06df1e6665133f42d479431592513e8
SHA512 c51dbfff80a064103d113c70e0df7e0d5b8a43e90a8e864d95512ecdb36901b8c156bcee9be7305625532ee306129d56a133e5c8567ba57b22ffbf9a3933a113
SSDEEP 1536:TKQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:zqfd7NtZL8cHQRZEQ6Spsk
TLSH
T189C30237EBC21F339D92CB60B9530FD697F644A59034D301AA6D77AF6C8349174428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 4283b54912a9705672a081991211daf2ee0a2b4c772dfa7e971e53e0c7346611
MD5 a7ec17dcd496cc6f4922fde2aa6ae228
SHA1 3b5dfd8006be7973c2607d76e01e7ae443648cd4
SHA512 310ee7045d05d06322354ae5d95b79242e84804eebc00c49dbe641cdebb4b41d09ead9254507ce530f0d72ce2abcf2f2fa1e696924044161c6ffc48445c7e04e
SSDEEP 3072:RACVLZKc2P7Wmxbd0+91k3WDAMhLONNd1cyYrye5eVqfd7NtZL8cHQRZEQ6SpsqJ:RAH7WmVGS2WkNRdYAVqZ/ZLW3ExqJ
TLSH
T124341227EFD20F371E96C23876571F6B37B25C99D0648205AB6C3BEB98435E439058AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 cea5fca885f45628568fe53d798b15da6560e6463a97e34c39fcd9365f838c99
MD5 c037989a8d19c9a0cb21879b8d2ddf71
SHA1 c337855dd8304401985487d01e54b5551649b90e
SHA512 0ee10ea0209b0ffe83ac4abcbe2c2254c1003caeed0e673debd1d56b99c804364a2f7aee6fcb4688811a66bd46c03b5e2eb5192f5ea99fa65ff4fe5f187adcd3
SSDEEP 3072:gACVLZKc2P7Wmxbd0+91k3WDAMhLONNd1cyYrye5eVqfd7NtZL8cHQRZEQ6SpsqJ:gAH7WmVGS2WkNRdYAVqZ/ZLW3ExqJ
TLSH
T13D341227EFD20F371E96C23876571F6B37B25C59D0648205AB6C3BEB98435E439058AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp3B6E.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp3B6E.tmp
Size 2KB
SHA256 bcf40f23677e44d599011eca45ec3122abc64ee6a889f99a339222e39b4f3b01
MD5 3780869409c2cb67babc968ef419070a
SHA1 65371fb9927444c62d88e654b4dbf18bc1c30734
SHA512 b96cf9b9beece8736702bba9be69c1c88211f542511340ffa47736ef03af49a4ad4a3da58e5e43f606239f1ff52727ed145617f89f44485a14b18cfd67f21462
TLSH
T1E2411B5363F98789B619AF551DAC0D0B249DAB58CBB1172FF1B000DC6F16F0C048C306
MD5 SHA1 SHA512 TLSH

Submit Download

TCPView.zip.crdownload

Path C:\Users\Admin\Downloads\TCPView.zip.crdownload
Size 1.5MB
SHA256 4fc5ceba3e1b27ad95a24df35d094b454ec5f9478e12a8ca2b1b222705b9683b
MD5 0db74b666d6dc61a26e4cb217bb05f24
SHA1 1da8cef179836761535b045a850ea8ccc423b4b5
SHA512 35dac71cfbd9c39622c378ba437b37c1ce6411cdd3b7258ab854a69e549b765db2fd8d38a7f911509780fcc42922529a23b4eded3e86147d1a372aa3bd1bccd9
SSDEEP 24576:Ne2wNjB59NWEItARSMElIwqWjOmG/XRa3A1yAtD3K/gWUrwZPyM815/fn:U2w19Q2RzTn0kZyAtLWUisn
TLSH
T1BF75335968971D3FF61268211DFA63785F9D93BDC0D2A50109472B84E3F2ACA8865C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1672-194-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-166-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-242-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-240-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-238-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-236-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-234-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-232-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-230-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-228-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-226-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-224-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-222-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-218-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-216-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-214-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-212-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-210-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-208-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-206-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-204-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-202-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-200-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-198-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-196-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-192-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-190-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-186-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-184-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-182-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-180-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-178-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-176-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-174-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-172-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-170-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-168-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-220-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-164-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-162-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-160-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-158-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-156-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-152-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-150-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-148-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-146-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-145-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-142-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-138-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-136-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-132-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-130-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-126-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-124-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-122-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-120-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-119-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-140-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-134-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-128-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-3268-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Download

memory/1672-188-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-3295-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Download

memory/1672-154-0x00000000067E0000-0x00000000068B1000-memory.dmp

Download

memory/1672-118-0x00000000067E0000-0x00000000068B6000-memory.dmp

Download

memory/1672-0-0x0000000000280000-0x00000000002D4000-memory.dmp

Download

memory/1672-69-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Download

memory/1672-63-0x0000000006230000-0x00000000067D4000-memory.dmp

Download

memory/1672-62-0x0000000005BE0000-0x0000000005C72000-memory.dmp

Download

memory/1672-50-0x0000000004FB0000-0x0000000005016000-memory.dmp

Download

memory/1672-3-0x0000000004C40000-0x0000000004C8C000-memory.dmp

Download

memory/1672-2-0x0000000004BB0000-0x0000000004BC8000-memory.dmp

Download

memory/1672-1-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Download

memory/3780-90-0x000001BA66E00000-0x000001BA66EE9000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads