f4a11c8bfcee6d762a7bd309aac599ddf3ac01f333bcf2d86b411c2699e472d1

Analysis

user interaction
yes
max time kernel
465s
max time network
466s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
image.jpg
Size 210KB
Sample260714-s61q8aat21
SHA256 f4a11c8bfcee6d762a7bd309aac599ddf3ac01f333bcf2d86b411c2699e472d1
MD5 fe40b94bae50116c0c2e3a103aec4c92
SHA1 fbe7ed0e799e4d50223292df7bac13630a17dd06
SHA512 09bb366731bcd12060424dc3ebdcba80c7d251b86cf00302534654e68e36763058c9ad2f8bc59fc94372888a9f576935b1f86e311aa99064dbc7fc9717769370
SSDEEP 6144:shH4Z1uXMNPxUbvKDivN90MZDUQ2sYXufOaRdirZnDnn/eEc:shH4W6DiHBZ23XufdRQ5c
TLSH
T1F524E06733DAC210C70D6835D0D7CA88A6EB3614EAE9B60AC1DFE1238D4F96C9E4D51D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1676	Install_Xfer_Serum2_2.0.23.exe

Loads dropped DLL 2 IoCs

pid	Process
1676	Install_Xfer_Serum2_2.0.23.exe
1676	Install_Xfer_Serum2_2.0.23.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
149	mediafire.com
152	mediafire.com

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\VST3\Serum2.vst3\desktop.ini	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\VST3\Serum2.vst3\desktop.ini	Install_Xfer_Serum2_2.0.23.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum2.aaxplugin\desktop.ini	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum2.aaxplugin\desktop.ini	Install_Xfer_Serum2_2.0.23.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum2.aaxplugin\PlugIn.ico	Install_Xfer_Serum2_2.0.23.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum2.aaxplugin\desktop.ini	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum2.aaxplugin\Contents	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\VST3\Serum2.vst3\Contents\x86_64-win\Serum2.vst3	Install_Xfer_Serum2_2.0.23.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum2.aaxplugin\Contents\x64\Serum2.aaxplugin	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\VST3\Serum2.vst3	Install_Xfer_Serum2_2.0.23.exe
File created	C:\Program Files\Common Files\VST3\Serum2.vst3\desktop.ini	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\VST3\Serum2.vst3\desktop.ini	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\VST3\Serum2.vst3\Contents	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\VST3\Serum2.vst3\Contents\Resources	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum2.aaxplugin\PlugIn.ico	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum2.aaxplugin\desktop.ini	Install_Xfer_Serum2_2.0.23.exe
File created	C:\Program Files\Common Files\VST3\Serum2.vst3\PlugIn.ico	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\VST3\Serum2.vst3\PlugIn.ico	Install_Xfer_Serum2_2.0.23.exe
File created	C:\Program Files\Common Files\VST3\Serum2.vst3\Contents\Resources\moduleinfo.json	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\VST3\Serum2.vst3\Contents\Resources\moduleinfo.json	Install_Xfer_Serum2_2.0.23.exe
File created	C:\Program Files\Common Files\VST3\Serum2.vst3\Contents\x86_64-win\Serum2.vst3	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum2.aaxplugin	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum2.aaxplugin\Contents\x64	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum2.aaxplugin\Contents\x64\Serum2.aaxplugin	Install_Xfer_Serum2_2.0.23.exe
File opened for modification	C:\Program Files\Common Files\VST3\Serum2.vst3\Contents\x86_64-win	Install_Xfer_Serum2_2.0.23.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install_Xfer_Serum2_2.0.23.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2728	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285175250687449"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3256	mspaint.exe
3256	mspaint.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
6036	chrome.exe
6036	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1412	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3256	mspaint.exe
3256	mspaint.exe
3256	mspaint.exe
3256	mspaint.exe
1412	OpenWith.exe
1412	OpenWith.exe
1412	OpenWith.exe
1412	OpenWith.exe
1412	OpenWith.exe
1412	OpenWith.exe
1412	OpenWith.exe
1412	OpenWith.exe
1412	OpenWith.exe
1676	Install_Xfer_Serum2_2.0.23.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3996	3980	chrome.exe	89
PID 3980 wrote to memory of 3956	3980	chrome.exe	90
PID 3980 wrote to memory of 2728	3980	chrome.exe	91
PID 3980 wrote to memory of 3956	3980	chrome.exe	90
PID 3980 wrote to memory of 1772	3980	chrome.exe	92
PID 3980 wrote to memory of 1772	3980	chrome.exe	92
PID 3980 wrote to memory of 932	3980	chrome.exe	94
PID 3980 wrote to memory of 932	3980	chrome.exe	94
PID 3980 wrote to memory of 2944	3980	chrome.exe	95
PID 3980 wrote to memory of 2944	3980	chrome.exe	95
PID 3980 wrote to memory of 4852	3980	chrome.exe	96
PID 3980 wrote to memory of 4852	3980	chrome.exe	96
PID 3980 wrote to memory of 2800	3980	chrome.exe	97
PID 3980 wrote to memory of 2800	3980	chrome.exe	97
PID 3980 wrote to memory of 452	3980	chrome.exe	98
PID 3980 wrote to memory of 452	3980	chrome.exe	98
PID 3980 wrote to memory of 736	3980	chrome.exe	99
PID 3980 wrote to memory of 736	3980	chrome.exe	99
PID 3980 wrote to memory of 3780	3980	chrome.exe	100
PID 3980 wrote to memory of 5272	3980	chrome.exe	118
PID 3980 wrote to memory of 5280	3980	chrome.exe	119
PID 3980 wrote to memory of 5288	3980	chrome.exe	120
PID 3980 wrote to memory of 5672	3980	chrome.exe	123
PID 3980 wrote to memory of 5672	3980	chrome.exe	123
PID 3980 wrote to memory of 5708	3980	chrome.exe	124
PID 3980 wrote to memory of 5708	3980	chrome.exe	124
PID 3980 wrote to memory of 5756	3980	chrome.exe	125
PID 3980 wrote to memory of 5756	3980	chrome.exe	125
PID 3980 wrote to memory of 5528	3980	chrome.exe	128
PID 3980 wrote to memory of 5528	3980	chrome.exe	128
PID 3980 wrote to memory of 5700	3980	chrome.exe	129
PID 3980 wrote to memory of 5700	3980	chrome.exe	129
PID 3980 wrote to memory of 5864	3980	chrome.exe	130
PID 3980 wrote to memory of 5864	3980	chrome.exe	130
PID 3980 wrote to memory of 6036	3980	chrome.exe	131
PID 3980 wrote to memory of 5264	3980	chrome.exe	132
PID 3980 wrote to memory of 5264	3980	chrome.exe	132
PID 3980 wrote to memory of 5372	3980	chrome.exe	133
PID 3980 wrote to memory of 5372	3980	chrome.exe	133
PID 3980 wrote to memory of 6060	3980	chrome.exe	134
PID 3980 wrote to memory of 6060	3980	chrome.exe	134
PID 3980 wrote to memory of 5416	3980	chrome.exe	135
PID 3980 wrote to memory of 5416	3980	chrome.exe	135
PID 3980 wrote to memory of 1292	3980	chrome.exe	136
PID 3980 wrote to memory of 1292	3980	chrome.exe	136
PID 3980 wrote to memory of 2092	3980	chrome.exe	137
PID 3980 wrote to memory of 2092	3980	chrome.exe	137
PID 3980 wrote to memory of 436	3980	chrome.exe	138
PID 3980 wrote to memory of 436	3980	chrome.exe	138
PID 3980 wrote to memory of 5628	3980	chrome.exe	139
PID 3980 wrote to memory of 5628	3980	chrome.exe	139
PID 3980 wrote to memory of 1300	3980	chrome.exe	140
PID 3980 wrote to memory of 1300	3980	chrome.exe	140
PID 3980 wrote to memory of 5792	3980	chrome.exe	141
PID 3980 wrote to memory of 5792	3980	chrome.exe	141
PID 3980 wrote to memory of 5352	3980	chrome.exe	146
PID 3980 wrote to memory of 5352	3980	chrome.exe	146
PID 3980 wrote to memory of 5180	3980	chrome.exe	147

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\image.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdc854c728,0x7ffdc854c734,0x7ffdc854c740
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1800,i,5163570720925054898,17945688486942631055,262144 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,16351404254374782088,5640180746411322086,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,8271741118948396906,15501913356904548190,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,13544884950017149846,16829492224332019034,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,10800834290059163243,12881187804825809059,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4500,i,7963569558904331112,15125586644244580861,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4544 /prefetch:2
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,12653642542129263552,9510550610671050073,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,4351995173982800306,6173886933812674345,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5048,i,12376688053515731583,11393522201773884632,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3860,i,11314357385542765882,13772295038312651330,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,7038906517034112582,1907215103882838463,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,11303069372198503525,10042043526301612418,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,1506349312101692716,9447695245947300232,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,4365014389161301896,8848138433627216990,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,15324514030790641507,17472376350027102490,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4544,i,16495457550090531036,17086795276395976926,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4568,i,6576552643019005403,7609821267084283462,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5960,i,12986810327177123616,3325969825547087321,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3268,i,5998719388212028797,520586378413137582,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3436,i,9197395927961898756,16885298850445865082,262144 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4720,i,5739026751900055791,16176313441226136978,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3396,i,12460365204203694359,1943703839002262655,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3420,i,10150505379557425526,8027511952218182802,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6248,i,1079491642053958472,2262570378800043735,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4508,i,6462159251513882732,3706160161762621694,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3468,i,5210723909484922566,17820790678264993130,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6488,i,9265465963036086461,14255447007654398913,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6384,i,16221280371270714848,9340533923415124563,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6420,i,4010433777205469495,3595987114274174874,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=4628,i,10141324935268043428,17196600671981784778,2097152 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4756,i,698609533967974419,2301268055198377701,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6664,i,4303856553094361595,4201516827416937401,524288 --field-trial-handle=2072,i,6560698773758215977,162551969039518021,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:5180

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3164

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1412

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Xf3r R3c0rd5 53rum v2-0-2-3 R3v1s10n-X-\" -spe -an -ai#7zMap15238:140:7zEvent14308
1⤵
PID:5580

C:\Users\Admin\Downloads\Xf3r R3c0rd5 53rum v2-0-2-3 R3v1s10n-X-\Xfer Records Serum v2.0.23 (Revision) -X-\Install_Xfer_Serum2_2.0.23.exe
"C:\Users\Admin\Downloads\Xf3r R3c0rd5 53rum v2-0-2-3 R3v1s10n-X-\Xfer Records Serum v2.0.23 (Revision) -X-\Install_Xfer_Serum2_2.0.23.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9bdd16ad-7a42-4269-bc98-97184bda33e3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9bdd16ad-7a42-4269-bc98-97184bda33e3.tmp
Size 233KB
SHA256 d0a0544aabc74c09375366f3e0b1a5c66848fe4a7388e4ff637aeb39649f0539
MD5 14879c8dca93bea280f9fc243c2b49f5
SHA1 089ffb6e4dbdaa92449ca030bbcc085db8abd2eb
SHA512 eb3b5fd441db606a7e1dc306d4251bf7cf8d8540d94979d1f2c2e7764cdb16cc1fdbb907e579e82b0d63f1bf79a1e939098b05615ed3df4f9e90a7439b236ab5
SSDEEP 6144:yQNmPtvDqwxm32+f6iY2rUSqZ/ZLW3Exn:ePtmwd+DYcUSqZ/piQn
TLSH
T1883412331FE13F63BD92C734B6632B8A4FF1955EC434A60CAA683F5664839512902D6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 77bcdb2c3160a7fd4141144587938963255d18e2280ca048bae35e2b889daae1
MD5 f444c4b91d48467daad7fc304bf0b2b7
SHA1 0a54e0644c006f7b684b802915a76b0b9e907f2e
SHA512 954788cc6221a65dba3cd53452e7ffe912bdce7b20bd8cf2525ecbc1a2e6c0ba3448dfbcc8997d4347508beecb9ddb77704805450cb4090f76ac02aea569ca9f
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1e131568f831b058496bc33de8d7b93642ebe8fa99aeecbe8da4a03265e91af1
MD5 5fffed6380caa22c075d0913097fa878
SHA1 f7434dedf0ea30a62308d45509e43fc8e5224641
SHA512 ef472a5c2ab7ec5823a082ce16ed828f0db541b2bf85948ac434f88317e61fe73165028ac5bee093d48202af02a46089952a6ae8f0bb873addf4cd3c2f0ced91
TLSH
T17BE02B96C931DC773CFD075D10A14B85EB5513662BC1595F3A3DC20C4FB463A4586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 212ca7bf7b7d2d2eb1420f20a95a733cf36df3ac7cd55d6d908f501d95b898cc
MD5 dead69906a4cade76a6755f0f37a3e05
SHA1 2bd126e5440098791ba7c5b34720e7f567fc263c
SHA512 5ab12c22a94f96c73c672267c6b9ef9ffadb26a2c141ad20980d2b59b996b0f4e5340d593617842204441c13511cd6e1145cce1122936f9f767b0fda930d44bb
TLSH
T133B0118822C0C083CE800230F8A20AA03E220CAF022A0A2288C000A88AA3BA2C002200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 672B
SHA256 adeb29db43fcf7047f1a3f9c74df9aaf64a7c480d5b63d27c978678d355aed20
MD5 6da50dfff8bd3725b8a173be3342174d
SHA1 b5f5195def66249713a7572154c51c7c9a32944b
SHA512 cb91a43e9ad57daac1da1620d41cfb2b53022ef40f814e05f60c86e9085d32d93bb75884e50b230ac8576d7d14482ae5a1e983e8471859abab4facd8c69e3b18
TLSH
T13F01248CD1F0E382CB447535E9A66D0A3D70CEE4CF17322340E5037458C3AD581DEA15
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 e2c801edd352e0f0e897df38e65c4443600325157d4875cdc28bfecee3d9b99a
MD5 bbc6a5a9762af11045d919cb107b0d3a
SHA1 f29103576a976a9024f428cdb3b40275143dd59f
SHA512 e7b4881ccd77f7ec7bfd019669c2a3484ffd65a395d35d49033e8ea900f70acf4d8106113afd00faf34c4eb3a1f8a006e457e0cd5bdf9297b50278ff2862f05f
TLSH
T190E05E44E1B0D381CB05123465E22CA27E71DDF440173E6B809107344616BD4848D846
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 07f2600caa7fa8e1712f621efdc118b8e957087258266be85e03d419b7aa1606
MD5 105a5ed627c7fcd248541e953c4e1f86
SHA1 c274a3e1f949e7118982f688ee2b5150b9154876
SHA512 4a8d5cd4b232869857fe2755808e6b0cff07a6fb4b8abbe808daa85ea86c4ac8faedf6411bb9a02d0ee63534fdc87f949f5750400980978b0d9a23d1f52818b1
TLSH
T1DAB022A833C00003CB000330F8A30E803E220E3E020A0333CAC080B8CE23FE2C0A0280
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 ad6ede2eb2b50f3c8d3c8c69f66a804d07a4162c945e4d7dfb971c3933d61bba
MD5 f85785798c6b69578d052f57014e68b6
SHA1 4d7fe8325d0be85574a4536886c271182d8dd203
SHA512 3bff7a07376bd63f912dc76201d3d7865c3b697810f1b7612076878d5e3c48df4f3ef0ac9bb821cc9715df440ed2280a3fa33ebdb70bcfe348c4d8e0a45e2154
SSDEEP 384:D0uwEqiCUlOflkS7WbdeIeL0Z0maItHuySWQENd7ey4IYm+Y2ur9XvahLAYtxIqG:WjyCbqqbY
TLSH
