4ede4ad767b52468b9f5843e93fbd6b59f75849965528b5a6f6b5a37dd351111

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LilithClicker.exe
Size 38KB
Sample260712-e1yssacy5m
SHA256 4ede4ad767b52468b9f5843e93fbd6b59f75849965528b5a6f6b5a37dd351111
MD5 05042fa80480173bf3439474e1ce876e
SHA1 c5cd8bce85e82c74d75c53c0ce558d8e0e040048
SHA512 acca6d3be872ed0e01e479f18d0d660d2afd92f6f6c6336fbadc8cb969f47231b9159683ffa4b8e80f7a5f2abe2df2fe42c8f78aa2bff64f1d19b3dbbbe894be
SSDEEP 768:nw5Rr2n7l/DwLiL++yiLdEnIv17bJHid:nwXynZ/Drd3Rid
TLSH
T10203192C3B48C509CBBF427D9DB786508731232A2016DE0A7DDEC6E94F6B354C6357AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1516	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283039492206117"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4908	LilithClicker.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
5300	chrome.exe
5300	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	LilithClicker.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe
Token: SeShutdownPrivilege	4752	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
4908	LilithClicker.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe
4752	chrome.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3476	4908	LilithClicker.exe	86
PID 3476 wrote to memory of 412	3476	csc.exe	87
PID 4752 wrote to memory of 5104	4752	chrome.exe	90
PID 4752 wrote to memory of 2484	4752	chrome.exe	91
PID 4752 wrote to memory of 2484	4752	chrome.exe	91
PID 4752 wrote to memory of 1516	4752	chrome.exe	92
PID 4752 wrote to memory of 3820	4752	chrome.exe	93
PID 4752 wrote to memory of 3820	4752	chrome.exe	93
PID 4752 wrote to memory of 3592	4752	chrome.exe	95
PID 4752 wrote to memory of 3592	4752	chrome.exe	95
PID 4752 wrote to memory of 4736	4752	chrome.exe	96
PID 4752 wrote to memory of 4736	4752	chrome.exe	96
PID 4752 wrote to memory of 2860	4752	chrome.exe	97
PID 4752 wrote to memory of 2860	4752	chrome.exe	97
PID 4752 wrote to memory of 3244	4752	chrome.exe	98
PID 4752 wrote to memory of 3244	4752	chrome.exe	98
PID 4752 wrote to memory of 2380	4752	chrome.exe	99
PID 4752 wrote to memory of 2380	4752	chrome.exe	99
PID 4752 wrote to memory of 3564	4752	chrome.exe	100
PID 4752 wrote to memory of 3564	4752	chrome.exe	100
PID 4752 wrote to memory of 1308	4752	chrome.exe	105
PID 4752 wrote to memory of 3356	4752	chrome.exe	107
PID 4752 wrote to memory of 3356	4752	chrome.exe	107
PID 4752 wrote to memory of 2288	4752	chrome.exe	110
PID 4752 wrote to memory of 2288	4752	chrome.exe	110
PID 4752 wrote to memory of 764	4752	chrome.exe	114
PID 4752 wrote to memory of 764	4752	chrome.exe	114
PID 4752 wrote to memory of 1720	4752	chrome.exe	115
PID 4752 wrote to memory of 1720	4752	chrome.exe	115
PID 4752 wrote to memory of 4912	4752	chrome.exe	116
PID 4752 wrote to memory of 4912	4752	chrome.exe	116
PID 4752 wrote to memory of 3204	4752	chrome.exe	117
PID 4752 wrote to memory of 3204	4752	chrome.exe	117
PID 4752 wrote to memory of 1636	4752	chrome.exe	118
PID 4752 wrote to memory of 1636	4752	chrome.exe	118
PID 4752 wrote to memory of 4556	4752	chrome.exe	119
PID 4752 wrote to memory of 4556	4752	chrome.exe	119
PID 4752 wrote to memory of 4976	4752	chrome.exe	120
PID 4752 wrote to memory of 4976	4752	chrome.exe	120
PID 4752 wrote to memory of 1076	4752	chrome.exe	121
PID 4752 wrote to memory of 1076	4752	chrome.exe	121
PID 4752 wrote to memory of 4644	4752	chrome.exe	122
PID 4752 wrote to memory of 4644	4752	chrome.exe	122
PID 4752 wrote to memory of 4268	4752	chrome.exe	123
PID 4752 wrote to memory of 4268	4752	chrome.exe	123
PID 4752 wrote to memory of 3496	4752	chrome.exe	124
PID 4752 wrote to memory of 3496	4752	chrome.exe	124
PID 4752 wrote to memory of 5212	4752	chrome.exe	125
PID 4752 wrote to memory of 5212	4752	chrome.exe	125
PID 4752 wrote to memory of 5604	4752	chrome.exe	126
PID 4752 wrote to memory of 5612	4752	chrome.exe	127
PID 4752 wrote to memory of 5620	4752	chrome.exe	128
PID 4752 wrote to memory of 5300	4752	chrome.exe	129

C:\Users\Admin\AppData\Local\Temp\LilithClicker.exe
"C:\Users\Admin\AppData\Local\Temp\LilithClicker.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ktls0xss\ktls0xss.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F65.tmp" "c:\Users\Admin\AppData\Local\Temp\ktls0xss\CSC18E4C8468B914EA9A4E4B3DDCDC5DEA6.TMP"
    3⤵
    PID:412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffe869c728,0x7fffe869c734,0x7fffe869c740
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,15856917386006152156,5267190725686485295,262144 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,4081698035471604926,7154151071717628824,524288 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,5700226839160920278,14293554052617560554,524288 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2396 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,4625483141223451595,1327466598302271936,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3444,i,9410306395834602611,15962678165799477380,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,6498765385165794491,2310654446042552260,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4640,i,2772116109169416763,12650767242530194617,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,3014772460046597945,5101125929194912622,524288 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,4058211768610455098,11025085575542373999,524288 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,5870461163506642591,5236388926583263660,524288 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5528,i,14021912584060441375,7321252363365622147,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3560,i,7224993162237697396,1411057501026113104,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3532,i,2373640213990985861,12603328890622251249,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5984,i,89210363947280493,4349520823066438386,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5996,i,11276644423208397190,5357363178012465244,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6096,i,12299101395476356157,9288361066935634236,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6692,i,1148382335065561934,18031398209190276332,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6672,i,5434346947632287803,9287033667631281606,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6780,i,5445078067027977122,642594057741006461,524288 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7032,i,1017823859292951575,3435590307083662718,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7112,i,6104022132378323412,3290490563227998377,524288 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7336,i,14454490433838652558,9785860550156534487,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7624,i,12411013182471013138,6054812851378538371,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6884,i,10668067291318201122,2957471663344769884,2097152 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7172,i,8586402254231867031,15334415672723973870,524288 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7268 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7176,i,12964554209071271894,14085254573808663634,524288 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7180 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7196,i,3392584943755662878,17870643443281578787,524288 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4508,i,9675900663004210345,14182389741397001817,262144 --field-trial-handle=1924,i,14109597445538502271,1755811021300445703,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 19fa32b794ed70a22a51ad1206fee6ef03a8f3d93acb1946ab304ff1b6e40712
MD5 3d335fbbfd6f228c94decaf43269faba
SHA1 e0d76048b625eee4d870b94aa93eb59291c67e5a
SHA512 613c6815c39ac0647b2d05f3095852573b4b631c7effe035c11f0513f57f179065079479594e7f6b2a002fb0b3d085251bc55abb2663ca80d07bb507ff33aad4
TLSH
T178E02BD7C861AC3729FD071850918746EA55131B2B80891F3B3DC70C4FB1A3A4186C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e0aa8165776bad316ccf4161bbe646b5468e79eb07267c42a5117242fe03fef5
MD5 6520d43c806e240b4266cb99b6baa5bf
SHA1 8bb9856d4d86d770f747e97e827540b24e4ef58b
SHA512 1503c265ba646e41b01d98e77892d144df05fccf8ce66d0015c05875f1f96ee8a1e5233a9132d1b485f9ce7f5df9d349d528ea776b419e7bce86e6985a2d4230
TLSH
T14C41875307DA4FC1EF886876E0F0CE61F6A1DC128C260E56A1E1192D554ABF1EF27249
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 11342280b0b42f1baa424a68e6b76dc46ed121269ea6ad6c71279bb0bb1c0807
MD5 d7d8c2ea229066ddfba95cfbebb0521c
SHA1 80a6e80458e500df7e4a596febe3ccd767d043cc
SHA512 b90a407b7183d15fcae9bf9c011e83d300f109958ff25fb83ec28bbc5754252bd2e0fd88343471b1580febc47fe2b5eb2b69f11ee9d36215d5aabf119cc95c96
SSDEEP 384:D1HFkQBwir4oOQekJJeqy9vQBe7hWJWJoJqepjWtJ+VGuaIzEUAYEBKGStftTgBE:bZj4eKRE0BrwzBzRyw
TLSH
T1F9929DF3C7E8866DD9112AF4A7643B1ECD1D1928432C3C36CAD9AF4B93E14B0E24165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 04b74868147bd34d4afadc5bb20e1b44f2adcc46169a300fd6667c13fb20a609
MD5 a2b45a963aab0557b1b89fcb81c05c53
SHA1 549c825dc54b3e67711c02ecd1f492f5421a74a3
SHA512 df09d28419f49f3c15de55bd00a7bd2006441ba34dd066decb0e5b1f5d4868d1ac58eff96db2eadbb3bfd1c02a756836f5496a859f50b0ec8358455b9e3517f5
