hxxps://cdn[.]beyondmp[.]dev/launcher-releases/Beyond_0[.]1[.]10_x64-setup[.]exe

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
191s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.beyondmp.dev/launcher-releases/Beyond_0.1.10_x64-setup.exe
Sample260715-hypzmsd13p

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1748	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	4608	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
3756	Beyond_0.1.10_x64-setup.exe
1844	app.exe

Loads dropped DLL 8 IoCs

pid	Process
3756	Beyond_0.1.10_x64-setup.exe
3756	Beyond_0.1.10_x64-setup.exe
3756	Beyond_0.1.10_x64-setup.exe
3756	Beyond_0.1.10_x64-setup.exe
3756	Beyond_0.1.10_x64-setup.exe
3756	Beyond_0.1.10_x64-setup.exe
3756	Beyond_0.1.10_x64-setup.exe
3756	Beyond_0.1.10_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	app.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beyond_0.1.10_x64-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4608	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285730126799779"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beyond	app.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beyond\URL Protocol	app.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000c4c770c51ae3dc01b23728f223e3dc0195e8f8452914dd0114000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beyond\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Beyond\\app.exe,0"	app.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beyond\shell\open\command	app.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beyond\ = "URL:com.bynd.dev protocol"	app.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beyond\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Beyond\\app.exe\" \"%1\""	app.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beyond\DefaultIcon	app.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\beyond\shell	app.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
4232	chrome.exe
4232	chrome.exe
3756	Beyond_0.1.10_x64-setup.exe
3756	Beyond_0.1.10_x64-setup.exe
1748	powershell.exe
1748	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1432	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
3728	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1844	app.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1432	chrome.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 2952	1144	chrome.exe	87
PID 1144 wrote to memory of 3440	1144	chrome.exe	88
PID 1144 wrote to memory of 3440	1144	chrome.exe	88
PID 1144 wrote to memory of 4608	1144	chrome.exe	89
PID 1144 wrote to memory of 1912	1144	chrome.exe	90
PID 1144 wrote to memory of 1912	1144	chrome.exe	90
PID 1144 wrote to memory of 4996	1144	chrome.exe	92
PID 1144 wrote to memory of 4336	1144	chrome.exe	93
PID 1144 wrote to memory of 4996	1144	chrome.exe	92
PID 1144 wrote to memory of 4336	1144	chrome.exe	93
PID 1144 wrote to memory of 2916	1144	chrome.exe	94
PID 1144 wrote to memory of 2916	1144	chrome.exe	94
PID 1144 wrote to memory of 2536	1144	chrome.exe	95
PID 1144 wrote to memory of 2940	1144	chrome.exe	98
PID 1144 wrote to memory of 4964	1144	chrome.exe	99
PID 1144 wrote to memory of 4964	1144	chrome.exe	99
PID 1144 wrote to memory of 1696	1144	chrome.exe	100
PID 1144 wrote to memory of 1696	1144	chrome.exe	100
PID 1144 wrote to memory of 2708	1144	chrome.exe	103
PID 1144 wrote to memory of 2708	1144	chrome.exe	103
PID 1144 wrote to memory of 2292	1144	chrome.exe	104
PID 1144 wrote to memory of 2292	1144	chrome.exe	104
PID 1144 wrote to memory of 3752	1144	chrome.exe	107
PID 1144 wrote to memory of 3752	1144	chrome.exe	107
PID 1144 wrote to memory of 1636	1144	chrome.exe	113
PID 1144 wrote to memory of 1932	1144	chrome.exe	114
PID 1144 wrote to memory of 3760	1144	chrome.exe	115
PID 1144 wrote to memory of 4232	1144	chrome.exe	117
PID 1144 wrote to memory of 2220	1144	chrome.exe	118
PID 1144 wrote to memory of 2220	1144	chrome.exe	118
PID 1144 wrote to memory of 1396	1144	chrome.exe	119
PID 1144 wrote to memory of 1396	1144	chrome.exe	119
PID 1144 wrote to memory of 1432	1144	chrome.exe	120
PID 1144 wrote to memory of 4144	1144	chrome.exe	122
PID 1144 wrote to memory of 4144	1144	chrome.exe	122
PID 3756 wrote to memory of 1748	3756	Beyond_0.1.10_x64-setup.exe	130
PID 1844 wrote to memory of 3728	1844	app.exe	135
PID 3728 wrote to memory of 3800	3728	msedgewebview2.exe	136
PID 3728 wrote to memory of 1328	3728	msedgewebview2.exe	138
PID 3728 wrote to memory of 1328	3728	msedgewebview2.exe	138
PID 3728 wrote to memory of 1328	3728	msedgewebview2.exe	138
PID 3728 wrote to memory of 2808	3728	msedgewebview2.exe	139
PID 3728 wrote to memory of 3412	3728	msedgewebview2.exe	140
PID 3728 wrote to memory of 3412	3728	msedgewebview2.exe	140
PID 3728 wrote to memory of 4380	3728	msedgewebview2.exe	142
PID 3728 wrote to memory of 4380	3728	msedgewebview2.exe	142
PID 3728 wrote to memory of 4380	3728	msedgewebview2.exe	142

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.beyondmp.dev/launcher-releases/Beyond_0.1.10_x64-setup.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb8fd3c728,0x7ffb8fd3c734,0x7ffb8fd3c740
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,616866369333312115,12387851174659327834,262144 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,6315182016128892613,12723687176449037604,524288 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,3518600771063032129,11248674654725980427,524288 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2336 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,3850721674723944243,1058216239895652712,2097152 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,9849298723820797649,7961688972170283017,2097152 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,10506428606479286166,14143789622579400574,2097152 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,4169791005366062744,3117878663373944336,524288 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,6933236752559777172,283146600333620499,524288 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5268,i,17177814389769167900,3757800306393684317,2097152 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5900,i,1352891849946259874,16974634442445603205,2097152 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,2676101398156841088,5422861172098775649,524288 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,6766345661328449912,5886454615359333768,524288 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6512,i,1783170700801830183,9344034148363094458,2097152 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6632,i,11041367469523757347,1124546013688597297,524288 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6636,i,13667540048291903027,10327430043863897267,524288 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6640,i,15977981768035116659,240088113530647253,524288 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4720,i,2285519490168895649,13195735282189641534,262144 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3240,i,15863825419072327369,2692337673407932787,2097152 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3356,i,10152996679488596476,11968654222417148157,2097152 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4784,i,13226347768184888506,6078314941378710592,524288 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6604,i,15349988264421566401,14713554919244871724,524288 --field-trial-handle=1796,i,5273356257933257954,16661500557297199080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:4144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1468

C:\Users\Admin\Downloads\Beyond_0.1.10_x64-setup.exe
"C:\Users\Admin\Downloads\Beyond_0.1.10_x64-setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Users\Admin\AppData\Local\Beyond\app.exe
  "C:\Users\Admin\AppData\Local\Beyond\app.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=app.exe --webview-exe-version=0.1.10 --user-data-dir="C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1844.2304.16577098299920199213
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffb821db078,0x7ffb821db084,0x7ffb821db090
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView" --webview-exe-name=app.exe --webview-exe-version=0.1.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,13175365568612015485,14636183391521114438,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView" --webview-exe-name=app.exe --webview-exe-version=0.1.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,13175365568612015485,14636183391521114438,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView" --webview-exe-name=app.exe --webview-exe-version=0.1.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2384,i,13175365568612015485,14636183391521114438,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView" --webview-exe-name=app.exe --webview-exe-version=0.1.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3676,i,13175365568612015485,14636183391521114438,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.exe

Path C:\Users\Admin\AppData\Local\Beyond\app.exe
Size 23.3MB
SHA256 9493138ac7cdbc89deeaea77bf38a056879d93ec266a060629d34881fa9ffa2d
MD5 d7f3bcf4d33bf2a2c1fe5358564ca34a
SHA1 ea17997d1380c3c0b95497c223422e68e47b7020
SHA512 7e37f336a17f1f39148e5a1617b6e3526112ccdabe199c063f4c526538967b69de063e77c91b4656f77029d74d434b6685125aa5325f303c2cd6095e8a3cadcc
SSDEEP 196608:z11jxGT7xC7a2vMWeFYIkAH9Menaiei8YqijRGXItTlqFC:zYMu2bAdMziekqMRGXItTlI
TLSH
T1DB3718217A5B996CD09AC47083478A661E6138DB0B35B9FF448466383F7EBF46F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1e124d5e003a24c3cb59cd942f19ab35bbd3bf1332b67130d6d60b1bef068d07
MD5 6d02f3b8b36fe8ce65cd000be3a45393
SHA1 0ef2a3ec27ee975df2b787b2ab8241b77fb7a406
SHA512 09a945f7f5c59c80b213ccd7a05bf475479289c42361bb291f0915c16bd6893ea00e43817779271f37ce1a5906a03abb6308dd06cdd86805553c6d1ba2d7a653
TLSH
T1FAE02B79CA629C3B1DFC1718B4654F46E641231727409C8F773D810C4FB473E468685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 373KB
SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
MD5 7eb1501498252ec1a30118a2d3917c94
SHA1 b275a098ab3e050e2b4ac71eac10c238c2365c45
SHA512 8f5831b6bfeaea74aba0d23b684687e0a308f51f1528859535c9df335367b946b6be42500ce637e77baff40795bbf152e24abcfcee227c6d9d0e490412e09d26
SSDEEP 6144:bBJYkBiu4su2hIklCVm8ZiLHBd0R+2jBLX47rD+CNOgtU28xNAoWclJ/lo31jjuQ:bfWV22kvnBSw2FLIPDVNfN8nWclJ/Md9
TLSH
T100842306FA0DD6F4A7A40DDD2990A3E04D1372444CFC4A347B8523B9DDE3AEF4A159AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 1e499f66684f547a76c085985eee08b8d089fc954cabd39a21a31242cb5cc933
MD5 9cae574763432d472f76f6cd9384f97e
SHA1 69308a1c2aa9353603e12e79af93cf400bcc15d1
SHA512 6493fc6a2e906e407a087463bb0d8068c2ff2f6f624b5388cb887e84bd5a9efbf4f0cb10122a7653e1a9dfde8655a56657b1c21a94727124ff736757af3faea3
TLSH
T1F431CEA050C25072EFEA9EF00DC2E60C727A01F0D0531DB7AA949935AD9FFEC20D4A49
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 917d1bc8db6be8a38ff856025cbf7851567104855b9b69590569b84b4a46ecaf
MD5 ddfa2097b1e27437f90f11abd56161f7
SHA1 0c0ee74a881585d885bca6a526a824c2f3f47f16
SHA512 645656ecf80b0ecdba6d04e39bb6ef343056bf7d09c891544010d4cd3b7e865924501b80077f29b07e56f3e195afb1ee0893472788c12e0a4594e362ead752e2
TLSH
T1BAC012A191557061DBCE06740CF3D041B4D00CBC09CBABEF85C0916DDCFAF907A05D89
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 102255832b236741cae925d49d16dc527faedd270564968a50e53a017e26005a
MD5 4350436f9b1744548424635f8db4ed11
SHA1 a4733b8fbfb013dd505c78794b665bbb8850b4cd
SHA512 4ca63312be22df16d8ef9e0d96849c175bb8b147a6a4eefc6dc7b7f68e4befefa679b63c72e2a1633e4c5a510ca3a73ae47b81dcce8ea870aced82d7c3763d25
SSDEEP 48:YALlh0qHqth1hPafo7XLsHTIu6sagmzsSfszosqKsAqzsxtsIjhhnONzsu/+sKq6:DewUPNaa8Td0hKaCRjjh4/E6XpVE
TLSH
T166A19FF7C3D8852DC91196F5AB256F2FCE2D0964432C3C66C8D4AE5B97E2872D21074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 d3a89c005bdc7006cac8739f1359236fba5f8a19bfedf2c04c391262f2472244
MD5 76facfd99f8a7490e436687ac2ed0f1d
SHA1 2725a9448a8a59d5e57be19bbc186ec3955dda5c
SHA512 9ab6a2db49a862aa6ad97b4319468662c3e6342deced231161a7829893425b2225bc9e1ff561e33b0c7e000f376f30684af2fe645998d12ff7c4a6b650d989bf
SSDEEP 384:DewUP1rP5Xg/rSwbIHaaWd0hKaCokE6sMGA0vICV6ITI2IqDj3hVQUgb7FjK1HS:37EcJES
TLSH
T18A4290F7C3D8C62DC81166F59F257E2BCE2D096452283D27C9D8EE4B67E2472E21064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 674f76a97237116aef15c8a5b7c71720726cfb750c3b29b908bed3dbfc41f172
MD5 c30b5607c1b8cf47c4f8e0e8e55f6e14
SHA1 a1a64bbab9498d35e95bc65929d6685244b4aada
SHA512 c7f1762b8a3a894989a31db8af4e1c025b3af3c9b218684743e9bf5dea97a1944fadec6792c7697d82578ba495ecb502f0ec88a86224f0eaa52bd0cb0e038f6a
TLSH
T15E819CF7C3E4862DC91196F59B256E1FCE2D0A24431C3C66C8D8AE5B93E2872D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 be5c32ce02e204bb4603ddb8479c9ea79b31f87298b44c0c1827d3a3ecfb8d2e
MD5 bef615bf736cb8d8174e51f1dd0d8c5b
