salatstealer | 157365d292da5d243e852444596fe55dac2aa59710c6cb3eda006394aa6b4ea6

Analysis

user interaction
yes
max time kernel
578s
max time network
581s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EXITLAG_PATCHER_V1.4.4.zip
Size 84.3MB
Sample260716-cn9y6sbs8j
SHA256 157365d292da5d243e852444596fe55dac2aa59710c6cb3eda006394aa6b4ea6
MD5 d18a66fe2f7f207ee2e85503f3107c0b
SHA1 5470db98fd078349b5342f58aa223535b8c8fd4c
SHA512 937fd7a0c95383265fbbbcab7872f68d4d3428cbabe0df5bc88d9fc6edf965273d8c1362ca1f04864e903e448338b28db5a8754be803217f48ba2c4d562cc041
SSDEEP 1572864:vH1CVcU9/QYs0uMZaBzDxfVrtYRQPn28t+E1x/oNOTED9URr3edd2OsUr:9NkoYs0ul99V52QuhEUOu9URKd1r
TLSH
T1A018330412D7BB7FFE6FB1C2A835676E9045B620BBF2864A32C5F0D79179A76EC54800
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery salatstealer persistence spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 50 IoCs

resource	yara_rule
behavioral1/memory/3316-1652-0x0000000003800000-0x000000000445F000-memory.dmp	family_salatstealer
behavioral1/memory/3316-1654-0x0000000003800000-0x000000000445F000-memory.dmp	family_salatstealer
behavioral1/memory/3316-1655-0x0000000003800000-0x000000000445F000-memory.dmp	family_salatstealer
behavioral1/memory/3316-1653-0x0000000003800000-0x000000000445F000-memory.dmp	family_salatstealer
behavioral1/memory/3316-1656-0x0000000003800000-0x000000000445F000-memory.dmp	family_salatstealer
behavioral1/memory/5980-1658-0x0000000000660000-0x00000000012B6000-memory.dmp	family_salatstealer
behavioral1/memory/5980-1659-0x0000000000660000-0x00000000012B6000-memory.dmp	family_salatstealer
behavioral1/memory/5980-1661-0x0000000000660000-0x00000000012B6000-memory.dmp	family_salatstealer
behavioral1/memory/3316-1665-0x0000000003800000-0x000000000445F000-memory.dmp	family_salatstealer
behavioral1/memory/5980-1671-0x0000000000660000-0x00000000012B6000-memory.dmp	family_salatstealer
behavioral1/memory/3136-1698-0x00000000009B0000-0x0000000001606000-memory.dmp	family_salatstealer
behavioral1/memory/1180-1765-0x00000000006E0000-0x0000000001336000-memory.dmp	family_salatstealer
behavioral1/memory/5744-1768-0x0000000004270000-0x0000000004ECF000-memory.dmp	family_salatstealer
behavioral1/memory/5744-1769-0x0000000004270000-0x0000000004ECF000-memory.dmp	family_salatstealer
behavioral1/memory/5744-1770-0x0000000004270000-0x0000000004ECF000-memory.dmp	family_salatstealer
behavioral1/memory/5384-1776-0x0000000003BD0000-0x000000000482F000-memory.dmp	family_salatstealer
behavioral1/memory/5384-1777-0x0000000003BD0000-0x000000000482F000-memory.dmp	family_salatstealer
behavioral1/memory/5384-1775-0x0000000003BD0000-0x000000000482F000-memory.dmp	family_salatstealer
behavioral1/memory/5384-1778-0x0000000003BD0000-0x000000000482F000-memory.dmp	family_salatstealer
behavioral1/memory/5384-1780-0x0000000003BD0000-0x000000000482F000-memory.dmp	family_salatstealer
behavioral1/memory/4064-1809-0x0000000003910000-0x000000000456F000-memory.dmp	family_salatstealer
behavioral1/memory/1060-1835-0x00000000007A0000-0x00000000013F6000-memory.dmp	family_salatstealer
behavioral1/memory/3136-1854-0x00000000009B0000-0x0000000001606000-memory.dmp	family_salatstealer
behavioral1/memory/4864-1869-0x00000000002E0000-0x0000000000F36000-memory.dmp	family_salatstealer
behavioral1/memory/4536-1886-0x0000000003ED0000-0x0000000004B2F000-memory.dmp	family_salatstealer
behavioral1/memory/4536-1890-0x0000000003ED0000-0x0000000004B2F000-memory.dmp	family_salatstealer
behavioral1/memory/5764-1923-0x0000000000A60000-0x00000000016B6000-memory.dmp	family_salatstealer
behavioral1/memory/3316-1898-0x0000000003800000-0x000000000445F000-memory.dmp	family_salatstealer
behavioral1/memory/4536-1891-0x0000000003ED0000-0x0000000004B2F000-memory.dmp	family_salatstealer
behavioral1/memory/4536-1889-0x0000000003ED0000-0x0000000004B2F000-memory.dmp	family_salatstealer
behavioral1/memory/4536-1888-0x0000000003ED0000-0x0000000004B2F000-memory.dmp	family_salatstealer
behavioral1/memory/4536-1887-0x0000000003ED0000-0x0000000004B2F000-memory.dmp	family_salatstealer
behavioral1/memory/4064-1807-0x0000000003910000-0x000000000456F000-memory.dmp	family_salatstealer
behavioral1/memory/4064-1808-0x0000000003910000-0x000000000456F000-memory.dmp	family_salatstealer
behavioral1/memory/5384-1779-0x0000000003BD0000-0x000000000482F000-memory.dmp	family_salatstealer
behavioral1/memory/5744-1771-0x0000000004270000-0x0000000004ECF000-memory.dmp	family_salatstealer
behavioral1/memory/5744-1767-0x0000000004270000-0x0000000004ECF000-memory.dmp	family_salatstealer
behavioral1/memory/5744-1766-0x0000000004270000-0x0000000004ECF000-memory.dmp	family_salatstealer
behavioral1/memory/4064-1810-0x0000000003910000-0x000000000456F000-memory.dmp	family_salatstealer
behavioral1/memory/4064-1965-0x0000000003910000-0x000000000456F000-memory.dmp	family_salatstealer
behavioral1/memory/5892-2001-0x00000000039E0000-0x000000000463F000-memory.dmp	family_salatstealer
behavioral1/memory/5892-2000-0x00000000039E0000-0x000000000463F000-memory.dmp	family_salatstealer
behavioral1/memory/5892-1999-0x00000000039E0000-0x000000000463F000-memory.dmp	family_salatstealer
behavioral1/memory/5892-1997-0x00000000039E0000-0x000000000463F000-memory.dmp	family_salatstealer
behavioral1/memory/4332-1990-0x0000000003EC0000-0x0000000004B1F000-memory.dmp	family_salatstealer
behavioral1/memory/3136-1988-0x00000000009B0000-0x0000000001606000-memory.dmp	family_salatstealer
behavioral1/memory/4332-1992-0x0000000003EC0000-0x0000000004B1F000-memory.dmp	family_salatstealer
behavioral1/memory/3136-1924-0x00000000009B0000-0x0000000001606000-memory.dmp	family_salatstealer
behavioral1/memory/384-2040-0x00000000000F0000-0x0000000000D46000-memory.dmp	family_salatstealer
behavioral1/memory/1640-2089-0x0000000000650000-0x00000000012A6000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Enumerates VirtualBox registry keys 2 TTPs 40 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	FirstStart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	ExitLagCrackV1.4.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	FirstStart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	ExitLagCrackV1.4.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SearchApp.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 20 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ExitLagCrackV1.4.4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FirstStart.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 20 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	ExitLagCrackV1.4.4.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	explorer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	explorer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	explorer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	FirstStart.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	explorer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	taskhostw.exe

Badlisted process makes network request 11 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
477	5236	powershell.exe
481	5236	powershell.exe
482	5236	powershell.exe
483	5236	powershell.exe
484	5236	powershell.exe
485	4480	powershell.exe
486	4480	powershell.exe
486	4480	powershell.exe
493	4480	powershell.exe
494	4480	powershell.exe
495	4480	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 20 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	ExitLagCrackV1.4.4.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	explorer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	explorer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	FirstStart.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	explorer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	explorer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	SppExtComObj.Exe

Looks for VMWare services registry key. 1 TTPs 40 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	ExitLagCrackV1.4.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	FirstStart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	FirstStart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	ExitLagCrackV1.4.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	SearchApp.exe

Executes dropped EXE 37 IoCs

pid	Process
5980	GpuService_9e1e7c.exe
3136	smss.exe
4064	explorer.exe
5744	WUDFHost.exe
1180	GpuService_9e1e7c.exe
5384	SearchApp.exe
3856	spoolsv.exe
1060	GpuService_9e1e7c.exe
4332	SppExtComObj.Exe
4864	GpuService_9e1e7c.exe
4536	taskhostw.exe
5892	StartMenuExperienceHost.exe
5764	GpuService_9e1e7c.exe
5176	OfficeClickToRun.exe
384	GpuService_9e1e7c.exe
1640	smss.exe
3164	smss.exe
3772	explorer.exe
5340	GpuService_9e1e7c.exe
5012	explorer.exe
2684	GpuService_9e1e7c.exe
3540	dwm.exe
5728	smss.exe
1408	explorer.exe
5164	GpuService_9e1e7c.exe
3092	WUDFHost.exe
2808	SearchApp.exe
4116	SppExtComObj.Exe
3044	GpuService_9e1e7c.exe
1764	spoolsv.exe
4324	GpuService_9e1e7c.exe
2852	taskhostw.exe
5180	GpuService_9e1e7c.exe
3144	StartMenuExperienceHost.exe
4840	GpuService_9e1e7c.exe
1472	OfficeClickToRun.exe
4572	GpuService_9e1e7c.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "C:\\Users\\Admin\\AppData\\Local\\Packages\\SppExtComObj.Exe"	ExitLagCrackV1.4.4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "C:\\Program Files (x86)\\Microsoft.NET\\spoolsv.exe"	ExitLagCrackV1.4.4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "C:\\Program Files (x86)\\MSBuild\\taskhostw.exe"	ExitLagCrackV1.4.4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "C:\\Users\\Admin\\AppData\\Local\\Adobe\\OfficeClickToRun.exe"	ExitLagCrackV1.4.4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "C:\\Users\\Admin\\AppData\\Local\\PeerDistRepub\\StartMenuExperienceHost.exe"	ExitLagCrackV1.4.4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Local\\PlaceholderTileLogoFolder\\explorer.exe"	ExitLagCrackV1.4.4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WUDFHost = "C:\\Program Files (x86)\\Windows Multimedia Platform\\WUDFHost.exe"	ExitLagCrackV1.4.4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "C:\\Users\\Admin\\AppData\\Local\\Comms\\SearchApp.exe"	ExitLagCrackV1.4.4.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0002000000023954-1629.dat	upx
behavioral1/memory/5980-1632-0x0000000000660000-0x00000000012B6000-memory.dmp	upx
behavioral1/memory/3316-1645-0x0000000003800000-0x000000000445F000-memory.dmp	upx
behavioral1/memory/3316-1652-0x0000000003800000-0x000000000445F000-memory.dmp	upx
behavioral1/memory/3316-1654-0x0000000003800000-0x000000000445F000-memory.dmp	upx
behavioral1/memory/3316-1655-0x0000000003800000-0x000000000445F000-memory.dmp	upx
behavioral1/memory/3316-1653-0x0000000003800000-0x000000000445F000-memory.dmp	upx
behavioral1/memory/3316-1656-0x0000000003800000-0x000000000445F000-memory.dmp	upx
behavioral1/memory/5980-1658-0x0000000000660000-0x00000000012B6000-memory.dmp	upx
behavioral1/memory/5980-1659-0x0000000000660000-0x00000000012B6000-memory.dmp	upx
behavioral1/memory/5980-1661-0x0000000000660000-0x00000000012B6000-memory.dmp	upx
behavioral1/memory/3316-1665-0x0000000003800000-0x000000000445F000-memory.dmp	upx
behavioral1/memory/5980-1671-0x0000000000660000-0x00000000012B6000-memory.dmp	upx
behavioral1/memory/3136-1672-0x00000000009B0000-0x0000000001606000-memory.dmp	upx
behavioral1/memory/1180-1738-0x00000000006E0000-0x0000000001336000-memory.dmp	upx
behavioral1/memory/5384-1758-0x0000000003BD0000-0x000000000482F000-memory.dmp	upx
behavioral1/memory/5744-1731-0x0000000004270000-0x0000000004ECF000-memory.dmp	upx
behavioral1/memory/3136-1698-0x00000000009B0000-0x0000000001606000-memory.dmp	upx
behavioral1/memory/1180-1765-0x00000000006E0000-0x0000000001336000-memory.dmp	upx
behavioral1/memory/5744-1768-0x0000000004270000-0x0000000004ECF000-memory.dmp	upx
behavioral1/memory/5744-1769-0x0000000004270000-0x0000000004ECF000-memory.dmp	upx
behavioral1/memory/5744-1770-0x0000000004270000-0x0000000004ECF000-memory.dmp	upx
behavioral1/memory/5384-1776-0x0000000003BD0000-0x000000000482F000-memory.dmp	upx
behavioral1/memory/5384-1777-0x0000000003BD0000-0x000000000482F000-memory.dmp	upx
behavioral1/memory/5384-1775-0x0000000003BD0000-0x000000000482F000-memory.dmp	upx
behavioral1/memory/5384-1778-0x0000000003BD0000-0x000000000482F000-memory.dmp	upx
behavioral1/memory/5384-1780-0x0000000003BD0000-0x000000000482F000-memory.dmp	upx
behavioral1/memory/4064-1797-0x0000000003910000-0x000000000456F000-memory.dmp	upx
behavioral1/memory/4064-1809-0x0000000003910000-0x000000000456F000-memory.dmp	upx
behavioral1/memory/1060-1835-0x00000000007A0000-0x00000000013F6000-memory.dmp	upx
behavioral1/memory/3136-1854-0x00000000009B0000-0x0000000001606000-memory.dmp	upx
behavioral1/memory/4864-1869-0x00000000002E0000-0x0000000000F36000-memory.dmp	upx
behavioral1/memory/4536-1879-0x0000000003ED0000-0x0000000004B2F000-memory.dmp	upx
behavioral1/memory/4536-1886-0x0000000003ED0000-0x0000000004B2F000-memory.dmp	upx
behavioral1/memory/4536-1890-0x0000000003ED0000-0x0000000004B2F000-memory.dmp	upx
behavioral1/memory/5764-1922-0x0000000000A60000-0x00000000016B6000-memory.dmp	upx
behavioral1/memory/5764-1923-0x0000000000A60000-0x00000000016B6000-memory.dmp	upx
behavioral1/memory/3316-1898-0x0000000003800000-0x000000000445F000-memory.dmp	upx
behavioral1/memory/4536-1891-0x0000000003ED0000-0x0000000004B2F000-memory.dmp	upx
behavioral1/memory/4536-1889-0x0000000003ED0000-0x0000000004B2F000-memory.dmp	upx
behavioral1/memory/4536-1888-0x0000000003ED0000-0x0000000004B2F000-memory.dmp	upx
behavioral1/memory/4536-1887-0x0000000003ED0000-0x0000000004B2F000-memory.dmp	upx
behavioral1/memory/4864-1855-0x00000000002E0000-0x0000000000F36000-memory.dmp	upx
behavioral1/memory/1060-1832-0x00000000007A0000-0x00000000013F6000-memory.dmp	upx
behavioral1/memory/4064-1807-0x0000000003910000-0x000000000456F000-memory.dmp	upx
behavioral1/memory/4064-1808-0x0000000003910000-0x000000000456F000-memory.dmp	upx
behavioral1/memory/5384-1779-0x0000000003BD0000-0x000000000482F000-memory.dmp	upx
behavioral1/memory/5744-1771-0x0000000004270000-0x0000000004ECF000-memory.dmp	upx
behavioral1/memory/5744-1767-0x0000000004270000-0x0000000004ECF000-memory.dmp	upx
behavioral1/memory/5744-1766-0x0000000004270000-0x0000000004ECF000-memory.dmp	upx
behavioral1/memory/4064-1810-0x0000000003910000-0x000000000456F000-memory.dmp	upx
behavioral1/memory/4064-1965-0x0000000003910000-0x000000000456F000-memory.dmp	upx
behavioral1/memory/4332-1981-0x0000000003EC0000-0x0000000004B1F000-memory.dmp	upx
behavioral1/memory/5892-1948-0x00000000039E0000-0x000000000463F000-memory.dmp	upx
behavioral1/memory/5892-2001-0x00000000039E0000-0x000000000463F000-memory.dmp	upx
behavioral1/memory/5892-2000-0x00000000039E0000-0x000000000463F000-memory.dmp	upx
behavioral1/memory/384-2037-0x00000000000F0000-0x0000000000D46000-memory.dmp	upx
behavioral1/memory/5892-1999-0x00000000039E0000-0x000000000463F000-memory.dmp	upx
behavioral1/memory/5892-1997-0x00000000039E0000-0x000000000463F000-memory.dmp	upx
behavioral1/memory/4332-1990-0x0000000003EC0000-0x0000000004B1F000-memory.dmp	upx
behavioral1/memory/3136-1988-0x00000000009B0000-0x0000000001606000-memory.dmp	upx
behavioral1/memory/4332-1992-0x0000000003EC0000-0x0000000004B1F000-memory.dmp	upx
behavioral1/memory/3136-1924-0x00000000009B0000-0x0000000001606000-memory.dmp	upx
behavioral1/memory/384-2040-0x00000000000F0000-0x0000000000D46000-memory.dmp	upx

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\smss.exe	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\smss.exe	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\explorer.exe	explorer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\explorer.exe	explorer.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\76dbc88e-b8d6-5de0-e748-04954efe8eb8	GpuService_9e1e7c.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\smss.exe	GpuService_9e1e7c.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\64a90a0c-308c-0862-0a4c-e478d7730c30	ExitLagCrackV1.4.4.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\WUDFHost.exe	ExitLagCrackV1.4.4.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\64a90a0c-308c-0862-0a4c-e478d7730c30	ExitLagCrackV1.4.4.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\spoolsv.exe	ExitLagCrackV1.4.4.exe
File opened for modification	C:\Program Files (x86)\MSBuild\64a90a0c-308c-0862-0a4c-e478d7730c30	ExitLagCrackV1.4.4.exe
File opened for modification	C:\Program Files (x86)\MSBuild\taskhostw.exe	ExitLagCrackV1.4.4.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SppExtComObj.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExitLagCrackV1.4.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FirstStart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GpuService_9e1e7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5240	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286419340672623"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{7BC7E17D-D98C-499C-960E-1D2500F1C8F6}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5888	chrome.exe
5888	chrome.exe
3316	ExitLagCrackV1.4.4.exe
3316	ExitLagCrackV1.4.4.exe
5980	GpuService_9e1e7c.exe
5980	GpuService_9e1e7c.exe
3316	ExitLagCrackV1.4.4.exe
3316	ExitLagCrackV1.4.4.exe
5980	GpuService_9e1e7c.exe
5980	GpuService_9e1e7c.exe
3316	ExitLagCrackV1.4.4.exe
3316	ExitLagCrackV1.4.4.exe
4064	explorer.exe
4064	explorer.exe
5744	WUDFHost.exe
5744	WUDFHost.exe
5384	SearchApp.exe
5384	SearchApp.exe
3856	spoolsv.exe
3856	spoolsv.exe
4332	SppExtComObj.Exe
4332	SppExtComObj.Exe
4536	taskhostw.exe
4536	taskhostw.exe
5892	StartMenuExperienceHost.exe
5892	StartMenuExperienceHost.exe
5176	OfficeClickToRun.exe
5176	OfficeClickToRun.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
5236	powershell.exe
3136	smss.exe
3136	smss.exe
5236	powershell.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe
3136	smss.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3136	smss.exe
4064	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe
Token: SeShutdownPrivilege	5784	chrome.exe
Token: SeCreatePagefilePrivilege	5784	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe
5784	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 1524	5784	chrome.exe	88
PID 5784 wrote to memory of 5388	5784	chrome.exe	89
PID 5784 wrote to memory of 5388	5784	chrome.exe	89
PID 5784 wrote to memory of 5240	5784	chrome.exe	90
PID 5784 wrote to memory of 380	5784	chrome.exe	91
PID 5784 wrote to memory of 380	5784	chrome.exe	91
PID 5784 wrote to memory of 1428	5784	chrome.exe	93
PID 5784 wrote to memory of 1428	5784	chrome.exe	93
PID 5784 wrote to memory of 5196	5784	chrome.exe	94
PID 5784 wrote to memory of 5196	5784	chrome.exe	94
PID 5784 wrote to memory of 624	5784	chrome.exe	95
PID 5784 wrote to memory of 624	5784	chrome.exe	95
PID 5784 wrote to memory of 3164	5784	chrome.exe	97
PID 5784 wrote to memory of 3164	5784	chrome.exe	97
PID 5784 wrote to memory of 5876	5784	chrome.exe	98
PID 5784 wrote to memory of 2088	5784	chrome.exe	101
PID 5784 wrote to memory of 2088	5784	chrome.exe	101
PID 5784 wrote to memory of 1044	5784	chrome.exe	102
PID 5784 wrote to memory of 1044	5784	chrome.exe	102
PID 5784 wrote to memory of 3124	5784	chrome.exe	103
PID 5784 wrote to memory of 3124	5784	chrome.exe	103
PID 5784 wrote to memory of 5324	5784	chrome.exe	104
PID 5784 wrote to memory of 5324	5784	chrome.exe	104
PID 5784 wrote to memory of 3016	5784	chrome.exe	105
PID 5784 wrote to memory of 4544	5784	chrome.exe	106
PID 5784 wrote to memory of 4544	5784	chrome.exe	106
PID 5784 wrote to memory of 4380	5784	chrome.exe	107
PID 5784 wrote to memory of 4380	5784	chrome.exe	107
PID 5784 wrote to memory of 2564	5784	chrome.exe	109
PID 5784 wrote to memory of 2564	5784	chrome.exe	109
PID 5784 wrote to memory of 4156	5784	chrome.exe	116
PID 5784 wrote to memory of 2724	5784	chrome.exe	117
PID 5784 wrote to memory of 2840	5784	chrome.exe	118
PID 5784 wrote to memory of 2496	5784	chrome.exe	123
PID 5784 wrote to memory of 2496	5784	chrome.exe	123
PID 5784 wrote to memory of 8	5784	chrome.exe	125
PID 5784 wrote to memory of 8	5784	chrome.exe	125
PID 5784 wrote to memory of 5604	5784	chrome.exe	126
PID 5784 wrote to memory of 5604	5784	chrome.exe	126
PID 5784 wrote to memory of 4024	5784	chrome.exe	127
PID 5784 wrote to memory of 4024	5784	chrome.exe	127
PID 5784 wrote to memory of 2268	5784	chrome.exe	128
PID 5784 wrote to memory of 2268	5784	chrome.exe	128
PID 5784 wrote to memory of 5732	5784	chrome.exe	129
PID 5784 wrote to memory of 5732	5784	chrome.exe	129
PID 5784 wrote to memory of 5268	5784	chrome.exe	130
PID 5784 wrote to memory of 5268	5784	chrome.exe	130
PID 5784 wrote to memory of 3356	5784	chrome.exe	131
PID 5784 wrote to memory of 3356	5784	chrome.exe	131
PID 5784 wrote to memory of 5888	5784	chrome.exe	132
PID 5784 wrote to memory of 1456	5784	chrome.exe	133
PID 5784 wrote to memory of 1456	5784	chrome.exe	133
PID 5784 wrote to memory of 3492	5784	chrome.exe	134
PID 5784 wrote to memory of 3492	5784	chrome.exe	134
PID 5784 wrote to memory of 5668	5784	chrome.exe	135
PID 5784 wrote to memory of 5552	5784	chrome.exe	137
PID 5784 wrote to memory of 5552	5784	chrome.exe	137
PID 3316 wrote to memory of 5980	3316	ExitLagCrackV1.4.4.exe	139
PID 5980 wrote to memory of 3136	5980	GpuService_9e1e7c.exe	143
PID 4064 wrote to memory of 1180	4064	explorer.exe	151
PID 3856 wrote to memory of 1060	3856	spoolsv.exe	156
PID 4332 wrote to memory of 4864	4332	SppExtComObj.Exe	158
PID 3316 wrote to memory of 5892	3316	ExitLagCrackV1.4.4.exe	160
PID 5892 wrote to memory of 5764	5892	StartMenuExperienceHost.exe	161

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\EXITLAG_PATCHER_V1.4.4.zip
1⤵
PID:6140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xbc,0x124,0x7ffbd52dc728,0x7ffbd52dc734,0x7ffbd52dc740
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,2434831942759133156,4600395190165923760,262144 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,6938643426814330999,18424950831711667749,524288 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,2570534903910712415,13184524799875891925,524288 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2292 /prefetch:8
  2⤵
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,704506925511940190,3113430042467071868,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3476,i,2536179091828805872,14994662739211594364,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4548,i,5006439917786952395,4789901097913238800,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:2
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4340,i,8538874782428483205,13523837880473736457,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,9763663437103326858,11903188556780159636,524288 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5932,i,5963198918855069888,5537780808301445969,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4860,i,7681517725126670483,6741579790443478866,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3480,i,18276163520157618044,788507950194186546,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3708,i,1018347928320720982,16397434073447333968,524288 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,4754526058656050215,6278342331889246573,524288 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4796,i,1099280500505598210,13068536593863858724,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6224,i,18035803073868639717,17629938003926552658,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6340,i,2259529502153653605,6955034776539163942,524288 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,1001890554506497241,3903845295839241830,524288 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,5733652830820697195,15654700089272882358,524288 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,18117848736669198404,7716349526827457235,524288 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6084,i,13616761068424281567,15577618757198992328,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6912,i,16507482407890684797,772526681090069051,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6228,i,6844443785437003988,18023156883240907307,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6888,i,15369928322742554067,5498764640821709233,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6576,i,8696787890370401757,6611346054933314862,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7096,i,6973399786254915455,17959509252537771371,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6812,i,18443413501284983230,9987454872259104123,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5788,i,1417878015741639378,4071865874968764808,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6984,i,16557906789549177692,4307451525624141894,262144 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7092,i,11173367129958672465,13726735141568124823,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4016,i,11130772272776692747,5940190217744576913,524288 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7308,i,17615771962279703803,17770387935592790542,524288 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=3736,i,7823276063661440099,2774353462127459865,2097152 --field-trial-handle=1972,i,9777979757996548911,18018454478761871183,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:5552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4580

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3236

C:\Users\Admin\Downloads\EXITLAG_PATCHER_V1.4.4\EXITLAG_PATCHER_V1.4.4\ExitLagCrackV1.4.4.exe
"C:\Users\Admin\Downloads\EXITLAG_PATCHER_V1.4.4\EXITLAG_PATCHER_V1.4.4\ExitLagCrackV1.4.4.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
  "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Program Files (x86)\Windows Portable Devices\smss.exe
    "C:\Program Files (x86)\Windows Portable Devices\smss.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3136
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5236
  - - C:\Program Files\Google\Chrome\Application\smss.exe
      "C:\Program Files\Google\Chrome\Application\smss.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\smss.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\smss.exe" -
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3164
- C:\Users\Admin\AppData\Local\PeerDistRepub\StartMenuExperienceHost.exe
  C:\Users\Admin\AppData\Local\PeerDistRepub\StartMenuExperienceHost.exe
  2⤵
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
    "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5764

C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\explorer.exe
C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\explorer.exe
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
  "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1180
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe
  2⤵
  - UAC bypass
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:4480
- - C:\Windows\SysWOW64\ReAgentc.exe
    "C:\Windows\system32\ReAgentc.exe" /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\explorer.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\explorer.exe" -
  2⤵
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3772
- - C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
    "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5340
- C:\Program Files\Google\Chrome\Application\explorer.exe
  "C:\Program Files\Google\Chrome\Application\explorer.exe" -
  2⤵
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5012
- - C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
    "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2684

C:\Program Files (x86)\Windows Multimedia Platform\WUDFHost.exe
"C:\Program Files (x86)\Windows Multimedia Platform\WUDFHost.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5744

C:\Users\Admin\AppData\Local\Comms\SearchApp.exe
C:\Users\Admin\AppData\Local\Comms\SearchApp.exe
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5384

C:\Program Files (x86)\Microsoft.NET\spoolsv.exe
"C:\Program Files (x86)\Microsoft.NET\spoolsv.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
  "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1060

C:\Users\Admin\AppData\Local\Packages\SppExtComObj.Exe
C:\Users\Admin\AppData\Local\Packages\SppExtComObj.Exe
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
  "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4864

C:\Program Files (x86)\MSBuild\taskhostw.exe
"C:\Program Files (x86)\MSBuild\taskhostw.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4536

C:\Users\Admin\AppData\Local\Adobe\OfficeClickToRun.exe
C:\Users\Admin\AppData\Local\Adobe\OfficeClickToRun.exe
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5176
- C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
  "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5596

C:\Users\Admin\AppData\Local\Comms\dwm.exe
C:\Users\Admin\AppData\Local\Comms\dwm.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3540

C:\Program Files (x86)\Windows Portable Devices\smss.exe
"C:\Program Files (x86)\Windows Portable Devices\smss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5728

C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\explorer.exe
C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\explorer.exe
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1408
- C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
  "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5164

C:\Program Files (x86)\Windows Multimedia Platform\WUDFHost.exe
"C:\Program Files (x86)\Windows Multimedia Platform\WUDFHost.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3092

C:\Users\Admin\AppData\Local\Comms\SearchApp.exe
C:\Users\Admin\AppData\Local\Comms\SearchApp.exe
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2808

C:\Users\Admin\AppData\Local\Packages\SppExtComObj.Exe
C:\Users\Admin\AppData\Local\Packages\SppExtComObj.Exe
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4116
- C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
  "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3044

C:\Program Files (x86)\Microsoft.NET\spoolsv.exe
"C:\Program Files (x86)\Microsoft.NET\spoolsv.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1764
- C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
  "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4324

C:\Program Files (x86)\MSBuild\taskhostw.exe
"C:\Program Files (x86)\MSBuild\taskhostw.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2852
- C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
  "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5180

C:\Users\Admin\AppData\Local\PeerDistRepub\StartMenuExperienceHost.exe
C:\Users\Admin\AppData\Local\PeerDistRepub\StartMenuExperienceHost.exe
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3144
- C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
  "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4840

C:\Users\Admin\AppData\Local\Adobe\OfficeClickToRun.exe
C:\Users\Admin\AppData\Local\Adobe\OfficeClickToRun.exe
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1472

C:\Users\Admin\Downloads\EXITLAG_PATCHER_V1.4.4\EXITLAG_PATCHER_V1.4.4\FirstStart.exe
"C:\Users\Admin\Downloads\EXITLAG_PATCHER_V1.4.4\EXITLAG_PATCHER_V1.4.4\FirstStart.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- System Location Discovery: System Language Discovery
PID:1696
- C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
  "C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 890B
SHA256 ac8ce22db635a2b9ae700f33340c179a0df9677ce06d669e056e258ce8fde8ad
MD5 b15c6e04c654a32e84e9a92dd19468a0
SHA1 ba5eb2d9b8510dd00c348e780ab9aac41c26aa3d
SHA512 2a6ba5a87a39c64b415702f5e6f791b91bd8068c181372a2178ae605aab7685068c8678fe2c1479ae802978c95130dcf112bbe2640efa2974b4f49284b8d1421
TLSH
T1C4110D50B2FE63F37880F2AA8695734972AF380D35BC21B50930D648679FC2F7695882
MD5 SHA1 SHA512 TLSH

Submit Download

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 971B
SHA256 a0b3980681724b90a96b34bf0ea8a54715b30a6b440a1d2b1ae18dc357d30a23
MD5 2b1ad319742f2c8e3a270b9c0a3fa0ec
SHA1 540f895907fbe4b8f02348ea7d6cb90b310d636e
SHA512 926bee157929fb8a28dfed44748a68a5312181f3e10e6c4c7b6e9d73d71c0f966e94992a8229fa8b7dcb032a3ea21b74c4b7d5eea138fc75ab656a738de01b84
TLSH
T1B1111D40B1FD23F37880F2AA8694734872AF380D34BC20B50970D648679FC2F7695882
MD5 SHA1 SHA512 TLSH

Submit Download

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 1KB
SHA256 723abb872a2ce31887a0d7868327b1db0bcf524e4fb89eb1683c01fc8ccae1ce
MD5 76c3c2d85bd956de10f28fc3e5a74648
SHA1 221df5d8f3085ec865b4cb62c25b8bb73de8aeb3
SHA512 b2e917ffa6b559667f9be61edaa1295ecded8bbfa552f95e155733d63a201c7dfe910562177834c74c9cdcef9641edf0bca206dcbc5f42dbe77b077786ae51ac
TLSH
T1FA212140B2FE63F37880F2AA86957248726F380D35BC11B50970C648579FC2F7296482
MD5 SHA1 SHA512 TLSH

Submit Download

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 1KB
SHA256 eaa58981712269b727f98fa32eadabe7c5b40f66321486cb8d7ef5932e9a244f
MD5 abd3e009713a103a9b5a16b7ad019ce2
SHA1 6e4158ecadff139e5f5068c11a0fb6872f1ce1ed
SHA512 63c5e8be6500ea885270f652f79749a3f4c3a64714c9a2db0c8533efa624bf6c39f18989e99a730f1f80c7e15ec75fd8c237847e50e3940f3fd260d207f4fe1e
TLSH
T15F312254B2FE67F37880F3AB8A957248726F390C75BC21B50970C648679FC2F7296482
MD5 SHA1 SHA512 TLSH

Submit Download

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 1KB
SHA256 4224b5ab60da25612acf73f27b0e5487e7a052c27e6795a47de9a9f7e065f0b1
MD5 6cc0778818ffbc2f827184842129a891
SHA1 ebd0a6e9ba660b9c94cb4bc79b5eff5818eb3519
SHA512 b2066c14ffc46dd91fd57e203c024db02040d3cbf7bf031cf323222c50cd91000b8b4e6f4a9b132747cbc1712e74b410a930222766c66f1045b21f72104c0c86
TLSH
T1EB411054B2FE67F37880F2AB86957249726F380D35BC11B50970C648679FC2F7696882
MD5 SHA1 SHA512 TLSH

Submit Download

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 2KB
SHA256 a092c0f7cb9f7f2e6423898442bb682691a4993e0139efa6041a5b79daa016a7
MD5 2f6579d5880fb8c7cea355be92986f9c
SHA1 bdd6883dce9df0128ce5233bd910445b3eaf1877
SHA512 42a384a3f612be36293a4ee7677f8c87372a41f6176f3e7473f1c0985ee3554f26bb2e291b5b9f62123202bc7a83e4c64ae798b411d034fb53bd37f01292a8bc
TLSH
T1D3412F44B2FE67F37880F3AB86957249726F380D35BC11B50970C648679FC2F7696882
MD5 SHA1 SHA512 TLSH

Submit Download

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 2KB
SHA256 a9c212724c23cb946c799269607b2a74c5c7e1d639388f63c20c413a8acfd360
MD5 be39d57ce514a63ea9370c421d2e3f8e
SHA1 66679a2cb4b9a0f02314cf1a6e9b7083876b1c28
SHA512 1c3d08c644b41a5e6ad28236b68d8b761d41913439826d51a25a5a88dad52ee5a0545a34ba94a2384625abaa8e16e5d3fde77f06709816afd51ef0df171e4cf2
TLSH
T142512D40B2FE67F37880F3AB8695724972AF380D35BC11B50970C648679FC2F7696882
MD5 SHA1 SHA512 TLSH

Submit Download

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 2KB
SHA256 2ffa2998d207d316458c2c53b2d8a277a2894e7aa82095b432f348dfa58e2fa7
MD5 7f8ca0013274741683fb0cd0be7cec4a
SHA1 00001b6ffcac8cecf2c77db15a40600811da977a
SHA512 a0ad3ba407bf01485541d5edd21ba2811bb9d16d7ac44bbd85a5152ed4a5257f02b5256e30d5fbe1e95055839018e1c9f6a9cfca3fbe8ff229e6e705228305c0
TLSH
T1DD510F54B2FE67F37880F3AB8695724972AF380D35BC11B50970C648679FC2F7696882
MD5 SHA1 SHA512 TLSH

Submit Download

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 2KB
SHA256 826f1b2fc7dac7bc7cee188a2e38ffc9bfdaf02d970d45e32a13288790b29710
MD5 85eb49c57cc444ec955a539f3cbcbd81
SHA1 d10cd44d94f807909c161f58d86cff81a38cf757
SHA512 2f29198f40eb06b750418aa882f225407d1957ec259df89d9bd815815fcffc1118d27c826afdb4f9ce4c2b86ad06de939a7a3a3396c25780c98ca47f8a528899
TLSH
T1CE510D40B2FE67F37880F3AA86947649726F380D34BC10B60970C648679FC2F76968C2
MD5 SHA1 SHA512 TLSH

Submit Download

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 3KB
SHA256 2b9bb34e166d07b64c49b218d6b18936d894715fa34138e81098f2f9db32c9ed
MD5 b91c7668fb0d8d0e5b15de1c0800ae08
SHA1 42a66c96a23b2337c265db693d55ad5b89118548
SHA512 19470a78804db02adf49e55a74537e407f626cc8d58129a013c50071b82a5c8ae54bd9dfe215e6db3352105af89c3f8cf59041009956a4204e68c6b4c369934d
TLSH
T1CD711D54B2FE67F37880F3AB8695724972AF380D35BC11B50970C648679FC2F7696882
MD5 SHA1 SHA512 TLSH

Submit Download

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 3KB
SHA256 c8149f56da8a193dadab19de2121b3ebce5c34826170732563aae9d4354fafec
MD5 0e4f46fe1e154b471533dcfc79bc82c1
SHA1 b4e6ca49ea7bf2f74f3b122c422c9c1bbd98d9fd
SHA512 f5197ac5be292943711e3e2000992689ac21f4c33bdb7c95ca24b9b0e0bbb6c5ebb646e0972a42a979f65960d204b077dd19ba25c66c48c368c2319dc9046e68
TLSH
T121811F54B2FE67F37880F3AB86957249726F380D35BC11B50970C648679FC2F7696882
MD5 SHA1 SHA512 TLSH

Submit Download

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 4KB
SHA256 469ba6160236de2623a41c832e48ecc66781d575f6e200da0a209f0b31cf059a
MD5 1ebdcec44c727e9de4076dcbad6dbc78
SHA1 55dd0d8fa927669125a9c094467ce7b8a290a291
SHA512 a12af2a8177ba9527d9f68b4db6806605aafeae2f07e81f0c87ddecb7568de1b3dec9e7c1c30722c8e07cc7ffa9576cf889af5b66a5ff65ca4590dbf6715bd65
SSDEEP 48:Rs9jk2MXcLsvjk27s9Ns6Ls9NscgcLs9jk2pIs9jk2Xs9Nscx:IkjtkAyH3k4FkqM
TLSH
T14EA11D54B2FE67F37880F3AB8695724972AF380D35BC11B50970C648679FC2F7696882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 5KB
SHA256 6f38af3d1b27527c7ed4a7bfd17ba78f13f16472802652cfde2382b1976caa15
MD5 3133572fdba8a1f59c1d9b8e44c2d8fd
SHA1 1a15b45008586c01e31dbf409ca7be0abe1dc1db
SHA512 4eb609478263e91d13e1a987242b3bc35d436c286136daee33780cc9af3f721e62bd9acad55ec261773dcce736a1623954876c1524179b33eadf0d81d7946ca8
SSDEEP 48:Rs9jk2MXcLsvjk27s9Ns6Ls9NscgcLs9jk2pIs9jk2Xs9NscLs9jk2B:IkjtkAyH3k4Fkq3kw
TLSH
T16DB11F54B2FE67F37880F3AB86957249726F380D35BC11B50970C648679FC2F7696882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_470bf943.log

Path C:\ProgramData\svc_470bf943.log
Size 5KB
SHA256 6c8aa6cc65e1b6233809f63ac4740bb38328e83e1d6f7c81465e8a345f239450
MD5 a0e44174564b00263e1560894438a91a
SHA1 752989074deeadfc3c6255c760ed7fbb0005dd54
SHA512 86ce14166b9540f5645e6e4de0329a347e6b8ec872ae14c47b2c9d159a1aa708859a13889291eb6df02a4bc0634647190b02fc8906d6d1e34854f57ef66a8240
SSDEEP 48:Rs9jk2MXcLsvjk27s9Ns6Ls9NscgcLs9jk2pIs9jk2Xs9NscLs9jk24s:IkjtkAyH3k4Fkq3kTs
TLSH
T19CB10E54B2FE67F37880F3AB86957249726F380D35BC11B50970C648679FC2F7696882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchApp.exe

