hijackloader | 3769996f8267fb2ee2a1819ed2cdf1746257283e2dcfb28f71dd9f8b4d994b55

Analysis

max time kernel
299s
max time network
297s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/07/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
𝗦𝗘𝗧𝗨𝗣.exe
Size 576KB
Sample260717-nrtbdady4z
SHA256 3769996f8267fb2ee2a1819ed2cdf1746257283e2dcfb28f71dd9f8b4d994b55
MD5 c78fcfeeba6e2ae52f28efd2e054ae89
SHA1 894b2932d7e3cde0a42d2249063c5e058a8b9b38
SHA512 883e8e7cb17596544d7e80415cb9c06484c116d1de71add047084356208ff4529a691b23dbaeacdd770f104ae9a325cff3bbe2b532055749ab8f7aff4ca2e596
SSDEEP 6144:qQ/wOnH9FzvPHuifBbUvqBPfGXO0XnUsFTb90nKg2Gedar:qIJ9FbHuOuXXNT55T1dar
TLSH
T10EC419203715853ACA7252B298A86FBF302DEF144BE44DC7A3D87A2DFA715D35A31607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\WSL
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral3/files/0x001100000002bac0-49.dat	family_hijackloader

Suspicious use of NtCreateProcessExOtherParentProcess 26 IoCs

description	pid	Process	procid_target
PID 2404 created 3920	2404	WEmulator.exe	88
PID 2404 created 392	2404	WEmulator.exe	89
PID 2404 created 1584	2404	WEmulator.exe	90
PID 2404 created 4528	2404	WEmulator.exe	91
PID 2404 created 1976	2404	WEmulator.exe	93
PID 2404 created 4300	2404	WEmulator.exe	94
PID 2404 created 1664	2404	WEmulator.exe	95
PID 2404 created 2164	2404	WEmulator.exe	97
PID 2404 created 2852	2404	WEmulator.exe	98
PID 2404 created 3920	2404	WEmulator.exe	88
PID 2404 created 3920	2404	WEmulator.exe	88
PID 2404 created 1584	2404	WEmulator.exe	90
PID 2404 created 1584	2404	WEmulator.exe	90
PID 2404 created 4788	2404	WEmulator.exe	104
PID 2404 created 1660	2404	WEmulator.exe	105
PID 2404 created 2952	2404	WEmulator.exe	106
PID 2404 created 948	2404	WEmulator.exe	107
PID 2404 created 4496	2404	WEmulator.exe	108
PID 2404 created 5160	2404	WEmulator.exe	110
PID 2404 created 5312	2404	WEmulator.exe	113
PID 2404 created 5320	2404	WEmulator.exe	114
PID 2404 created 5328	2404	WEmulator.exe	115
PID 2404 created 4788	2404	WEmulator.exe	104
PID 2404 created 4788	2404	WEmulator.exe	104
PID 2404 created 2952	2404	WEmulator.exe	106
PID 2404 created 2952	2404	WEmulator.exe	106

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2404	WEmulator.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 3944 set thread context of 2404	3944	𝗦𝗘𝗧𝗨𝗣.exe	81
PID 4392 set thread context of 4000	4392	Tech_C.exe	82
PID 3944 set thread context of 1720	3944	𝗦𝗘𝗧𝗨𝗣.exe	83
PID 4392 set thread context of 4936	4392	Tech_C.exe	84
PID 4000 set thread context of 3920	4000	ParallelEn.exe	88
PID 4000 set thread context of 2500	4000	ParallelEn.exe	102
PID 4000 set thread context of 3920	4000	ParallelEn.exe	88
PID 4000 set thread context of 2188	4000	ParallelEn.exe	127

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	ParallelEn.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	ParallelEn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	ParallelEn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\ThirdPartyNotices.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	ParallelEn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	ParallelEn.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\databasehost_32_rc.job	Crisp.exe