SHA1 99435bdbf55584746557dc96ec3b3eb739967b68
SHA512 ca2c75693146a114d339f17609db43971d1e9a39ef89919f848973c6d6948457bd8124abae97b7defe28c057363f15e769c2d54a52008c4786b2fd15b5aa178f
TLSH
T19A2149A7A17EF45350BD18AB1D04F819B97AA83416809DE4DE7BC1BDB0808E30F63597
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b12c99a2c04b53beec8d09c0867e4ff59e10c93f3ea9f347aefcc633c8437adb
MD5 ffad37b1759cf6eea8435e8fed477d8b
SHA1 9995d8a5ee784e91db4865b3f68aa74de6b17719
SHA512 8379661f9f4f8fc95b27324f2184d73fca1407837d4130f716c9996c50a2965646b3b4ffdb6874fbc0b288a7b0f8dac2ff41348bdb22bba55610cba1382944ca
SSDEEP 192:CR8TC4KV+Fgv7MF+pAPRp2S9HHsb+WNnmM08OiXkwH9VyIsnAUge:CR8TiC8goUX91wR0fWLe
TLSH
T1F942C72EEE15697BACCAC229FD527B97D7F5102231D51E84EAFC891C14E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 acb80bd244b2a2bdd37899108e1166316fc2aa09afb3c26aa864e91e3e2fa99f
MD5 6bbbc641fab117275a30836db2c6f709
SHA1 3710708dc51f68bb6b950f61b689f579e5f4f964
SHA512 502c89e72f411c74f4b0a31ba84224ee2324d0b13c75db1a08f9bea432d415536dd19a7105a0d7a8b1ee2124dfddf221743d7f3829e219bc7124693088b46fa4
SSDEEP 192:CR8TR4KV+Fsv7MF+pVPRptzK79HHsb+WNnmM4gDIg1OiXkwHlVyIsnAUgE:CR8TVC4goXX21wRTIg0WTE
TLSH
T13452A76BEE115D7BACCAC229F9527F97D7F5102226941E88E6FC8A1C10E79CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3bba979f53320f6dd7b163f3bb3788af778ccb9a594c3d5c65dcab9be4fd5f8b
MD5 1d8edc0caecfdd3bd25f230767ff2c68
SHA1 4b72702d165054be8facb71b2e85ab0699923a9a
SHA512 bdd538ab48f223e1103365e0c22c2c3402240ec575609df39758a11c2be12709e1c102bf36ce1aa74f07d36bf1011311c51c6acb5e1de0fe64bbd14219f28805
SSDEEP 192:CR8TR4KV+Fuv7MF+pVPRpt4T9HHsb+WNnmM4+2YzOiXkwHlVyIsnAUgE:CR8TVCKgoXXE1wRQYaWTE
TLSH
T18252A66BEE155D7FACCAC229F9527F97D7F5102221941E84E6FC8A1C11E7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f6e00382554313f6e4d13f4f6a69faf48fa01e658995b1d9a4db0e5f62f33ac6
MD5 1f517d7e290019b02a7c41c276f56484
SHA1 07ba90f274f8a5ef27a72d39d7d473427ad2d4fc
SHA512 2000ab7a61d287e8fd6b3e7bc664fa030243b476d884e590f62852e0690eab414a080ea56a3ea8939133d231e8a3d7ccb6423608dd112f8230aa27869aca4f82
SSDEEP 192:CRccBzTR4KV+Fsv7MF+pVPRptYquZJ9HHsb+WNNpmM4ZdcEOiXkwHlVyIsnAUgE:CRcmzTVC4goXXy1whkcnWTE
TLSH
T19452A76BED101D7BACCAC229F9527F97D7F5102226945E84E7FC8A1C11E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fa89e6b83656b7715bbb47832421aa2143d16325fdf1d44c7039a0f6a2ca8601
MD5 58da51aaca4a1ab3eda53b4464252f9e
SHA1 6261c44602484fb21a9153f92573e157b9f4c49a
SHA512 f99759212cb8fe8fedbb44739e65ba20469ca4bbd51d0dadbea04f5c637ffa8153b0cfcf2925967e5b1b6fa1ba0f186d30f288fabe5aaae0285b0da52f009ddb
SSDEEP 192:CR8TC4KV+FGv7MF+pAPRp24T9HHsb+WNnmM4v12vOiXkwH9VyIsnAUge:CR8TiCygoUXz1wRq2WWLe
TLSH
T10142B76BEE15697FACCAC229FD527B97D7F5102231951E84EAFC891C10E79CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 733ffa0fa897ce1a73262508577881e724ed1f5b56711ab2f934ecfd5b8d8f8b
MD5 129e57c137ddc5daf4cb3387f6d58b4b
SHA1 21a7cd00fca8462772f85abf443f125178466d27
SHA512 c6fe26fe0f22ead41430974e86914b72fe5da39f6e2a64ce9fd058b863563c20d73fe0cfa5af5475b0d46cf908e6c730894fe50258c91631a31d7384d7c9f670
SSDEEP 192:CR8TC4KV+Fmv7MF+pAPRp24T9HHsb+WNnmM4QeeFOiXkwHzVyIsnAUgE:CR8TiCSgoUXz1wRKekWVE
TLSH
T13652B76AEE15697BACCAC229FD127B97D7F5102231D51E84E6FC8A1C11E7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 e0eaa908117dc03da91ba3231c0860ffeb210a7733f021e958fe0a608f098a05
MD5 b58c9ef30b3e991dd608c83e086e8db0
SHA1 422e492976cdd4d523bf4d4b94359563bd65b16b
SHA512 808306ba78786585d5b09fee5613d95cf89e8a39c2c300fffc0ed4f517c10193b72ae7ac0a718d1774a3a7b8933285f9ce1dfa4e7caf294d120b597d6106707c
TLSH
T1BEC01201C601A220C06A03F41543ACADB154BF25C919135E43F4A966FC39831C0191E2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7171311649484511515598647e325f7fee5721d95802c6903171fabdea9ab901
MD5 f8b1ba64b4d63fbe893a76b264979413
SHA1 9aebbf8a07898a9b80d40f269872c651d4f0d43b