T1BF628BF783E5D62E891157F49A14AE1BCF1D0619432C3C2688D5EE4BE3E2432E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 49d6b349ea53d4babfa521d217a95faaad981dc7f03737d8ebe9da2c44c46e3f
MD5 539e8c2763922f40e7cf6c0b990725ba
SHA1 2a8d1dd6ce809513b2adb39261a53fe02bcdbac9
SHA512 0572bcd414ae2a0b55cae33daadea509fff3d82f7dee09622be9ad8052f4681118add77a8e5da3d9870cefe53b7c52e573acdeb7a8871e0f706064548b10ab81
TLSH
T1E9718DB7C3D8962DC91156F5A7217F1FCE291A64431C3C66C8D8EE5B93E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 412c611540ae35e40948b838fcab151b405f572db5144eb5ee25d64c006e0c34
MD5 c01a236f1698f3511b7e996ed3356b1b
SHA1 0228e26f3d733bb143cbdd62a7439bac2452b029
SHA512 1c2bbf3eab1943db0c281efed7eaa9ebcae8fa896c195014afed08668ee75d051021d729126b928037a65d6e82e085ba9fccd2dd3916d7fc55ca8e85e75d44b8
SSDEEP 384:D0uwEqxY2z7w4kS7WbdeIeL0Z0maItHuyYWQENd7ey4IYx+Y224Lj+XvahLAYtPH:EjD87bYqPB
TLSH
T107728AF7C2E5D52E891157F49A146E1BCF1D0A19432C3C2688D5FE8BE3E2432E16964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 a03752cfd259b2250d53dc639ec20c1f0a8335e192193715a98286481a11b57c
MD5 8ebca1d826834159b49ccf6b17f1859b
SHA1 c7f8727e2dd42e7b383b986e480c7aed545b6894
SHA512 eb9cc435008af93dcd2510bf4bd2a8a6e012f3646c5bb4cfa0cc0a3ac913236a3beb63259b14fcd02e103e15164cba8a5c095d87aff4d2c97fa9f5364e8cf9b5
SSDEEP 384:DXOUwFxY2z7w4kS7WbdeIeL0Z0maItHsyYWQXay7ey4IYx+Y224Lj+XvahLAYtPz:jjD87bYqPR
TLSH
T1AD727AF7C2D5D62E881157F49A246E1BCF1D0A59432C3C2688D5FE8BE3E2432E16964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 63a31be1686c10accfbe45e84c37de0d4ae8ab449c80a742e329cb9d1aff15e6
MD5 347b7a1fd4ad547c351653503d8140d5
SHA1 28fc6b2cc144ebf1349c31258531ceb59817b8bc
SHA512 0f228752ab23abd29fff3563f853f84ba4829d65157b4cc44c48669ac03ed22a3d0f3bd1841b6425734714b5815022a220341e9ae279f9d80b679473e879dbdf
SSDEEP 192:DXOUwFxY2z7wEaItVNrqwHyY/10LjbYI4uoYt64HQykv827VN:DXOUwFxY2z7wEaItVNrqwHyYN0LjbYIC
TLSH
T1B6128BF3C3D5C52D881116F4AB256E1BCE1D0A58432C3C2689D5FE4BA3E2872E26965F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7c4a222b26ca20e5baf5141ff6e1e516074a408f07c0dcaad37b0ab80579f88c
MD5 4505df84e2d41efa24739ddf82a222f4
SHA1 504567ec75c44f5031ad902e653204e937b3f688
SHA512 c31d8d6567d2f997dfde9c7c979509f821c731784e4080da282c7abf59f5cf055c80aab4436077785787c1a83db75330794ca7e552488751d8858ec3ae65096d
SSDEEP 192:xRXcBzKL9aQk2jmtv7hIuPRpbHYur95Hsb+WNn+FBIn2ikO8es9ucTkVyIsnAUge:xRXmzkDYN97XprrwQO2rOWlge
TLSH
T1EC52D82EF910557B6CD7C22DF9227B57D7F6102126A02E84EBFC892C19E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b05b2d1f9a988ecd4997c0e3abeb18ad795ebf87d096d1327c15d3b93e2d7ecd
MD5 06efd97a3305bacd997e1d58ffeecb1c
SHA1 0965ca93c7045a9e1e34d65ddcc71bbd35461bc6
SHA512 16699e84257a5d34c1fb48f99d6db18c8b83221f6b2c5d5f3407cf2319f9f664add91e55e65d646871d9a693f2d17c7f2c6cc6477d33de8cb4a88bfda89f153d
SSDEEP 192:xRXcBzKL9aQk2j8tv7hIuPRpbHYur95Hsb+WNn+FBIn2ikO8es9ucTkVyIsnAUge:xRXmzkDWN97XprrwQO2rOWlge
TLSH
T19F52C82EF910557B6CD7C22DF9227B57D7F6142126A02E84EBFC892C19E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 398bd73cb82ba25907d2ffebeb9bb05de67850bea4e2cc464c9fd53562c2b73f
MD5 03b48cb0498b831c4e83a0337f60bb7f
SHA1 d36d48311c16160101bbf73f1e3db1d35b4f6d11
SHA512 9944b50b4be4ef2fa5604b0df9e272b8d44d84683278eb3858fff4b3100c393f04be153084f192a62663b1fb508f7e2ed75dba699148906746b9aff9cb40867e
SSDEEP 192:xRXcBzKL9aQk2jptv7hIuPRpbHYur95Hsb+WNn+FBIn2ikO8es9ucTkVyIsnAUge:xRXmzkDvN97XprrwQO2rOWlge
TLSH
T18D52C82EF910557B6CD7C22DF9227B57D7F6142126A02E84EBFC892C19E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 66d4ec1b63235c4d2663f3ae3625b1b2c8a1c734cf62276a4cc5e068bd21dcb0
MD5 237a9eed98801f2b1c618a1c70737389
SHA1 224b439f5e4ca2ca3c6082acb7119ab5ad9ea937