SSDEEP 192:wRFcBz+L+E0Uaq1Nav7hpAPRp2HVSF95Hsb+WN1AhV4uu2Qietl52CBwr+VyIsnH:wRFmzoN0bo29UXvrwmg2ol52Cyr28
TLSH
T1A752D72FB920597B5CDAC25AF962B757D7F6103225902E84EBFCCA1C14EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1705a24fd352240e1a1823d834ec29c7a5cd3218161edc19458d757148e7e704
MD5 3685d077abe064f701664ac5a942a684
SHA1 c465773766c120b0955d561f4b6f41505f1b039a
SHA512 6f47cec8256fb7c3cd8d68949d5445f5864f8f31fd94ae829dffe2c5ac86fd0adfb452721ddd355056be54b41935ff02e1543f58f3c384e6d1b9c4f5c682b441
SSDEEP 192:VRFcBz+L+E0Uaq1hEv7hpOPRpwHaSFc95Hsb+WNBpu+mrj+pV+a62lietl52CBnX:VRFmzoN0b4g9+XxrwPyKW23l52Cxr2e
TLSH
T1FD62E72FB96019775CDAC259F962F757D7F6102225902E84EBFCCA1C14EB9CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 59b1b9f0fb385fcc8bebab298a76356f9e3399ab07c7b28af334eb0311ce6908
MD5 5ecb998c6630c18ce1f841b65dd9adbd
SHA1 09da3b4bf8c242f451287318fe7d2dd874579ddb
SHA512 a1fb844a86a4deaf1b11bff757937f95e612d36938b56cd19c0b51755fe3ae692f9871746490eb48280e55ee2be8f90f75afb9f884d5e0a8beb5e1d92f65d6eb
SSDEEP 192:VRFcBz+L+E0Uaq1hav7hpAPRp2HaSFc95Hsb+WNBpu+BpVW/ietl52CBwr+VyIsH:VRFmzoN0b429UXPrwPVWVl52Cyr28
TLSH
T15052E72FB960153B5CDBC25AF962B757D7F6102225902E84EBFCCA2C14EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 78bc5e1eb59dd07c1f368e18a2970fef756e25359bec5b0865ee501e1eaeb624
MD5 50e40e65090d18dbca64bf8c95531231
SHA1 8fe56d7257bf35f615c47a58965461e1451aef09
SHA512 77df5623744281e33eb9c0536be9e7ce93e4795c9b073fdc1ef27aaf59ab4c04ddaf477c83db5cb7fd99cda2c43f325e0084a210a77eab776c84eb501b3248dd
TLSH
T115B0124080035783C01206F41642D8C8B128DF10960E270143E46926C87A360C035050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ed1a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ed1a.TMP
Size 96B
SHA256 f626ac0ca7fc7a1ef9a7537d83126a2fa337a7164f185c0a98552476eed34c3a
MD5 f7beaf224d12f855597a5797b4963cce
SHA1 12cb295f06574236dfb1e1b8362c060700780185
SHA512 a6f99067fe302fd773b09fa626d3b3322212e56700bc6dfc1debd31d19e5544b1aa1ff1481409972eed0edcfbbc1f52caced04ec153676331209ff37a0368966
TLSH
T18BB02200C0022222C0020BB0B8A0CECAB028CFE0C2030302A2E00A22CC38220C328020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 df77d3c87ba4bcfe5534d4beab58a61ff45d085f9b7f8af1be7232b801f7e4fc
MD5 9290fc282b91c3d9287768ea8f5228c5
SHA1 939028ead63ea83f4a545d0108b32ca866ab1dab
SHA512 e5fb17c6e3f1fa4d6d00cadd59280e2ef6de63a96421a323e35d0d3ec269ac3dafa68e05579b351d3e9540d2d523b0ca68d6a50fb1154d71e9500ce33a5f4aaf
TLSH
T1D7A0029416C71806D8454BB0938102C8B310CC280702D283A8E0016C8B5E3C28725660
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 cb7cc0e7ab865b75867a61191ebe62f330686267e4e2cc30be6884df65378a1f
MD5 3b06e79aa0f3f8749f74db75a78571c4
SHA1 1525b97ee66f27578b1942e4796be29c5beb3bfd
SHA512 33fe07a3ae1dda4f49a12e3cf4724db08dd08739aa13562e9326eecffb8018673483c678ffff0fbb67cc1e60ab4852ccf1837e6547afb4185e6988f018226830
SSDEEP 3072:XBVLZKc2P7Wmxbd0+91k3WDAMhLONNd1cyYrye5eYqfd7NtZL8cHQRZEQ6Spsq:c7WmVGS2WkNRdYAYqZ/ZLW3Exq
TLSH
T1FF341227EFD20F371E56D2787A571F6B37B39C9990648205AB6C3BEB98035E425018AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 44179f2604d1c7ea16a8605225ec97266ca5fa9175e7b1fed9bb46fcf81bcb81
MD5 772b96d05fb9aa662ac4b919c3dd3a56
SHA1 5c7c8ee31d46f852ff24fe0ab25d33adca5619b6
SHA512 086b0c046ddc3690c22b02a3cb836f3f9435f0b8d863475c868f8dbab6c5bd7ca232c3bd6d428168053977e4c2af4eab0789f3af3a1b506a080c21fb9b207168
SSDEEP 3072:bjVLZKc2P7Wmxbd0+91k3WDAMhLONNd1cyYrye5eYqfd7NtZL8cHQRZEQ6Spsq:bm7WmVGS2WkNRdYAYqZ/ZLW3Exq
TLSH
T13A341237EFD21F371E5696787A071F5B3BB29C9AD1548204EB6C3FEB58025E429018AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 f3950812a984fd445529d6f48f5d39dbfbcd17fefbd752cefbd56ff075f67b39
MD5 aedfa4129e8140171ceb1c9ebb609f79
SHA1 20878c64e7ee2163a9b73d54b5b945039cb83016
SHA512 8ff50cdf3877c05ae8e15fb1e28ddedf9faccfc87625722acf513f0f0aadbcaba7b790f80263d2608be3847a53f43e7b559d137e974977ffc9462eed09657a4f
SSDEEP 3072:/BVLZKc2P7Wmxbd0+91k3WDAMhLONNd1cyYrye5eYqfd7NtZL8cHQRZEQ6Spsq:E7WmVGS2WkNRdYAYqZ/ZLW3Exq
TLSH
T188341227EFD20F371F56927876571F6B37B39C9990648205EB6C3BEB98035E425018AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 544e89fbc0a390a5b5d0af07d217b53573b1913863b9770ba7991adb78354bc6
MD5 2a5ec793472997f8c09fe6bd5560637c
SHA1 3f36bb1f3623fe024fcf80ae0662b2f1a3c24e7c
SHA512 62e8cb900857fcf24a397fd53df05a4a991f0f4b5f32f7b86ff6f34951a8a03e0e05fcdf0ea7395bd1035354350139591def5fe2e911b3d011ef873be1d7028a
SSDEEP 1536:6HyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:8qfd7NtZL8cHQRZEQ6Sps9
TLSH
T1A8C30237EBC21F339D82CB647A534FDA97B644A99030D301AABD3BFB6C53451644249D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES3F65.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3F65.tmp
Size 1KB
SHA256 7fbca88555fc519c6e6d943432af6fd079b36154b66eeb001a988266a72c9289
MD5 0efa34fcd26464067eb56f4cfd72e706
SHA1 22e38f5d53d9fcd2985aa70592285766d5be2c95
SHA512 dbba29a610b08ac1e2e3c15426e39b509d0e0d998be43cab5dedf66c2ee6a70e4bc97ee8adddd913ce94de4dd4b22ea1ea67ba3e42925639961e2616818d1439
TLSH
T16321660483F94B1EF0735B32ADF6072FA264FDA4AFB2935A8540822C1C51644EEB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xmlb2v2q.rq1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xmlb2v2q.rq1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ktls0xss.dll