Executes dropped EXE 1 IoCs

pid	Process
4392	Tech_C.exe

Loads dropped DLL 9 IoCs

pid	Process
4392	Tech_C.exe
4392	Tech_C.exe
4392	Tech_C.exe
4392	Tech_C.exe
4392	Tech_C.exe
2404	WEmulator.exe
4000	ParallelEn.exe
1720	Crisp.exe
4936	Crisp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tech_C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ParallelEn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	𝗦𝗘𝗧𝗨𝗣.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1584	chrome.exe
2952	msedge.exe
5532	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WEmulator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WEmulator.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287632414321299"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4000	ParallelEn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3944	𝗦𝗘𝗧𝗨𝗣.exe
3944	𝗦𝗘𝗧𝗨𝗣.exe
3944	𝗦𝗘𝗧𝗨𝗣.exe
3944	𝗦𝗘𝗧𝗨𝗣.exe
4392	Tech_C.exe
4392	Tech_C.exe
4392	Tech_C.exe
4392	Tech_C.exe
2404	WEmulator.exe
2404	WEmulator.exe
2404	WEmulator.exe
2404	WEmulator.exe
2404	WEmulator.exe
2404	WEmulator.exe
1720	Crisp.exe
1720	Crisp.exe
1720	Crisp.exe
1720	Crisp.exe
1720	Crisp.exe
1720	Crisp.exe
1720	Crisp.exe
1720	Crisp.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4936	Crisp.exe
4936	Crisp.exe
4936	Crisp.exe
4936	Crisp.exe
4936	Crisp.exe
4936	Crisp.exe
4936	Crisp.exe
4936	Crisp.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
3920	chrome.exe
3920	chrome.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
4000	ParallelEn.exe
2404	WEmulator.exe
2404	WEmulator.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4000	ParallelEn.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3944	𝗦𝗘𝗧𝗨𝗣.exe
4392	Tech_C.exe
3944	𝗦𝗘𝗧𝗨𝗣.exe
4392	Tech_C.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4000	ParallelEn.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeDebugPrivilege	2404	WEmulator.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeDebugPrivilege	4000	ParallelEn.exe
Token: SeDebugPrivilege	4000	ParallelEn.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 4392	3944	𝗦𝗘𝗧𝗨𝗣.exe	80
PID 3944 wrote to memory of 2404	3944	𝗦𝗘𝗧𝗨𝗣.exe	81
PID 4392 wrote to memory of 4000	4392	Tech_C.exe	82
PID 3944 wrote to memory of 2404	3944	𝗦𝗘𝗧𝗨𝗣.exe	81
PID 4392 wrote to memory of 4000	4392	Tech_C.exe	82
PID 3944 wrote to memory of 1720	3944	𝗦𝗘𝗧𝗨𝗣.exe	83
PID 4392 wrote to memory of 4936	4392	Tech_C.exe	84
PID 3944 wrote to memory of 1720	3944	𝗦𝗘𝗧𝗨𝗣.exe	83
PID 4392 wrote to memory of 4936	4392	Tech_C.exe	84
PID 3920 wrote to memory of 392	3920	chrome.exe	89
PID 3920 wrote to memory of 1584	3920	chrome.exe	90
PID 3920 wrote to memory of 4528	3920	chrome.exe	91
PID 3920 wrote to memory of 4528	3920	chrome.exe	91
PID 3920 wrote to memory of 4300	3920	chrome.exe	94
PID 3920 wrote to memory of 1664	3920	chrome.exe	95
PID 3920 wrote to memory of 4300	3920	chrome.exe	94
PID 3920 wrote to memory of 1664	3920	chrome.exe	95
PID 3920 wrote to memory of 1976	3920	chrome.exe	93
PID 3920 wrote to memory of 1976	3920	chrome.exe	93
PID 3920 wrote to memory of 2164	3920	chrome.exe	97
PID 3920 wrote to memory of 2164	3920	chrome.exe	97
PID 3920 wrote to memory of 2852	3920	chrome.exe	98
PID 3920 wrote to memory of 2852	3920	chrome.exe	98
PID 3920 wrote to memory of 4680	3920	chrome.exe	99
PID 4000 wrote to memory of 3920	4000	ParallelEn.exe	88
PID 4000 wrote to memory of 3920	4000	ParallelEn.exe	88
PID 4000 wrote to memory of 3920	4000	ParallelEn.exe	88
PID 4000 wrote to memory of 3920	4000	ParallelEn.exe	88
PID 4000 wrote to memory of 3920	4000	ParallelEn.exe	88
PID 4000 wrote to memory of 2500	4000	ParallelEn.exe	102
PID 4000 wrote to memory of 2500	4000	ParallelEn.exe	102
PID 4000 wrote to memory of 2500	4000	ParallelEn.exe	102
PID 4000 wrote to memory of 2500	4000	ParallelEn.exe	102
PID 4000 wrote to memory of 2500	4000	ParallelEn.exe	102
PID 4000 wrote to memory of 2500	4000	ParallelEn.exe	102
PID 2404 wrote to memory of 4788	2404	WEmulator.exe	104
PID 4788 wrote to memory of 1660	4788	msedge.exe	105
PID 4788 wrote to memory of 2952	4788	msedge.exe	106
PID 4788 wrote to memory of 948	4788	msedge.exe	107
PID 4788 wrote to memory of 948	4788	msedge.exe	107
PID 4788 wrote to memory of 4496	4788	msedge.exe	108
PID 4788 wrote to memory of 948	4788	msedge.exe	107
PID 4788 wrote to memory of 4496	4788	msedge.exe	108
PID 4788 wrote to memory of 5152	4788	msedge.exe	109
PID 4788 wrote to memory of 5152	4788	msedge.exe	109
PID 4788 wrote to memory of 5152	4788	msedge.exe	109
PID 4788 wrote to memory of 5160	4788	msedge.exe	110
PID 4788 wrote to memory of 5160	4788	msedge.exe	110
PID 4788 wrote to memory of 5160	4788	msedge.exe	110
PID 4788 wrote to memory of 5304	4788	msedge.exe	112
PID 4788 wrote to memory of 5304	4788	msedge.exe	112
PID 4788 wrote to memory of 5304	4788	msedge.exe	112
PID 4788 wrote to memory of 5320	4788	msedge.exe	114
PID 4788 wrote to memory of 5320	4788	msedge.exe	114
PID 4788 wrote to memory of 5320	4788	msedge.exe	114
PID 4788 wrote to memory of 5328	4788	msedge.exe	115
PID 4788 wrote to memory of 5328	4788	msedge.exe	115
PID 4788 wrote to memory of 5328	4788	msedge.exe	115
PID 4788 wrote to memory of 5312	4788	msedge.exe	113
PID 4788 wrote to memory of 5312	4788	msedge.exe	113
PID 4788 wrote to memory of 5312	4788	msedge.exe	113
PID 4788 wrote to memory of 5716	4788	msedge.exe	116
PID 4788 wrote to memory of 5716	4788	msedge.exe	116
PID 4788 wrote to memory of 5840	4788	msedge.exe	117