SHA512 de6bcdaaf34b69ab5108da7bee63cae6517755e4bdb4058fc33ac88891fc4838fe8ebab43e35b93a67680e819660b7ab65d1dbb32080ac609e343c2f5c38d32f
SSDEEP 192:DRZKL9aQk2jOtv7hpAPRp2W95Hsb+WNnVi0UkO8es9ucRkVyIsnAUgtaJ:DRZkDoN9UXtrwM0dOWLg8
TLSH
T1D742C72EF910647B5CDBC22DF9227B57D7F6142125A02E84EBFC896C19E7ACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5b071456aec60ef8aa202dba4b2031433473d28a342446d1212b8d5ba9ed14d6
MD5 342e2fa78794483e822f9274f78949c6
SHA1 5d3851067aa96154f9f783b0c9e168461f7dd174
SHA512 83608ca7ac75d79362eb2ef4ab3e35f2fef597cf94ea6d2113761474db0a2968f5e69b3533be43998420f73dd0ee5babb8dff679ef31990054339a16d215a515
SSDEEP 192:xRXcBzKL9aQk2j7tv7hIuPRpbHYur95Hsb+WNn+FBIn2ikO8es9ucTkVyIsnAUge:xRXmzkDpN97XprrwQO2rOWlge
TLSH
T1D152C82EF910557B6CD7C22DF9227B57D7F6142126A02E84EBFC892C19E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a66cad8d822caf120c12b3a688d51d509ea81d1f35e311e46caa181d7d3e728e
MD5 d5dc015da7a4547a8db7a65a39f374ff
SHA1 04dc9583117ca13ae44d9132cfb1e7bacaf27381
SHA512 0c48a222d68f32ab71ebb6803d78721feb95626d7f0197e139fc675320e5e7aff85aa9141d249f78c99a8dd1fa3f6b803342e9716595eaa4fcfb31faec65cf84
SSDEEP 192:xRXcBzKL9aQk2j6tv7hIAPRp2HYur95Hsb+WNn+FBIn2bkO8es9ucvkVyIsnAUge:xRXmzkD4N9JX2rrwQO2oOWRge
TLSH
T1B352D92EF910657B6CDBC21DF9227B57D7F6102126942E84EBFC892C19E7ACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 178b056b62f920db3db9cb6db35f7e6de52c81e24a1f5f912757906a102e070d
MD5 feeb19d08cc8743a42e9e8a734efbf06
SHA1 2dabc3e3b1981e92b620f69c53b292864990c3e5
SHA512 778462598083e0ec229bca9e8a79d808bb944378128e2dbaecda1a52523dfaacf4e200ca894abebf4d4620e02790d40de77ceadc3d96aa6f9c6efb5d6c50f34c
SSDEEP 192:xRXcBzKL9aQk2jbtv7hIAPRp2HYur95Hsb+WNn+FBIn2bkO8es9ucvkVyIsnAUge:xRXmzkDdN9JX2rrwQO2oOWRge
TLSH
T11052D92EF910657B6CDBC21DF9227B57D7F6102126942E84EBFC892C19E7ACC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 73b34065ba9dee44c28d0d9c806ae3564d24318f0ef3cc511e61fa971154451c
MD5 348306edf2e7418168e5ddda5fb4babd
SHA1 9fd48983bb1ff24bfe67b23a951065486fcd6393
SHA512 1080aabc6b4b0f750198d8853b4d3f8fd69b941247a90c29f660ad80b8c8fb0130745770f2074ae1c0844b1677ade0a4e07446a39ffad704587ef4821dd4fbeb
SSDEEP 192:IOR0cBzKLuaQk2j0Cv7hVuPRpbaGB4GBuMoyGT95Hsb+WNWKGilTxNGK4In9Pbuo:IOR0mzkyiO9uXE1rwBzlumOWlge
TLSH
T16462C72BF920157B5DEAC22DF9227B6BD3F6142156942D84EBFC892C19D7ACC320741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d8fd5e6d5fc84076830f6b1737122522334af3762e071768d604369bb39ab5d8
MD5 84083251b5ae84b96404a0e4471e5fbe
SHA1 5047ee704b2dfa536946c5cea6b252e19aae96f3
SHA512 99003eaaa4a4cfce90a0b0332bdb665658e332bbb2b0dba61500fb2a20d653afb237fb16c2fb37f286fdab31e70a124ab0de7b29c62730730828836cc5003ab5
SSDEEP 192:IORxcBzKL9aQk2j0Cv7hVuPRpbaGB4GBuM395Hsb+WNol1GK4In9KmEYkO8es9u+:IORxmzkDiO9uXEurwoz9EBOWlge
TLSH
T13862B72FF910157B5DDBC219F9227B6BD7F6142116942E84EBFC892C19E7ACC220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 bd2893de42c40f889b984f622394002776aef1bc3e9c470954838e4c92230cf0
MD5 3741a4246378ece41d39141fd4a8f702
SHA1 1940c434ea26aaf18a04d1aa862fa09217814f67
SHA512 54ec0802199ace6ee161668b61045069a34c30b17f2a0bcc85e12db2f430c633cd3f2e7891ba108d12e1980f9aae57ff56aeb205a3a23ec7cc9a546b05d887ea
SSDEEP 192:IOR0cBzGLuaQk2j0Cv7hVuPRpbaGB4GBuMoyGT95Hsb+WNWKGilTxNGK4In9Pbuo:IOR0mzwyiO9uXE1rwBzlumOWlge
TLSH
T1BB62C72BF920197B5DE6C21DF9217B6BD3F6142116942D84EBFC892C19D7ACC320741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 53470a5b4bfb7e7ee2a53c942771b28230abd14515bbd02e9eef79f0321812e0
MD5 5a1bc9b12621e9a3581778d9d7f66c1e
SHA1 096a06cf4eac6fbbc9c0701e940b0fa0232612f2
SHA512 ce6d421a58232c543ffbd61f7b8011ae003f4b67680147d09651778ebbfb334e1954d47c9d6722f2ffd122e0c8a9adb340eecfd6ac1dd39ef82740cd1f3587e0