Path C:\Users\Admin\AppData\Local\Comms\SearchApp.exe
Size 43.1MB
SHA256 b03e9657b6d14754a89b519aa07388ac95e61258c217edad4adf68a5ba2488e1
MD5 d6854ff81eb19f1ef11e925f5fcb57b3
SHA1 ea50e9ff809389106a2640c8882f8ffe060d490d
SHA512 5d29371f5cd2bedf8d2f2db493278d0202ba2fd1c9a55a1e9f26105fe5bb6feb07e43fac523d0cf962ef1dbdcbe42694417b3d953a5b4ff5dc54c8ec7f5854ba
SSDEEP 393216:2xk/94JcO6+MTevLSYhL6rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrM:Ck/94x6hTM
TLSH
T1F0A733999141EA37C87BB1784B46CA5F2E91EB284735E4C2E77780BAF9F165CC801F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2649a6d7c4c1ff7ebbb7e0a66fff66e443d34c9aa693a8021fae6bf20868708c
MD5 bb5b0eafdc702438cb2e5e5d9ecbcbcb
SHA1 fc3e486e5d8e4f6e766493d96df9fd515026c379
SHA512 f7d03d81244c27ced95d2d58725fc3d56efa73dfe263b605af02deb58ceb00a7f7f3f69b168f1dca530aa1c3618f9895f34160a5825ce66fd3c42aa328d2c951
TLSH
T1D4E02BBEDD61DC771CFD071CA2500745F65417473B40858B3A3CC5084F7463A875A85C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 68KB
SHA256 b6ccc3cf539069827a664a0a8033a5ebafb0c350c521c4689d97e43e2e7f895f
MD5 713ea1400a719c6919382f7204a58fc8
SHA1 d2fd8ae1b5c16747c5991c8f851594d5c358cc34
SHA512 7fc10435b2757847be1959ab785a78bc6de0766551375e0863de5d2fb59855bbbca4f0ed4e86eb55b1333d48fe508a8846e7c54a53d727ec5735239064dfde30
SSDEEP 1536:+JEUyJTBWzK2ZuHQ77WPbR1qu7a5V3xYBBIiYDtWzDKhjQl09ht:3Bd0K2Z2Q77ySu7a5V3+yiYD8sjQO9f
TLSH
T1996302C67791CB1DD890B8C067467E00B140AEFE1F762EEE76A01F0992273A5698F49D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 0bfb925468305916f5db57dde7cf8d41443af0da8e999ffe9218cefe8f312a31
MD5 05ac70d8aae67b193cc0ca588e770246
SHA1 5024f97e5e8b3c5f82435f70ba627080a6d9860a
SHA512 4ad573b948540e99ce44791a37ad9b9fa9572e532cc69555e0bd0384ac47545937c0653a0ae3c390f2c9cd20450150f6893b34630e753365312e8d2b5e9c0120
SSDEEP 96:EB9hIvkN0b0I3PSTZDxibg2YeJFVc7eHbDVl4Xa/m98ZYWyEPpQE:EB3FuhfSTVu/YebKqHtGKdZgEPpQE
TLSH
T159A1D742D9D36C2FEF7E263D63D92829B2B906FE15072F825449A1786D8F3A80DBD050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e02108479cbbf13f100cdfc7069ded51250cc81aa47e534155eb50ce6b9864c8
MD5 73a0cda94cc4378b5ae8cff6fdf7f984
SHA1 4d016e715965e63534234ac7bb7076161b073dca
SHA512 747864bcd59ab3f5d57f3be79aa0af329c2af9a423947b5390c6d0480bc4e508e57204677e6a1119c3da4bcc5ebd3b2e8f0076195b332dbfad0922718eb745b2
SSDEEP 96:pz5hISkN+Tb3I3PSTZO1ibq2YeJFVfueHbDVlz/a/R98E1ory3Pv0F:pzr+CYfSTgaRYebDHtEQEv3Pv0F
TLSH
T1B8A1EA42E9D36C1FEF7D267C63E92829B6B506FE16072F435088A0786D8F3A80DBD150
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 784cd89754a7c378c4965eaf3ccb619975bc4cb26cdc94b43110dbf9c66665cb
MD5 112478633a385d40e4b5f01085575bdf
SHA1 8076f41be8cad463ed929e8b43de6774e21b4294
SHA512 9c5947d2015929ba372183887d8ce916cba925a1716c5dd32cc632774c863ad43f24f7ce07c85cb4848148a7ea77694cfc73492c413b717869425d1d37307328
SSDEEP 96:Fz9hIVkN0b3I3PSTZOqibq2YeJFVfueHbDVlzLa/m98EBWyEPv0S+:Fz3nuYfSTgnRYebDHtQdE7EPv07
TLSH
T132A1E942D9D36C2FEF7E263C73D92829B2B506FE16072F825049A1786D8F3A80DBD054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 222KB
SHA256 67f337a8b827d19839ab90b483e880fa44e8b21c8a99e8f1df89c38509986625
MD5 cd769ceadba40fbea7ac49023e55b2b7
SHA1 4d138e8034daac8cdb4a588375eb96c2481f47c4
SHA512 033747ecb042b5826b38a17bc6d747a2279612873ebe28c0dff4a5cc832054ffa99baa384ad654ebcab4970f537b1de7c220ee9f0337f7e2eef3a4ea6291e496
SSDEEP 3072:7UxIFoidA85A79k17IQLM4avI5l5ztTQkQOpxZBweXSSkQI:A8hFjq
TLSH
T175242A5662E573CAD52F83730916CC02D3BA6EC81658709BB9A17D4D26FBB413B3073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000014.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000014.ldb
Size 16KB
SHA256 6deb65d6e1feea18dcc4932276ddf030392cf1b329a4d498d8e0baceabbd14f2
MD5 0d1c51ae8edf90618cc0a1ecfde37fc6
SHA1 025e9b3f787bcb2d27193d2bc8e77e7812214ae8
SHA512 5c3a6a6aa1f96791ff453a1362af99d9a64022d9497e9bbccdf8ffc30126aaa6dc72865e76be9bd95c2d2a1326b74a3ccee28b068a9b4cba4baca11222703fbc
SSDEEP 192:VTtFyZq2w+SooyTwqag3YUNCY4WT1dS4YNnI2PKJCYvJEOPWq23TyoKOLMsDkTpQ:ZOZngQZFfCY4gKE5deTmOKJegIqZg
TLSH
T13572B0772ED98487C0FBA276E5FD03452A12AC073585D0ECE282305C24A65F36A6DF06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000015.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000015.log
Size 1015KB
SHA256 2933a9e44cf84f98d8e18857669220327e0431e40340e3b075a9b684b2b36171
MD5 3ea321be2f2ff7a4022308090e4bbdc5
SHA1 87a2d05e99085420df0742f65fe34b508caf0f89
SHA512 7a4c154e515ea8b4ed50e2d74e4c53e40a00eee1568538d5e11e0a32f11ea9a69bd5a516e2210c1cf195025e1f4cee7ad001a814d5a6bdac6fde12c13269c896
SSDEEP 6144:m11I290bqCFj274WJZfXqKW/Zf6f/LA+NkFkIkkkXkr9qx+:HbhUBNkFkIkkkXkj
TLSH
T15E25D8546167E2D8B53E933B1706CC0BE335E1C8C659B8617AB16E0D36EAB843F4876C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000017.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000017.ldb
Size 11KB
SHA256 35b1777e6e61f9929f633a3323a8fe21693d865f460285f1781894d66438b944
MD5 18554043cf5e1699bff7441ce339f3df
SHA1 a4fa261f41991415969414a43a2e28efc254bf17
SHA512 139e2c067d47b1f0a4cdafdb87416ed93c09a2f391bce0c98b2fd9adf4594d51b915c349c433015fe622bfd198fde5d00410313483112485beff1fac08870372
SSDEEP 192:RTeT+vWOD7nbWT1SS4YNnI2WKNCYv9blWBK3TyoKOLMsDkTpJeaJCgqtG0Pki8k:leT+vvHgxEWRDTmOKJegIqk
TLSH
T1B542B05B39E5D8EFC0B3A236B9F7234D1E127C063145D1ACEAD7100C29F62AB2575B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 349B
SHA256 b1567dc166b051a424001849f345e63e27b1af141a0f742698353c2caa23aa24
MD5 201e685c91edaed47842bd28443457c8
SHA1 a975d3a7af4be49dbe7068fc454310a69a589199
SHA512 2ba5513ec829489c8637a21ccfffc33a57ba6d8eedac6b631e6b0ae77f1f85455e4001b47db3ab65b2cac3241189ca9a59fa08aa4e0b0d2a83772987643ebb86
TLSH
T157E0DF2898D9CAAF21A481AB6531770E9AABE50CA7DDAD460F85D85870CA40C91B93A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 5KB
SHA256 f19aaf98b546eb42c64ebebfdcfe0432b449a50a1e1212da2a10b6a9d4eaec22
MD5 6e257b8a86821997d8765c5d56f0eb24
SHA1 fcb5cc36fc97479f0d79a691dfb5f34d1e581cf0
SHA512 ed23ec179044a18e0015e10a933ec3bea25f14a65335202f465ab6d1f9ca3d34cba7484224b3f5b35cd9b117cb8b772b73e853435406ccd33b174e7f942d39f3
SSDEEP 96:F/JEj/JCeesN24mDItGibvzG3OlcHL4rXy9XCBoC7lkgxJi1wKyayuucgGP:M8BsNNmDiHzG3OM4CXCBtlXi1wsg+
TLSH
T1C3C17BCB459C8DE910C2C163C339B2A9CD5DF0117A2E2F1475CDB2AF23E250BA75A2E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 851B
SHA256 43e4ad4577d3bc121713a74c8d498d67a7f557571e7101f5bf5e983e2933bd34
MD5 10e37467f8cfd0e000da500d9ac9153f
SHA1 24fd4edd7aff8988a97d361421a79d9f1c6183d9
SHA512 769295d45a1bd1c0fc6e7d95b472facdcfd2fd1db60f8a53e4d2296d9fdf8b19bc214fbf7dc0f6b295b388b9bdbbb19ce97c253f9dac8018d125c9f5bdb0a37d
TLSH
T176012821FFD19AC2F8F995F168BFF384773124CE292BC32F502AA15AA1626474D9411F
MD5 SHA1 SHA512 TLSH