SHA512 b4f067a3425a29d3127f4541b73815f6e9019aa9acd153cfdeb1af7e4ea2fb79c7aba47e757f4259b0becf74a7f5cf096a9bc73ea3a3c37dbe97df77f0e0666f
TLSH
T1E5B0124184416601C00207F8195254E871289F21960A170143E06A2788365518114250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a16b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a16b.TMP
Size 96B
SHA256 c264d62b29ffd899e0395041aa673afb852afab04379b2761f01b1448e95f973
MD5 76c630e03fd340e133171ac5242944db
SHA1 be4fd4957f3f14b80717c44ca041d12d5249873a
SHA512 12843e8f21574dbb5c52abf763423575937e5b850960d65a65e1b2fa159c1d4e464be95705e3d96ca0be0ff014c7beee39f7d53313bdd946845881c7937ec4fe
TLSH
T129B00255C2467613C04303B42DAAB6D87160DF35DB43532692F11AA6DC257A149296B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 84f3d4ee679b8a63de4df007872a2407ca91045eaad34a28e0eca3f3c902c6c9
MD5 05dbb1fad48eb3c3ff71dfe4a27acbd5
SHA1 5054855cd44bfb6ec5f0831c1f357e1eb230a717
SHA512 6b736555d0a36acf1596e7e5440ccc9f0cd93254aeb6b513858916e06d85f5dcaf49a316815c87fbcff4c42849261c33ba02cc144195a9e3ed1278608bbb8fbd
TLSH
T1F9B0222880000C38CB0302B022F308E23F082C2C83E3C0228CA0A08CE803022A330AA8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 156KB
SHA256 a4d9521dbc6976d71186278342b40735e4573429823dd19d6c05beae0bc25132
MD5 18f83ea6a415c9a24062ddf1f92d819e
SHA1 82f7830ccf6041e635dd1025f3db83ebb3f28b78
SHA512 ed09808919a15cab859bd0fe420d3d031e0188b95a2c8b0e064b6d08364c598dbdc5565bfbd5975b4594d89dbd056a5fa0e43688cb126b427a0f7977f565d834
SSDEEP 3072:FzeWd8XWDZ6Tk+HvtPk+DEGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:FiI/w9tPPTm7Rkm1tYpBeh2BAoM
TLSH
T1E7F3122B5E65993719B8FB4E608F090F1AF14AF6C938DE958CD49A0033EA7C82B45D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 09486c49c6b5091d4d05ba0a6f9f45a66044840335deeccac4a51f512e0aec19
MD5 af6bfaaf7f37c0be4ed753c7dcbf1fdf
SHA1 0cc7c3d2ebb0256cfdad8d1d6f1363077645a5c5
SHA512 03f361166a87bd3fa4b56932f7257b932531ab44b84f2bcae47ca508dbc00d451d75ca8e06b25a5e021955b71bacac985734046b426946db696b394ab8678428
SSDEEP 3072:/ZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Ym7Rkm1tYpBeh2BAoM
TLSH
T169C312275E75E9375878BB0EB08E0B1F1EF14AA6D930DA92C8D85B0467F97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ac1d6fd29100882ace203350889af41191b2b84cfd7bde71304a9983c743ed01
MD5 061447756825c71862ac71e1fc6519b9
SHA1 56c61a1a4d9f121ea269882080f651f85b64739e
SHA512 50df74e1f2a6a7488cf8c0106c451b262a1ea556d52c0bc49fc7c309f4f5b7b1abd87a049a88c2ac80187cff389cffdddebb558951cda321aa443de1f025c077
SSDEEP 3072:G2TGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:G2qm7Rkm1tYpBeh2BAoM
TLSH
T1DFC312375E75AC3758B9B75EB08E0B1F0EF14AA6D820DE92C8D85B0423F97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 79fcc447296bca135b9e9b3646d81534bef8f4cc7055207e0c6c8cdee62506b0
MD5 21b31b15a40db21f2278f32bbd0e5124
SHA1 a896a0836c135a3f454dc127ade4755892449cb5
SHA512 d04a7582ad5c7877d023e937affe6022a3701def141a86ca1a4092a80725e92ee80d6b5b408c471c228021986fbfbef3781769fb64f63a9ebb609b97220788dc
SSDEEP 3072:F2TGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:F2qm7Rkm1tYpBeh2BAoM
TLSH
T12DC312375E75AC3758B9B75EB08E0B1F1EF14AA6D820DE91C8D85B0423F97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 159KB
SHA256 9bf0acf1f1867a3994c39a740132be33778a35d5babe5a9c931a39b0c625d711
MD5 c5b97799b35a7ee6ef21ba7e763caf4f
SHA1 8def4e07a2d5ca9ebdf173b0b9432c796d24bcce
SHA512 362be15c36ea6f690cb4814974be0ac0b7a6c15f322ee677877207c226e4ac7ebd8be8ecfa6ab84dc449b6c04dad0a41079eaf6136af94af36772945282540ef
SSDEEP 3072:FP/zmzhWlgGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:FPSzhym7Rkm1tYpBeh2BAoM
TLSH
T159F3122BAE26B83754BDBB0AA08D0B9F09F14A6296349C91C8C95F4473E979D5D44C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 8d43fed2f5243cad7709f08cf297c8c23f0275fffbf6154373ddb82d8b2ee474
MD5 afa6ce6d41b1fb18caffe9cd9467488c