SSDEEP 192:xRXcBzKL9aQk2jwXv7hIuPRpbHYuMsL95Hsb+WNn+FBIn9s3w728ZkO8es9ucTkM:xRXmzkDa/97XpnLrwQOig728+OWlge
TLSH
T12D52E82EF910597B6CDBC21DF9227B57D7F6102126942E84EBFC8A2C19E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 60e68d839a9e19dc9261a24fbd2526e236675bd868c5cd2a4fb367dd539927bd
MD5 c04b13feb07bfbf29ff474d5811d7f98
SHA1 67aebfe6833c3590f69b44edab838ecf33fd9f7a
SHA512 baa3b5ac9c1312f8957e0754564a12e3b29c30232f8275e52802f13801e227833559f34e85cf433fc6a92335903b52a4ca9f3470329f98c192eac9e46c37e183
SSDEEP 192:DRZKL9aQk2j8tv7hhAPRp2W95Hsb+WNnVi0UkO8es9ucRkVyIsnAUgtaJ:DRZkDaN98XtrwM0dOWLg8
TLSH
T12642C72EF910647B5CDBC22DF9627B57D7F6102126A02E84EBFC896C19E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3bbb61abd368c5009c2dbf8fbc8f9ec1f00432138e018d4a7bbe53d71c7e9d93
MD5 b07a4b1dd40843cec0e875efcc8f8872
SHA1 6cb3dfcb77a24f44fcc2d1913ae7f594dd390dc5
SHA512 0c8e1c17d2b1d5b9556b6bebd26c1b580371d90b46d5ae614c392cb1815cbae51c40184321b924dc2317b5c4d5e416ccd2d018ef9a595bfc3ae304e2576e9d80
TLSH
T1A9B0126084015201C41206F4314228C87164EF14A60A2B0553E0A922A827190C018092
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ae9a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ae9a.TMP
Size 96B
SHA256 ed18f5630fd0ba527c1d4cb68550c79faf3e442f59de1d00b14748b38565e1c6
MD5 a321994ebe46755d5b638aa48d13e8be
SHA1 c024395a05a0d9f413a39e6f9b0174193062a35d
SHA512 a20e40a613d3ae0f3d551361ce362dab8651c3227e367dc54b110dc23be0a1be6331ebd99bb9a2075d144580b06b047421861527e3f1bff7ccec9d6c86a84b02
TLSH
T1AFB02222C003A302C00203F02B8880E8B3B0CF20C2030202C2E02A22FC2B2200A280A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 5a18963d805ae6d2c5399c241e3044f7968af98ddad85afb2b4480b95e6b7413
MD5 04c316046a6e99b7a3834e6c73bdbb3f
SHA1 6859a5e6cf40cff1140567a7aa3328b14ae4f759
SHA512 ebee5beff0cbe5f1baf2a01741b4af78ad8b204322d42f8a7bec42b1c8b1aa1f54664ed63c7651d049c9cc49c3d2e6cbb8779af59f41604130f39e8836cd0bce
TLSH
T10EA0021517C22895CC1103707B8246C67B10C8211305930340A544C4DC525924181711
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 9902011c5fb938f7e6ae25b5c225d017ff4d40fe6105f96c3888716bf55c2b22
MD5 dde3cafabaa1a172edd4c180a8bf37c8
SHA1 d96a9754e090af24ca1ad5896cfc6a8280b9d190
SHA512 3398b429eca1fe56a4ee074cd1a47b1ce5d8fe9fc3bf731745764e08428ab33f4e9a260edd53f80a168a3e2f481b2884865aff3655b41fde992b8b10d4d3fba8
SSDEEP 6144:LQNmPtvDqwxm32+f6iY2rUSqZ/ZLW3Exn:pPtmwd+DYcUSqZ/piQn
TLSH
T11F3412331FE13F63BD92C734B6632B8A4FF1955EC434A60CAA683F9664839502902D6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 45cee929a10eec5d29b75b6da69249bb923dd75ebf13651db207338ca24b8334
MD5 688154d593519b1c9e16e40390506b77
SHA1 1248c92ad3af92c335b627ae8a3625f7e92b8482
SHA512 4107864c0b26bd1605d9def8d40834253bfeaead077c14e291145164da24fe4ef013c0bfe48841bc04b409820983d3c9d10137a22c5e65193eaf11ec50c607b3
SSDEEP 3072:qqNmPtyODRe1EVxm32+cCvRa10kaY2rnUSqfd7NtZL8cHQRZEQ6Spsn:pNmPtvDqwxm32+f6iY2rUSqZ/ZLW3Exn
TLSH
T1A83412335FE23F63FC92C334B6631A8B4BF1955DD434A30DA6683F9AA4838512512D6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 292KB
SHA256 875ee62ce876fb07de7c1586d3345525cbcd6bd898ec4d10203355c9a9e76b4e
MD5 ae7b09355e89c8d9411858d919dbb25f
SHA1 f47bb91fe157a137ca399c980d923b917e97001a
SHA512 c3c9929b19131e5979e183e59e2683bb6c547bd4cc13ee5e56bbc626949eb8a3d28fc8a2c856c58031daaec0efcc939cc54bb841249c51810007522ece15081f
SSDEEP 6144:2iGlhGfF85NmPtvDqwxm32+f6iY2rUSqZ/ZLW3Exn:83grPtmwd+DYcUSqZ/piQn
TLSH
T1195412731FD23763A8928334B167168A4EF1C85BC924F31C6AB83FC67487D512916CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 911873e39ea11b87b89ec2174428dd84f21fb167a6969458f433462c25c650f8
MD5 fdad6501daa4a43326f403853d2014db
SHA1 16c2796d386d85f9bbe4d7702c6102991a48313b