Submit Download

5c05dd48-7d56-4fdd-b902-a10389a71da0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5c05dd48-7d56-4fdd-b902-a10389a71da0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 46c04eb5bfcb415a45ebddae6cc9ee08f8d07c73f689ed80284276ee74547bdd
MD5 27f2568f4efcf9cc2f827afc8a83f91f
SHA1 448a4a197bace1bf30e753dec3c2d1e387b9646b
SHA512 d5f6960d99aabdbdde4b0f1333736573f17199d7d3d5e9ed86319a23bf165222bfda50b91e260e767ccb12ddc898cc500194aae92db44ba01d335cf259fc3bea
SSDEEP 192:DLK5WC4ruHeWYvlHJhiY0qjNewpaaHMGcY778I0e3RIfFQ57SVWaXWtrWgGFNSEx:DLK5WC4ruHeWYvlHJhiY0qjNewpaasbv
TLSH
T1973289F3C3E4C22DD81126F4DB64792ADE690E2483283C6AD9E5BF4B53E5471E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 e743b73e42961797194428dc34c76af06fc22b3cfa849a3bc9789bf549108465
MD5 5555b792fbcc595ec03c489e8b304a00
SHA1 88df541ef3dc19e526e73d4042062ea7cab5df7b
SHA512 8d4f4e135bc2baf9293c5394186e8b3a8a6496025d44e1627a93c8146fd4482c1f4143c1a049226f7493575e8ca65aca41c0b331769ad509ef94368820eb26f8
TLSH
T197619CA7E5BEB477203C49AF0E057D0A297A64351391A8F5DBDAD16CB0A0CFB1B02067
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 86883c5e8584b72f0707bcc1a08d5cb837b65fe96b29c4cae93bc2221f066e69
MD5 e97c0704d3777dfde91981587b07c0cd
SHA1 3931c861fac5ed947a7310a1f5107d5756b7137d
SHA512 a8e99633ba1f8901a900c2bcc24822816d6a4370217206ca14fef2ac448983859ee060b2e951017c3435b9dfa4117a86bc68ff25f0602fbdac44a093af1b018b
SSDEEP 192:pRDcBCvCUotqKov7fhM7PRpZu1No6fC1CMIy92Hsb+WNKW3sQxTLh24MlU7T8ETy:pRDmCvt1zhEX1QwfTdURhEQsm2Save
TLSH
T1EC72D86BA8205D7BADE7C229F911B79BE7F5102555E01E80ABFCCB1C25E7ACC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 7a6ab3953f8cbbc6ce333824771ad994690b0429cd9b3ca5bc9624df3b087df2
MD5 330c188603981c164d1ddbb2603e6383
SHA1 1a96e91200bae0aec0f5cc53c1a604777d2832aa
SHA512 6b9d63704a446aae1c67b5b13e3768799d755c593655db80ab610573424dc426a916a9a4a1387fac8640a26248e7d41510001b23dbb58f52b330acd2cc624b8a
SSDEEP 192:pRDcBCLCUotqKov7fhM7PRpZu1No6fC1CMny92Hsb+WNMV6h24MlU7T8Eoksm2aO:pRDmCLt1zhEXUQw6RhERsm2SaCe
TLSH
T1C172D76BA8205D7BADE7C229F9117797E7F5102551E41E80ABFCCB1C25E7ACC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4fca366aaa829c1de72774e429a2f12166d1597114ff429011f9a812e5a91009
MD5 76dca5337398922a50c69192dd0bc133
SHA1 dd0abbef65e5f14f3b79b9997171cf5d77d069f1
SHA512 1969ff5ac40cd846d2556b5ea88a70de1b3cbc724bf938235b9ea65187c17cf2f23269303e41075ada42b3d30896eacc8b1c559c6ade0ccf722f58086ddafc30
SSDEEP 192:hNR/LCUotfKiv7fhM7PRpZqwNvy92Hsb+WNn9TJ4mYsksm2aHa4BVyIsnAUgraJ:bR/LURzhEXuQw5HYFsm2SaCe
TLSH
T14162E72BA8106D7B6DE7D22AF9217797E7F5102521E41E84EBFCCA1C15E76CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e93adc000ee0cd453b3e8962fd4b7f93be69c5b92e2cb9b00b9294ed5090224f
MD5 a54da5bbb6b932558b65c04b60e343f7
SHA1 ed1a5cd26c415a46fbeff146c5bb24625db06cf3
SHA512 d0060db24d7afe9f6c3b3f583086786008ebd797d4019f2eb8a8069f14864b070b3f17106eb204e15b4828aacd182937d8432295a5e4074e741a7bd02829624f
SSDEEP 192:PR/L/RQTtfkfv71hpAPRp2tivt92Hsb+WNn0qi2U23ksm2aHa4xVyIsnAUgtaJ:PR/L5QhkBhUX7QwB820sm2Sa08
TLSH
T1E352D62FA920697B6CD7D22AFA217797D7F5102521E42E84EBFCCA1C14D75CC212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bb29f2e2206bb1e1692f0a97dc333f4331ca32313b8e75ca4ec95839145880b6
MD5 0d341f040b60937d91d5feaad1deaa32
SHA1 c48fbabfc0f76b462dfbf2caa6e06ea1866d21b2
SHA512 ad75a39fd32ef74466ca72b295fbba244d318663b579311ac6de9d7a79303cba1bb6a8df6fc16ee818439aea323f8b6e6d174c207b2be068b3c1117e3fa780de
SSDEEP 192:hNR/L/RQTtfcv7fhMAPRp2tivt92Hsb+WNn9TJ2U2mksm2aHa4xVyIsnAUgtaJ:bR/L5QhIzhtX7Qw5H2vsm2Sa08
TLSH
T1D652D62FA920697B6CD7D22AFA217797E7F5002521E41E84EBFCCA1C14E79CC212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 91a97d310397c3b623dc90f19be37a3c0e404fb6385901c43b0951b966c4d641
MD5 b46e496a6fb7b431eac2531147b2f9fa
SHA1 49b0ad282083f393a6347ac50b4425d3410f3f1e
SHA512 b54c7f2d18d52b95686f56d0d0aaa568104b5ef908b87b9fbbe0ca0972b56ff6b03f6bc404be78e803b4d75ad8a2d16679d54bc9f2eeffd670c0434029b0ee8c
SSDEEP 192:pR/LCUotfKov7fhM7PRpZqwC1vy92Hsb+WNnh2i7T8EFksm2aHa4BVyIsnAUgraJ:pR/LU1zhEXZQwgnE6sm2SaCe
TLSH
T11A62C72BA8106D7B6DE7D229F9217797E7F5102525E41E84EBFCCA1C25E76CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 84ba03ff67f6fe4bf02f0fc60c2905fe1c45b3baa2eec91e6d6d86c11558a621
MD5 f6f360529936b258b932862b736dc33c
SHA1 367b46d359aabeab6905494ca7ddb1bde1b72e5e
SHA512 46b3aadb2189778468982e7a6459851aa3b2110a9e3f4450e8e226d56183086550de03da11aca39f24891e9b88098f26a64e60b255c14981d456ee320f3cf624
SSDEEP 192:pRDcBzLCUot9Kov7fhM7PRpZq6fC1CO5y92Hsb+WNksh24MlU7T8Eoksm2aHa4BM:pRDmzLO1zhEX5Qw2RhERsm2SaCe
TLSH
T1AC62E82BA8205D7B6DE7D229F9217797E7F5102515E41E84EBFCCA1C25E7ACC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 a894979d9049d53e0f770f8f1b3886ee056bab5bb8a51b60d1b2058e10d2a7c0
MD5 fc6c99e9eb9e283baf56e24c9f7c3c5f
SHA1 4d9a1dcd5853db9ad5f0ffd8e7a92e6334b4853c
SHA512 9c7ac439f7dbe9e97dae93ad56c6652b43df337b7f8c0a50f221fa734999aeb07c5483d8a0b64567b3cd393f6410d4d1a468d01a77a26c4576dfe55e71a8aa58
SSDEEP 192:pRDcBCvCUotqIov7fhM7PRpZu1No6fC1CMIy92Hsb+WN9X6h24MlU7T8Eoksm2aO:pRDmCvtDzhEX1QwVRhERsm2SaCe
TLSH
T16B72D76BA8205D7BADE7C229F9217797E7F5102551E41E80ABFCCB1C25E7ACC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 12f328ac966b249f3f3ca0e537e9d7bbcc96bacb651361954df8688c6de0de4f
MD5 e59548fe22d3fa5cb09ea4540a9de003
SHA1 7ac6a2181685abc19470f190659d0cc5d6c89bc8
SHA512 94c8a59974695189e01e4b15fef2c1a8f054ff287a19617b49072fc985c6fe954e9e794b1dd6ba6494366419b23deaee50de40fa865ede1bf92acae77b284595
SSDEEP 192:hNR/LCUotfNv7fhMAPRp2qwKvH92Hsb+WNn9TJ2U2Rksm2aHa4tVyIsnAUgraJ:bR/LUtzhtXnQw5H2Gsm2SaMe
TLSH
T17E52D62BA8106D7B6DD7D22AF9217797E7F5102521E41E84EBFCCA1C25E76CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3831b5f5-725c-4cfe-bc34-4f723a26de2c\index-dir\the-real-index
Size 2KB
SHA256 93622c857609229942e301183158d506db42f300de3b85017550f3b9404ac930
MD5 ed57421dae14132410be5f92843a0cd4
SHA1 5c1670b3f90ded37c163f9749a7e3ed516c728ca
SHA512 2a5b714ff74327eb6031ddc66b9393fb028cdd7c1e035ca1358f7f6b0536203027befade78a64a5b8d43ed8845694c59ad7f9c097595db59ac0b2b8aa478da0c
TLSH
T10451958CDD8063EDDCF151BA1C5410B597B01D24FC98C3D29094F1A638436682B0B6FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3831b5f5-725c-4cfe-bc34-4f723a26de2c\index-dir\the-real-index
Size 2KB
SHA256 79e33338c2d25ac8dce53f5233ac1da2049de17bd832b7c63cdea6862cdfe301
MD5 297fd07d52f99828b8eaf0b22b006496
SHA1 8f9f0f2402c4e9b1d181e324f7b8df82f4941277
SHA512 d7bd50d7d3f2ead77ea116b7acfa3856723ca7939970ee6b3727ac7f97a4df0524ccc3c58437694d46325a0281087c0434dd66ef74be1f292a02d3c491390f99
TLSH
T14151A68CDD8063EDDCB551BB28402171A7B01C34FC98C7D290D4F1A238539692B47AFC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3831b5f5-725c-4cfe-bc34-4f723a26de2c\index-dir\the-real-index
Size 2KB
SHA256 8d5ec2dc582d1f269e5b9a581bbb4b7e4395734ae6f8b6ef7f9b0d8d5839242f
MD5 4a9f8e6bd3f1d5082cf7ae48df358476
SHA1 d47b20cf6d2e64227cddf539123559b814f18b01
SHA512 79771f982880a551d3761c6c2b1c8af481f75b4d2bc62c31a919e86fa042c3bcb35960b23ceea723b41f4b6067057cb8a91b7585f68444eb0c3a417d7c4ad541
TLSH
T19341868CCD8063DDDCB151BB2D5811B59BF01C28FC48C39254A4F1A67403A682B476FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5875a8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3831b5f5-725c-4cfe-bc34-4f723a26de2c\index-dir\the-real-index~RFe5875a8.TMP
Size 48B
SHA256 9d8f7fa2ec5b954bb9bb75c106feb5200cb0f5987cac9a25372f6ca1c0c82463
MD5 a735d13451c31541cb9b6010dfda3d29
SHA1 91e1a55a8e94714f34f415df9292a09eb4f25395
SHA512 ca23c8cd2b35e36b8cfe2d9274f9189c1c8cfa2a031eb390a7d1ad8b5d37b138114e47cc8e0bf9400fb645def75bd438914ddd8ab550fac9e81a2ff78a78691a
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\7276bccd-58b7-437c-b306-3991eb45c9b4\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 276B
SHA256 27ec715f6498fd2395d7f54a73e3fdf41298312eb934b898fa9eaa7d52b30c8d
MD5 482120e4f92d7fb956858ae6d9170831
SHA1 98eee610f38de7ee56df7888e650ee106f01c61a
SHA512 5b9dc8c8c75ef7a185023b7ca21d0b8ce211a99c153f44716d1f8803ffd5ed72c9362eb2dd2fac5aa8cf891b9e10b8fb5147a3bc871f9b1eb7c24c9fcbe6cf3c
TLSH
T109D02B8BA630741FD9BBDFD5B839669E672665984C44DCA060CC181E2539E02A412D27
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 608a29a2f29738df44a5ad5ccb6e84a2770cbd550e64304b58e772ce8f1b4242
MD5 2ecfe9aef2f5a09e9e038cb776bab5d6
SHA1 b57b9e8ea90d595061b7a6b76237b5d5dfe8696d
SHA512 c992a6660c2fbb2fca683a43f74d10e16eb6a078572e99d9e5bca79a17959f8ea419e0453c81b70003dd1c55a39a1c65e3755d153aefa46a9ca769cc0e7a14ec
TLSH
T186D023C7437159475678FFC8107945DC5317BD19CC91C8E8950874172475913C402A36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 283B
SHA256 5017762c6cc11d4e3a888e81d2bc6cbadbdbf2cc376bc71ceead5847a41e4093
MD5 234dd2ddaaa50786b8afb97f6c80370f
SHA1 3458e8d37fba98104c2ff7c34ad072425b21c231
SHA512 1328cb187974a42191b19a053343b92632d6edbbaf0c1d87ac99e19845df1617aebb68b7d7f5f6cf17b1bfe9b114165e9fea8f585948fa1e0424145801ce73d6
TLSH
T1DBD0C28B6630344ACA77DBC5B829259A6766A9584844D8A0688C341E2679E06A411D27
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 276B
SHA256 d2f84fd146d48ef7af64ada1518ca02505aa1bad65b01cb2df13b5563ffc73fd
MD5 a0f41cde55200302bed29e550654bcb1
SHA1 dc6cb95cddeae5451d772a44d090ed726ded317d
SHA512 8a5f5099ce15fc20c3b5890f7bcbf6a23a9257aa9fc2500590cd500de5e49fb566f2c785ad86e9bc4084622efaf32ac0bf0459161576459f51eedff31411d8ea
TLSH
T16FD02B8B6630741BD97BDFC5B83965AE6726A5985C58DCA060CC181E2529E02A412E27
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 e3197bdeea74d6690f1c1ca3bd8eaffeb6876c484d7ea354dce78fc07afeb351
MD5 1137120fd8ae9e36a592488a1f03e3b2
SHA1 063857375b45e71b5bb4eeda9ec3706432e6c5e1
SHA512 c7f261048ca8265d3c28a706598c5ea8aaa16867f93f04d269cc2ceebc46d18a8e790776d9db8f0c03c46d6117659911394ed1c72b7bea9ac60b710a81fc8d5e
TLSH
T108C04CD3066095478574ABD81078969DA71B955CCC94C8E4910854072025D529412926
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 85acbde7c8efac2eed3dc4bbe44fffb047b10677e76177943d7092c42da96b13
MD5 c8d41427f306622fd954ecb6586fae86
SHA1 37f33d55712a6b42276cb536b2e7397ea28a9e1a
SHA512 2ad0e8297b70c7400336a7bdd6b62c242cc840c1a42d74730104aacd1b25285943f32ab0c5b7817f0367346b5fa2735d843aa2284191aeb454c035c914f722f8
TLSH
T16BD023F7073169475370AFC8207456DC73256C0DCC94DCD8490874972278D03C031636
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 0ae6505380279b0fc37c708fda3249bf8c29ec2f1b30a3059a2b4aa26cd53805
MD5 ec0a8cbadea7b717cc52461325d39646
SHA1 72f4d113f64487310448240b8cd3d59ac01e628f
SHA512 0b9bbc75edbc03b02772af08dca8fcf6c9e5fc4582261203acf19ad7f1929364f054f1555c1da5c93a0686977429e24ced5c7830d27293ba0186cb3b7897233c
TLSH
T107C09BD3076095878674FBDC3078AB9DB71B955DCCD4CCE4950C54072279D539411937
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 360B
SHA256 13f7037683b8f19f8ea42a128580af8d4ca223b9e96a852670ac815df74a0534
MD5 10262c9222041168813eef495e6388a3
SHA1 72695b597a959bf67f32407563bfed67b7ab2b35
SHA512 3a7140802a68029de3c64e263a5a597cab09da138177198289d7682971a452a2af62fa5a40ed4c298860d61f6b8a40e210ebde788db88e827cff2968adecad4d
TLSH
T17FE0C08A5330740EE67BDBC1A83951A967627C545C48D8E49588341E2178F02E023E2B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe582e7d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe582e7d.TMP
Size 137B
SHA256 67aae12e559244c9741225e22bca9f5530af0ffe6dde228db3111bb51473e519
MD5 cbb28a9c0549f5165a0e6279d8990ce7
SHA1 e54fdafa953c606c94fdd2e78f1b2c0c9da5ce30
SHA512 5cc958dca422a5cbebdce675db871f9a473ea6d47fc1b89a5b91be9239bcae03e07b2f05613c22d6a43062acc4c25d6ec587bd93f95344306e533eb5db289f8d
TLSH
T102C04CD7166055478675AAD41078969DA72A9D5DCC80C8E4910974172035D539511926
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 d227d3dc482421b90ca503cad539475c9df70c25caafaf3775d11108ac512e0c
MD5 04b8a5f3a2aab531adf78916206f5b37
SHA1 51cc2681da1c2b9c7d14dd385d86b07cc5b8b732
SHA512 9dbe52a5ee66b83982f3e67ba063d46569983d0f9f7ed5b3af0e7a5b5cc328cd1435f210165506b84783e73fecc60f711de32ef9196777aa1a2a8fd8d44e1834
TLSH
T166C02203C80082A0C22382FA28AA008C3208AE00CA0C220AEAEC2A028C32022802A3A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 192B
SHA256 23b46aa79f6a67ebcd37378b4a558043878c140b8d343b9ad40650c09f6ce532
MD5 b4b7024abaab2348066bc3098c3fc0d0
SHA1 ab355d36f3db8cbdd426f1a3b45154c754dbb0b8
SHA512 50a0111c9757db00ffefaed68b2dd5dc70abc8fe175fcefe45c1d8d22636983e14ba2d6e5855939cd168513cffe75fef3c5db546814b92502a9644a5967b423f
TLSH
T18EC02B4A804043D2C82343FD154310CCB224DF12C50D130086DC76169C28133C11D1A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 919ac3f902299bc1797ddd4be477159ad7df0438340fed76ac04379f0cdf93c6
MD5 6f646b5cfca04db3cef48ccee80e450e
SHA1 46ce9f7548d4761cf097d3dfd1d4d87b2075b29b
SHA512 b5f2ef55a1aef2c2222a699c08a86d181c20a098d8e71c5528f7d2c3f75cc5c4aead7acd51c9288b16d6c31c0e7f115118df0a268fa97692dd26cb15063053b3
TLSH
T1A5C012BCC0029251C51702F42453A4CCB268EF35B64B770443E87B56BC74110902D19B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 22ed67b78adc3486789a765915dc28b7f93d168251f5f1242c1f6b6fe52aa56f
MD5 218795bdb016a927b662dbddad233e27
SHA1 b354ea83d3b557759fbc7bb117cbed1ee146a9aa
SHA512 aa4faf929f8f3d5ab7aa806c3492f17e6c85db95ca8d623736b3134117ed482b5c8edc89f261af0b169090eb36f5569005b101ef9effff7333727cbcf147b45d
TLSH
T1EDC01204D0415205C05602F41A6224CC7158AF959A0E330442F459BBFC39175803A252
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cb2b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cb2b.TMP
Size 96B
SHA256 20209b2f1ea36aacf3baef98855dd94e6695b95e8979821227d7c5ec41569aea
MD5 91ba4235e0543aec9e35497b6a3c89ce
SHA1 78b1f556f2552bb70412050666c70308aa5b4bc9
SHA512 1eee265b4486a5c4aee9c67792598e4a9448dbe1f70b01d720c8e878f6fc34ea0430c27fc3b1e9b866aa7acab26db6113c1b4af34c4cb51f6382fc7731a19168
TLSH
T1AFB02200C003B222C00203B0288083E830A0EF20CA230202C2E00ABBEC30B2028300A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 9271d13b09e51f50aa8ec666460801aa544c75b7a207a3981833d71d6d098fc8
MD5 09a6bec3724d65b50c56c9c77c17622d
SHA1 aff7b3b3979e6e5e12de8eb58a86f6b40b179d81
SHA512 111c5443ca5fff08ab94c033462a5a8c8f48bc9fce165e62904fa5ab359e2b8226e2da084c92428e7be74569acc676ca818eeaa0b7a75380308db6314668f00a
TLSH
T197B0026A05485833D62847B8F3E506F133310C219BE2936648E55054B567E97A352701
MD5 SHA1 SHA512 TLSH