SHA1 2e02958c53fc2c45e4999eb0497947b2c4828db0
SHA512 533393f278f8df2c88c2440bc8b2abefa6b94fa7a44af4e2a5929560db939a563cf3bc99b69fa5ff1428a20704837caa1edf193b7e96ecf388a41498c98aa5d4
SSDEEP 3:MsEllllkEthXllkl2zExllXSQu/:/M/xT02zKSd
TLSH
T16F440405FFD00405D74410304413C3511370D4100D1357C3747104137CC55400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_kfhd4h1k.nee.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kfhd4h1k.nee.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA79D.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsqA79D.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA79D.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA79D.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA79D.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7aef1b045f5a18581fbc3ab8367b454474549cdfdd555f5df778fdc68e5fdd11
MD5 644f63796feed0d532e8be57713d202d
SHA1 568b8bd9e5c2ae798f9d6950736d92a6688f6d9b
SHA512 ecc1d4012f5f13135e8eb9e039273615d79793fe0ed841697dd58fde25e4c7d7be0a3927e161c09c96410f9c143654e3fa2495143588f26d58b2d2fcf5b152d2
TLSH
T1D2D0041151001153C44511711F10D301010045573113011013517D0737C14000005117
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bb12e90a551deda47e0644834dbed659e858286afe8a196167bd1d899ef98fa8
MD5 5319299d5302e153bea562d21ca0d165
SHA1 0be29410341451835745bf3e5dfe47b90d4850a4
SHA512 53d520981524465db78eaad75936b86a2dc247103a85ed12f372611dc57156ba55e1474a5f3e0038918a7e22035be4b502b98df322e753fc735a83d2e9b4ada3
TLSH
T188D0121332010275C41021731A02B2090400C21F510640006629EE1F3B444500906453
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 faad700b3c58f2306820b81f74ec8d3e77c3c2762e47c22a27f9bbacf98716be
MD5 5d2ff6fd3a81226830408aadb3c20bc5
SHA1 5480b92fa0008a6e5f661d66913280868b6ce2f3
SHA512 a114efe8fc9d23d65b58303fe3c5f24af32798d3c9a11b9a26b6faedaafb662a445a981bf29747e0bddc3a6af47fcdea5450aa9271b3989fe48b4fba4bf87416
SSDEEP 3:LstlNllkll/lpSQKl//:LsX3lEthK1
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Local State
Size 1KB
SHA256 b0035d6d84f15a0e532764bf54986c27304380270771a787254c3b951693d4b1
MD5 2dbf8ab0bbb2d2d207ca9d68e241db15
SHA1 d5f4574186b21de68ee7ef8148a80edd840a9873
SHA512 54c1532a21626c8632e6f37f2102a4542e24ef20e7644542bb5cab6901a95a2dfa74f40913c35ad0f4d9df22322337d03a3b9cc3221207114d2c7d16ae58378e
TLSH
T1CA318573A4902A35EDD15289F2467ED3BE343076E7658E9C93DD0B0C02D368C6A26C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Local State
Size 2KB
SHA256 9950d9050610275c4d71cbbad0272b229b67f76d05b5482f76df77cc992cdb41
MD5 29c1abf20d1cdf34d087fc8a0e991601
SHA1 fd3cd9bef3fa34667f9702426e2ab7b299e367e1
SHA512 fe35c021df4879040f136c85c0697c5f5034bfe6b44fa73c251c3d1e82a208207221061dac2fe96620265dccba2dd6790f1b61dea8caa2929b7e5b4ce6153065
TLSH
T10D51873368146A3AD9E25648F9463F53FA396061FBA66FA897DD0B0C01D755C2702C3F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Local State
Size 3KB
SHA256 d3d4bbe2fcc43bf303987a85b4974e48029018378188b7bcf7132c73ec4a053c
MD5 36954157c3d1977ac8ff33f9c0765219
SHA1 d366da88acb25333de56757aa855424bee1f801f
SHA512 12959e0a5cc38f53a9d37706f8ab072f8e4d9c1097c4bc94407599176fd375687c8cfa3338e07171c347c421e36527c5782c8ae0d2a808fe109f13a9b4add2b0
TLSH
T1997187326964A53B8EE29945F9862F53B6655033F6D57FACC6EC0F0C01D72982342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Local State
Size 15KB
SHA256 1cbed1fe7b365286eb7ad8e8ce1bab20e4dbfbd1b6fb9498da5287ddc731da44
MD5 d645445e20b4b08354f94ad03070bef4
SHA1 b0ceaa3d6ac409f4abb7892422df11883553bdc7
SHA512 5f42a08560c7635686f29536fd01ff5043d459cea62265e5123025e9e6d35b68e51a4ed523eca9d6bca1c07805a428a2517dde467d1fb74e55303da16050f16a
SSDEEP 384:zDh6GJBYYGsR34i6jB1pNNyc7rYdgNbNiypPXFaCWkVBTdm:TYY9N4BPNNyIrYINhC
TLSH
T11C729E3108591D2B9CF0AB407A4E1A1FA6B490D7F9D5AFEACDF94B0D42E71D8130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5b0859.TMP