SHA512 83f3b013dd47607c594844b85fd08f7b9847d4d49229021f7691a7a5fd40003294cbfac98acffaacd66ed1c7f374b7716b4824dda496e672f62fde67091df351
SSDEEP 3072:kqNmPtyODRe1EVxm32+cCvRa10kaY2rnUSqfd7NtZL8cHQRZEQ6Spsn:XNmPtvDqwxm32+f6iY2rUSqZ/ZLW3Exn
TLSH
T1C63412335FE23F63FC92C334B6631A8B4BF1955DD434A30DA6683F9AA4839512502D6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 4eba698dd55b6214b27b39d010a0445eeb2af912623a4a57dfd63d18433bfa19
MD5 3f2dca422f9ffde85bdbfa2efba12651
SHA1 7f5561920269bce25c0a18e821722e403c400039
SHA512 8a0a9e69206b72234e722e148cb059bfed479fbdfbd07a231e1401f5d3b0a0412764209942205b337075390479f2933480370b360668bf3470bc4c5ca25abb9b
SSDEEP 6144:zQNmPtvDqwxm32+f6iY2rUSqZ/ZLW3Exn:xPtmwd+DYcUSqZ/piQn
TLSH
T14C3412335FE23F63BD92C734B6632B8A4FF1955EC434A60CAA683F5664839502902D6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b34bbf12-21d5-4d98-a30e-8b57426c8def.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b34bbf12-21d5-4d98-a30e-8b57426c8def.tmp
Size 115KB
SHA256 379afb96187383fddb37743e03db1b9b75924beb3245de73a6df7af5ea941020
MD5 215a96bff559ebe833997db5bba6bbcf
SHA1 a0792f7d4060c548833b808aedd1fe7336e6511c
SHA512 6ce93ac395831bde6718b632cf45dc44ecdefbbaa1705b1a479674f1c25a495d03c52c918e4ac1dc5fe34cb4ed31c9cf604f16a70e163602bc690c5970fe1bda
SSDEEP 1536:6qyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:5qfd7NtZL8cHQRZEQ6Sps9
TLSH
T194C30237EBC21F335D92CB64BA534FDA97B644A99030D301AABD3BFB6C93451644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh9984.tmp\System.dll
Size 12KB
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsh9984.tmp\modern-wizard.bmp
Size 150KB
SHA256 54eec84988f8d5d5f1cdfefd74333dbcd85b1ff525b2b1f9cac6de9905cefe1d
MD5 fd944873f187518849e6e3336c45f968
SHA1 3ba4d7d455372a329eb44200ecdd2e3075869047
SHA512 d2bbbc19e4114fc68c695664bf8c5ba4f04e96f24b002f4e37c8147f946c32c043a97723f6536c4a8895384a2c119fd2fb8042e3e27a16fdf55d4f779e0e1f3e
SSDEEP 192:8tq4juZtJc621zAgTZoN5qxtCZiF46E5tOPfPq5hFziRZG:8tqvtW6tUinK
TLSH
T173E394EC7911C899DFB9367079A1258022A37CD30BC68207F0BB372D557B1A96B0FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh9984.tmp\nsDialogs.dll
Size 9KB
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
TLSH
T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 a3f1b5b04f9f0728ecb5592b0a9a90bf7c9bf9a071ede5b41d6a3f50f9ee7008
MD5 3c64e34d1b8f430af754817ad89f5cfd
SHA1 ab22977fd6f647824a163baaf8a90f64b8a73218
SHA512 ad30aa4ac6cf0fced76292839f9ee4f54f829db2a9627749a5a653afcb8355080f944845c5fb72270766c3968d95f18eb969c9f30bab4e63cc2f4ca47bcfe3e3
SSDEEP 96:N/mjkZ00Pfak09rq0aAzFnwA09UE0gJSw:N/mjkZlPfY9rqfxh9Y0t
TLSH
T1AE02F14537FB6645F1F3C939A9B337219F76F8078A185E9E4280930808B5A105DADF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 47afa04fa9d88206cdce2ffe778ed6472159739393ecd0908b4537b98f0e87dc
MD5 999aef088490d6c28fa7944f12e222da
SHA1 691170192e3e734d75b2d51dad7c6e0dbc7ce088
SHA512 ee0d17aff9b90b5ef86cbf3728517e5748c1dc19e702058c8214a5ed7b74817f7a07d2d5a918952a8929d3eafbe0cd8f94488397f12c0b388f0b09ad644111cb
SSDEEP 96:S0/mjkZr0Pfai0UmhKFkNHjkZr09rq0aAzFnw309Ur0gJSw:v/mjkZoPfeUitjkZo9rqfxE950t
TLSH
T17B32F04537FA6545F2F7C939A9F337129F7AF80389185E9E4280830809B5A105EADF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveYourContentHere.txt

Path C:\Users\Admin\Documents\Xfer\Serum 2 Presets\Clip Banks\User\SaveYourContentHere.txt
Size 28B
SHA256 d075e2d9140936f59212626377644656770a38f7647f680d89de778dc6515387
MD5 a1f07dba0f4c7831e59d05cd9130ad4b
SHA1 95867bda781ba26b148adbc5b655606a36be7124
SHA512 d79e9aec150046c7221d7346ceab6b97c1de3a9857affa3823ad6756808a2dcfefab8c553a567d875d7e7ddf7ef44c482c5e66058f17168452f575631c1978bb
MD5 SHA1 SHA512

Submit Download