Submit Download

16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5784_2019848429\Icons Monochrome\16.png
Size 257B
SHA256 d52376c8b210b8003f5aed9f4555a7916b4640d4c42a36cc81d9864991c87a8b
MD5 6cc922565abd761f4039c816d86018c4
SHA1 05393c91529467f8ddec22a121fe482701365d6f
SHA512 8732f24ea85ab3fa845b3cfa2a354a85cab63a507947fb61bd8119c623e31c87d6f0735ce7f06119db597ec4fce4ad44c15046859b574cb11fb1306e489cf995
TLSH
T1ADD095F2E311DD34C52E96900533C473F433171B1DD56055664491DA4D9E90533C8D59
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 0e1f9009535f57e5b858e11427231f209c83289b028b9e0cb9fdcf4661542de5
MD5 e281b5d596abdaf9c0b5da4d409872fd
SHA1 dc833508f165c4f62659c4b2033f31168569a146
SHA512 bd341168aca661533a35016f3e3a8812d6431828bf8f53ccf8a1c393ceb1d1b10fae38068c50622836ce2a1aa3614ad2c016733edec80ad456995b6cbea09360
SSDEEP 6144:BdzyxYqw6rvSKEpMGbKm7Rkm1tYpBeh2BAo2:PzyxDwxpM4F9oBGcAo2
TLSH
T15F341333AD615D7359B81B2EA04E2A1A1DF2AF69DD34985688CC6F4C26ED7D84F01C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f3e1f82c93d431c21606257dfb721238b7409edcef508664d6eaa268be9dabe5
MD5 ae4c45c0f779d6ee593a449185659d9e
SHA1 d6b348f4175edaf1af699f2ceca9423075131302
SHA512 a4bb108d7526dca2ee6d3889e715e79e29d44c4a00e2558dc8e8fee523e384ee3786670d9b3bd0bc5c297113713031c0f71ed5f08b68ab8bef0f343ad6e9713c
SSDEEP 3072:CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:1m7Rkm1tYpBeh2BAo3
TLSH
T1D0C312275E71E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 3d99c9f77fcaf14e92167a3060ad155299ffc2d118de692ed1985540a5c4d4d9
MD5 abd9644c7a52fd7ef87c1787a1f77aa3
SHA1 2d2d6655138357e4dbdf59a010d706df09d96856
SHA512 d5f36ceb6ca009577883537985483a8cd2040d3b6a2c20075fac3f382326460f4791ba95d3ae8f49f31fd2663fd55dd713446c5d97b581f569ee2693f04d41a8
SSDEEP 6144:4KzyxYqw6rvSKEpMGbKm7Rkm1tYpBeh2BAo2:DzyxDwxpM4F9oBGcAo2
TLSH
T14A341333AD615D735DB81B2EA04E2A1A0DF2AF69DD34985688DC6F4C26ED7D84F01C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 c2cee94be505c85ce80bcda36c1415437316abd7bec933225f5ff67a3f598a7e
MD5 09abd84941205b7abb13556e08985b10
SHA1 afdb26379e04f4e2af604a92dd6b51d946946425
SHA512 1872ae08ba4613dc83df89c2986dbe12775757c06ec1c9f211fdea404287aa73b0f728438868a25feefa526d5edbf3e36fbbc9149ec8fd3f75c8e979a8dea6c0
SSDEEP 6144:3zyxYqw6rvSKEpMGbKm7Rkm1tYpBeh2BAo2:3zyxDwxpM4F9oBGcAo2
TLSH
T199342323AEB09D735978172EA04E1A5E0DF2AEB5ED34985289CC5F4C27E97D84F01C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 51552e747cc417f0645bb998467953774053ed1fc1cb30f259a6612b5dae8f73
MD5 64d8e1f906e5a1c1f6959c7185bdf2a8
SHA1 7c8c09deb6831e9d0499c3d99936c1e853a1776e
SHA512 735bf59cba0363a0d53a059f1fd7ecc2f6fdf00660ef062a35fa66a8e212154aff035dc22875184cc4a63aa22db5b183c572b1906bde72261448f09dade1e8c5
SSDEEP 6144:WzyxYqw6rvSKEpMGbKm7Rkm1tYpBeh2BAo2:WzyxDwxpM4F9oBGcAo2
TLSH
T14A342323AEB09D735978172EA04E1A5E1DF2AEB5EC34985289DC5F4C27E97D84F01C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 b22f3818cd9716d5e49ea23273abe7aa17bb99e51fde59497b68c19b88bf10d4
MD5 abc1cbed2b38882902572a0a0f3fbf37
SHA1 92ee4c7f1587dcf97ab394ef6a68966527e5f5b8
SHA512 84d345e393ef1ff91a15fe63a4197ce52a8dcbe4f128f81eb097c5dc8591642d8b01de92d23fa0de7e73fe956020c054a364f0d133a7a5afb895eea8b168fa40
SSDEEP 6144:tKzyxYqw6rvSKEpMGbKm7Rkm1tYpBeh2BAo2:AzyxDwxpM4F9oBGcAo2
TLSH
T143341333AD615D735DB81B2EA04E2A1A0DF2AF69DD34985688CC6F4C26ED7D84F01C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 75d43cc98b3e9248c3ef474aa380005b02e0bbb094754526074c75b682bf5b05
MD5 681a869f1eb1d32470d1bcfa39ff035f
SHA1 ebc898291248fbc5e137c9c93759c9556d441a65
SHA512 6eed006be90804dea7d81f7ac7e796211e63594d8e02ce6afacabe429ab41e8115e084ecc752642e446da8063fb8fb8fa79400b88d0b1ab9f7d646b2512610a5
SSDEEP 6144:gKzyxYqw6rvSKEpMGbKm7Rkm1tYpBeh2BAo2:7zyxDwxpM4F9oBGcAo2
TLSH
T184341333AD615D735DB81B2EA04E2A5A0DF2AF69DD34985688CC6F4C26ED7D84F01C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 87aadf995cde234d1fce2d2de19906a9218007d2eb30f4ed8d5b6ef7587527f7
MD5 9dcb06227cb7790c2d6025d632abc94f
SHA1 cdda69aafcb3ca07ee6d46acf7074e63b6b51e8b
SHA512 7a2f5b47444a219a0daa6707a4c9d6a4f1c059ba88767cc6fb5a6e6d90d3a7055b67c2e80743637648cde5f73c496c9895a71a3bf5b4b06360b3667cd393440b
SSDEEP 3072:rGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:ym7Rkm1tYpBeh2BAo+
TLSH
T176C3122B5DB5AC375DB5BB1EB08E0B1F1DF14AA6C920DE52C8D45B0833EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 be245ea8003c5b2e556a174e88af8f303bc19f369a5bc4b98c4d82fed1a54ac1
MD5 1a7cb2df6a6f2a1ae5bd04579c00097c
SHA1 728aa58eca7710904ae89853338b0f7fb09d6e7c
SHA512 447090917c0dfc7349423609b3d6292746cf19a5ed3e437c0b76aa2cd33f1171bb6bada3fabf6ec1cb2954adbca63e2d9f09c18cdab3220eadeaa113575ede5a
SSDEEP 3:MsEllllkEthXllkl2zEL0bQ+lt:/M/xT02zf0e
TLSH
T1B8440205AFE00409CA001536402383502364D55445225787356164225C855410C11400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3799378038