Path C:\Users\Admin\AppData\Local\com.bynd.dev\EBWebView\Local State~RFe5b0859.TMP
Size 1KB
SHA256 e9aa5a1a92eedd4ba943526b93be69325e504101e21b34a5e096def49b08c087
MD5 9e60c554f19d7e919546f912c78addb0
SHA1 97773e12ce36ebc7b52cdc3f202109e6c0e1a082
SHA512 0d5c7a01538a34c83ce99c2670612b3a6034087184082baa48f8d90a3483afcb8fc46eb1b4e2c3ba6181cfe0eb1124ed8c9cc3298921d4153a4fb5bae0adec71
TLSH
T1C7214D33D4946A39EA910189F242BEC37E247076EB659E2C93DE0B0C02C759C6A67C37
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 329862.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 329862.crdownload
Size 6.6MB
SHA256 8a696161a5db220018750194a0292fd75f17c81bedecf9f0c31ba40f8246747c
MD5 672968592bc2d0d38b4cfecd7c124d49
SHA1 0aec924d3c49c56fdd121ebff51dcd9ae24ba208
SHA512 b575b847825f54f7ac26dfefb714c530a0f280c02c7687e83f8ab58850a3279407322f4aa6455332d9df32d574030cd29980ab81d898646b0ac17d73537227b5
SSDEEP 196608:9kgH3jxU4roSyiJqgwIBcG0VrQNnH6yIY:9kgHTBLtqTIyG0u9aM
TLSH
T189663382DE142BBAC67B10B46E2605794E58EC9E0131E653DFA1D0F5136FEBEC336225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1328-662-0x00007FFB9E150000-0x00007FFB9E151000-memory.dmp