Path C:\Users\Admin\AppData\Local\Temp\ktls0xss\ktls0xss.dll
Size 3KB
SHA256 2922d13fe3df8adccf37ba5901da44e59e9d3494ece01b3e1ea046e01396482b
MD5 9b21b22fe1656869fbfe731f08db1e5e
SHA1 f3e0e2fc5779c4b6b8862608ccc37e4daa3068da
SHA512 ee6ccd04598a2b94761f01e5c570b58788109ade4c7984dac99e8920368b5d2f7a1e03fe5666407489648f8cc49826d0673e5f8bdf900177b76b08b471d0ec33
TLSH
T13A71A00697F44627E87B0B38AEF7435637B0F844AB62936E2A54025D6CE03744E31BF1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC18E4C8468B914EA9A4E4B3DDCDC5DEA6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ktls0xss\CSC18E4C8468B914EA9A4E4B3DDCDC5DEA6.TMP
Size 652B
SHA256 0a8b38ee8fcd450bd32155b15cb8568c70d30aef8a3cefdc7675353ee4b590c3
MD5 96ef3b12c622643775873296b65ba0f8
SHA1 85927b4e347674c15a2548da50f238edfd8befbb
SHA512 e1178c0285073115c19914a0bf7b63169ddc342f9244212bd1f0c10da7a43eec6b6dbc3bdc7df5c00700a2834ba900b07c2e2e14d1a3fbc5634fb59946700911
TLSH
T128F0170963F8020EF4F34F30BDF64367A1A8BC64EE3293AD244043692864510C972EB2
MD5 SHA1 SHA512 TLSH