Path C:\Users\Admin\AppData\Local\Temp\3799378038
Size 138KB
SHA256 475437015c984e8b771f1aea56be03c86cc46c80ab62dafb83e6bfc4f7762f72
MD5 8991be60344d68bf3bd9ad8a6b66509f
SHA1 8a1dbab0b8e48c918255d3ade08722794e541190
SHA512 7d5cbb6b3dc7c76ed9eebd9bc3de970ae52f05cdc2398d04ec5b1384bb086d0123fa3fdc2de13b0bde6b1d2d0380185ae3b3c1d8f63072701b4a539acee8c8f4
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2wj96dlcq+UVumLvnw9g:jeuvBnhJsueMEGvIW1DcP24KJVumjmg
TLSH
T139D3884B3A747002EDE59A722CE051BB5D3CB16D4F55A5D428B620588EF2923B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GpuService_9e1e7c.exe

Path C:\Users\Admin\AppData\Local\Temp\GpuService_9e1e7c.exe
Size 3.4MB
SHA256 145e75c7e55b58a5167488fa514544a66a7f864474fa8f8b016de0aa29457ca3
MD5 72daa0486d3abd5bd00ea0703fe3fb3b
SHA1 02da7e65fb420bf3a61caa7fa529acf4a2fd246c
SHA512 e3de2eac8c66a1cdc57d91531f88ab6cd1ddb4d36696d7c03538b64014988d6c7fe7222da6cc31e66194fc0a7f85d4d1ce7810808c04b86cf18a5d4123851bc1
SSDEEP 98304:xCO1H8VGGFPikRSdXrE/v6b7Ot73cThfiSEY4BefdC:kO0GGBfR4bOy7O53If5Ejx
TLSH
T198F533B75EDEC251F17CC9B79E932460A6B73A0C02C05B1FE051B6E891AB6DBC38845D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gpdfj3ym.lhe.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gpdfj3ym.lhe.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/384-2040-0x00000000000F0000-0x0000000000D46000-memory.dmp

Download

memory/384-2037-0x00000000000F0000-0x0000000000D46000-memory.dmp

Download

memory/1060-1835-0x00000000007A0000-0x00000000013F6000-memory.dmp

Download

memory/1060-1832-0x00000000007A0000-0x00000000013F6000-memory.dmp

Download

memory/1180-1765-0x00000000006E0000-0x0000000001336000-memory.dmp

Download

memory/1180-1738-0x00000000006E0000-0x0000000001336000-memory.dmp

Download

memory/1640-2089-0x0000000000650000-0x00000000012A6000-memory.dmp

Download

memory/1640-2074-0x0000000000650000-0x00000000012A6000-memory.dmp

Download

memory/3136-1988-0x00000000009B0000-0x0000000001606000-memory.dmp

Download

memory/3136-1672-0x00000000009B0000-0x0000000001606000-memory.dmp

Download

memory/3136-1698-0x00000000009B0000-0x0000000001606000-memory.dmp

Download

memory/3136-1854-0x00000000009B0000-0x0000000001606000-memory.dmp

Download

memory/3136-1924-0x00000000009B0000-0x0000000001606000-memory.dmp

Download

memory/3316-1904-0x0000000000760000-0x0000000000F82000-memory.dmp

Download

memory/3316-1655-0x0000000003800000-0x000000000445F000-memory.dmp

Download

memory/3316-1898-0x0000000003800000-0x000000000445F000-memory.dmp

Download

memory/3316-1645-0x0000000003800000-0x000000000445F000-memory.dmp

Download

memory/3316-1657-0x0000000000760000-0x0000000000F82000-memory.dmp

Download

memory/3316-1652-0x0000000003800000-0x000000000445F000-memory.dmp

Download

memory/3316-1665-0x0000000003800000-0x000000000445F000-memory.dmp

Download

memory/3316-1656-0x0000000003800000-0x000000000445F000-memory.dmp

Download

memory/3316-1654-0x0000000003800000-0x000000000445F000-memory.dmp

Download

memory/3316-1653-0x0000000003800000-0x000000000445F000-memory.dmp

Download

memory/3856-1991-0x0000000000420000-0x0000000000C42000-memory.dmp

Download

memory/3856-1926-0x0000000000420000-0x0000000000C42000-memory.dmp

Download

memory/4064-1809-0x0000000003910000-0x000000000456F000-memory.dmp

Download

memory/4064-1797-0x0000000003910000-0x000000000456F000-memory.dmp

Download

memory/4064-1807-0x0000000003910000-0x000000000456F000-memory.dmp

Download

memory/4064-1833-0x00000000000E0000-0x0000000000902000-memory.dmp

Download

memory/4064-1808-0x0000000003910000-0x000000000456F000-memory.dmp

Download

memory/4064-1810-0x0000000003910000-0x000000000456F000-memory.dmp

Download

memory/4064-1965-0x0000000003910000-0x000000000456F000-memory.dmp

Download

memory/4332-1927-0x0000000000B40000-0x0000000001362000-memory.dmp

Download

memory/4332-1990-0x0000000003EC0000-0x0000000004B1F000-memory.dmp

Download

memory/4332-1995-0x0000000000B40000-0x0000000001362000-memory.dmp

Download

memory/4332-1981-0x0000000003EC0000-0x0000000004B1F000-memory.dmp

Download

memory/4332-1992-0x0000000003EC0000-0x0000000004B1F000-memory.dmp

Download

memory/4480-2158-0x00000000708C0000-0x000000007090C000-memory.dmp

Download

memory/4480-2159-0x00000000710C0000-0x0000000071414000-memory.dmp

Download

memory/4536-1886-0x0000000003ED0000-0x0000000004B2F000-memory.dmp

Download

memory/4536-1888-0x0000000003ED0000-0x0000000004B2F000-memory.dmp

Download

memory/4536-1887-0x0000000003ED0000-0x0000000004B2F000-memory.dmp

Download

memory/4536-1879-0x0000000003ED0000-0x0000000004B2F000-memory.dmp

Download

memory/4536-1889-0x0000000003ED0000-0x0000000004B2F000-memory.dmp

Download

memory/4536-1891-0x0000000003ED0000-0x0000000004B2F000-memory.dmp

Download

memory/4536-1890-0x0000000003ED0000-0x0000000004B2F000-memory.dmp

Download

memory/4536-1894-0x0000000000B20000-0x0000000001342000-memory.dmp

Download

memory/4864-1855-0x00000000002E0000-0x0000000000F36000-memory.dmp

Download

memory/4864-1869-0x00000000002E0000-0x0000000000F36000-memory.dmp

Download

memory/5236-2103-0x0000000006F70000-0x0000000006F8A000-memory.dmp

Download

memory/5236-2106-0x00000000708C0000-0x000000007090C000-memory.dmp

Download

memory/5236-2125-0x00000000082C0000-0x0000000008864000-memory.dmp

Download

memory/5236-2124-0x0000000007560000-0x0000000007582000-memory.dmp

Download

memory/5236-2123-0x0000000007530000-0x0000000007538000-memory.dmp

Download

memory/5236-2122-0x0000000007560000-0x000000000757A000-memory.dmp

Download

memory/5236-2121-0x0000000007500000-0x0000000007514000-memory.dmp

Download

memory/5236-2120-0x00000000074F0000-0x00000000074FE000-memory.dmp

Download

memory/5236-2119-0x00000000074C0000-0x00000000074D1000-memory.dmp

Download

memory/5236-2118-0x0000000007C70000-0x0000000007D06000-memory.dmp

Download

memory/5236-2117-0x0000000007490000-0x000000000749A000-memory.dmp

Download

memory/5236-2116-0x0000000007390000-0x0000000007433000-memory.dmp

Download

memory/5236-2115-0x0000000007370000-0x000000000738E000-memory.dmp

Download

memory/5236-2105-0x0000000007330000-0x0000000007362000-memory.dmp

Download

memory/5236-2107-0x00000000710C0000-0x0000000071414000-memory.dmp

Download

memory/5236-2102-0x00000000075F0000-0x0000000007C6A000-memory.dmp

Download

memory/5236-2100-0x0000000006EF0000-0x0000000006F66000-memory.dmp

Download

memory/5236-2097-0x00000000062B0000-0x00000000062F4000-memory.dmp

Download

memory/5236-2091-0x0000000005E60000-0x0000000005EAC000-memory.dmp

Download

memory/5236-2090-0x0000000005DC0000-0x0000000005DDE000-memory.dmp

Download

memory/5236-2078-0x0000000004D60000-0x0000000004DC6000-memory.dmp

Download

memory/5236-2088-0x0000000005790000-0x0000000005AE4000-memory.dmp

Download

memory/5236-2079-0x0000000004F40000-0x0000000004FA6000-memory.dmp

Download

memory/5236-2077-0x0000000004CC0000-0x0000000004CE2000-memory.dmp

Download

memory/5236-2075-0x0000000004800000-0x0000000004836000-memory.dmp

Download

memory/5236-2076-0x0000000004FE0000-0x0000000005608000-memory.dmp

Download

memory/5384-1779-0x0000000003BD0000-0x000000000482F000-memory.dmp

Download

memory/5384-1805-0x0000000000C50000-0x0000000001472000-memory.dmp

Download

memory/5384-1758-0x0000000003BD0000-0x000000000482F000-memory.dmp

Download

memory/5384-1780-0x0000000003BD0000-0x000000000482F000-memory.dmp

Download

memory/5384-1775-0x0000000003BD0000-0x000000000482F000-memory.dmp

Download

memory/5384-1777-0x0000000003BD0000-0x000000000482F000-memory.dmp

Download

memory/5384-1778-0x0000000003BD0000-0x000000000482F000-memory.dmp

Download

memory/5384-1776-0x0000000003BD0000-0x000000000482F000-memory.dmp

Download

memory/5744-1767-0x0000000004270000-0x0000000004ECF000-memory.dmp

Download

memory/5744-1770-0x0000000004270000-0x0000000004ECF000-memory.dmp

Download

memory/5744-1731-0x0000000004270000-0x0000000004ECF000-memory.dmp

Download

memory/5744-1771-0x0000000004270000-0x0000000004ECF000-memory.dmp

Download

memory/5744-1768-0x0000000004270000-0x0000000004ECF000-memory.dmp

Download

memory/5744-1769-0x0000000004270000-0x0000000004ECF000-memory.dmp

Download

memory/5744-1774-0x0000000000DA0000-0x00000000015C2000-memory.dmp

Download

memory/5744-1766-0x0000000004270000-0x0000000004ECF000-memory.dmp

Download

memory/5764-1923-0x0000000000A60000-0x00000000016B6000-memory.dmp

Download

memory/5764-1922-0x0000000000A60000-0x00000000016B6000-memory.dmp

Download

memory/5892-2001-0x00000000039E0000-0x000000000463F000-memory.dmp

Download

memory/5892-2000-0x00000000039E0000-0x000000000463F000-memory.dmp

Download

memory/5892-1928-0x0000000000540000-0x0000000000D62000-memory.dmp

Download

memory/5892-1948-0x00000000039E0000-0x000000000463F000-memory.dmp

Download

memory/5892-1999-0x00000000039E0000-0x000000000463F000-memory.dmp

Download

memory/5892-1997-0x00000000039E0000-0x000000000463F000-memory.dmp

Download

memory/5892-1996-0x0000000000540000-0x0000000000D62000-memory.dmp

Download

memory/5980-1661-0x0000000000660000-0x00000000012B6000-memory.dmp

Download

memory/5980-1659-0x0000000000660000-0x00000000012B6000-memory.dmp

Download

memory/5980-1671-0x0000000000660000-0x00000000012B6000-memory.dmp

Download

memory/5980-1658-0x0000000000660000-0x00000000012B6000-memory.dmp

Download

memory/5980-1632-0x0000000000660000-0x00000000012B6000-memory.dmp

Download