Download

memory/1748-616-0x0000000007600000-0x000000000761A000-memory.dmp

Download

memory/1748-599-0x0000000070010000-0x000000007005C000-memory.dmp

Download

memory/1748-614-0x00000000074E0000-0x00000000074EE000-memory.dmp

Download

memory/1748-617-0x0000000007530000-0x0000000007538000-memory.dmp

Download

memory/1748-613-0x00000000074B0000-0x00000000074C1000-memory.dmp

Download

memory/1748-612-0x0000000007540000-0x00000000075D6000-memory.dmp

Download

memory/1748-611-0x0000000007310000-0x000000000731A000-memory.dmp

Download

memory/1748-610-0x00000000072B0000-0x00000000072CA000-memory.dmp

Download

memory/1748-609-0x0000000007900000-0x0000000007F7A000-memory.dmp

Download

memory/1748-608-0x0000000007180000-0x0000000007223000-memory.dmp

Download

memory/1748-607-0x0000000006540000-0x000000000655E000-memory.dmp

Download

memory/1748-615-0x00000000074F0000-0x0000000007504000-memory.dmp

Download

memory/1748-598-0x0000000006580000-0x00000000065B2000-memory.dmp

Download

memory/1748-583-0x0000000002920000-0x0000000002956000-memory.dmp

Download

memory/1748-584-0x00000000051A0000-0x00000000057C8000-memory.dmp

Download

memory/1748-597-0x0000000005FC0000-0x000000000600C000-memory.dmp

Download

memory/1748-596-0x0000000005F90000-0x0000000005FAE000-memory.dmp

Download

memory/1748-595-0x0000000005960000-0x0000000005CB4000-memory.dmp

Download

memory/1748-586-0x0000000005840000-0x00000000058A6000-memory.dmp

Download

memory/1748-585-0x0000000004F40000-0x0000000004F62000-memory.dmp

Download

memory/1748-587-0x00000000058B0000-0x0000000005916000-memory.dmp

Download

memory/3412-737-0x00007FFB9EC10000-0x00007FFB9EC11000-memory.dmp

Download

memory/3412-738-0x00007FFB9F4B0000-0x00007FFB9F4B1000-memory.dmp

Download

memory/4380-764-0x00007FFB9E150000-0x00007FFB9E151000-memory.dmp

Download