Submit Download

ktls0xss.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ktls0xss\ktls0xss.0.cs
Size 608B
SHA256 1ffda1d9bd7ef940c393a22b4e0654ea4cef227a632b07da70935439ef50ae5d
MD5 bd25d4e00de82cd0acdc243bf10e5032
SHA1 065ffafa2ce3c5a875867ab4a1ae7bed1978b7fb
SHA512 db69f4e0fd067d7dbc0963c86d84e9acff17f4212b03d0abbcde044b91ab91a4d384a18282c844d8b185527621ef0ccd054dea1643027fe1ca21207c6c5fcf75
TLSH
T171F0F6644701D92088B12A696B74C0D2F137EA4E729BB745716C07A08F77228E235A7F
MD5 SHA1 SHA512 TLSH

Submit Download

ktls0xss.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ktls0xss\ktls0xss.cmdline
Size 369B
SHA256 bda7f094440751a490f6be1fafb5ba5888d3a108a3e2fa4dbcf1e5175b498463
MD5 7b84f48d1fca4bfac8235421f4817586
SHA1 8461062c204db52a2332c1adeca5f6b218118522
SHA512 6d309874aaf359d226596efff4723a9c6cd1878433be538d01007d4052f83bb8a12ba695281ada8371e819c7807e181e469365ab909ec12a5395f9ed39f6294c
TLSH
T146E0C62A526BC77D01ED300B266AC4ACC2B2A7876AC03F84D046840FE0AB4003BD27A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4908-25-0x000000001AFB0000-0x000000001AFC0000-memory.dmp

Download

memory/4908-23-0x000000001AFB0000-0x000000001AFC0000-memory.dmp

Download

memory/4908-22-0x00000000023E0000-0x00000000023E8000-memory.dmp

Download

memory/4908-0-0x0000000000160000-0x0000000000170000-memory.dmp

Download

memory/4908-24-0x000000001AFB0000-0x000000001AFC0000-memory.dmp

Download

memory/4908-26-0x000000001AFB0000-0x000000001AFC0000-memory.dmp

Download

memory/4908-27-0x000000001AFB0000-0x000000001AFC0000-memory.dmp

Download

memory/4908-9-0x00000000023B0000-0x00000000023D2000-memory.dmp

Download

memory/4908-8-0x000000001AFB0000-0x000000001AFC0000-memory.dmp

Download