C:\Users\Admin\AppData\Local\Temp\𝗦𝗘𝗧𝗨𝗣.exe
"C:\Users\Admin\AppData\Local\Temp\𝗦𝗘𝗧𝗨𝗣.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Roaming\web_store_shell_v5\PDAUTAITGWFCNLQTKN\Tech_C.exe
  C:\Users\Admin\AppData\Roaming\web_store_shell_v5\PDAUTAITGWFCNLQTKN\Tech_C.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Users\Admin\AppData\Local\ParallelEn.exe
    C:\Users\Admin\AppData\Local\ParallelEn.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2500
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2188
- - C:\Users\Admin\AppData\Roaming\WSL\Crisp.exe
    C:\Users\Admin\AppData\Roaming\WSL\Crisp.exe
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4936
- C:\Users\Admin\AppData\Local\Temp\WEmulator.exe
  C:\Users\Admin\AppData\Local\Temp\WEmulator.exe
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ffba264c188,0x7ffba264c194,0x7ffba264c1a0
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1704,i,1123254048043364842,3051303199121713557,524288 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:11
      4⤵
      System Time Discovery
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1548,i,17108612558065066265,10501706706933382669,262144 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,12767540716454959650,16714176426333377060,524288 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,7229084721669759976,243930910617253080,2097152 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,17204946323870224943,6944840697486161583,2097152 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3976,i,3397048014915386296,18385529672403252513,2097152 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3988,i,346510724624656265,2445656901743283707,2097152 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:9
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4000,i,7547876557525279096,12901726595809034321,2097152 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4012,i,4702260742200868483,11485409622137519857,2097152 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:9
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,12726784182756416402,7380905567769918210,524288 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,13274889273843756223,15677002749932631016,524288 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,13942280682201182234,15217401817720734816,524288 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,987544645218012981,16633520855373452233,524288 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,9370613397657064261,11044686441542805265,524288 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,11698273691892115724,7727214310321613408,524288 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,11698273691892115724,7727214310321613408,524288 --field-trial-handle=2428,i,17818782656273207884,5200005854160087051,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:5744
- C:\Users\Admin\AppData\Roaming\web_store_shell_v5\Crisp.exe
  C:\Users\Admin\AppData\Roaming\web_store_shell_v5\Crisp.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1720

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba72dc728,0x7ffba72dc734,0x7ffba72dc740
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2000,i,4815791542592567705,18401326841166781821,524288 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,11732217506776804225,9294647202647955164,262144 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,6466493984015097789,8223844663541741648,524288 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2728 /prefetch:13
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,17304986191383779940,13585807710440451232,2097152 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,1441427749915556410,6409345359487423624,2097152 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,11450730940642145659,18311313270554104751,2097152 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,11609944720658211541,11767995412076261736,2097152 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,15554958765146340207,15811808469413150801,524288 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,11386552836577471564,13941450099786383947,524288 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,12870193042645452886,7071676699712675503,524288 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,16008898037163294235,1352618317305961323,524288 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,489091901893506705,6467036732051299302,524288 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3856 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5744,i,2457728711663511909,5877925431031652771,262144 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:10
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,5364263054973901682,18253692190230541660,524288 --field-trial-handle=2068,i,17203441737451099252,17845423218358473457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4500 /prefetch:14
  2⤵
  PID:5492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0b8083fd517b84b3ddbf1ddb852d552fae4b0f27f8665f9677a74ff476e4d7b4
MD5 b1aae06f22b7f83eea8bd49d3508161c
SHA1 af771ce55cbfe3e79f26084a6dcd6cdf9d671336
SHA512 977620650f1ac6b379a8f9329410e239238c3bb0dd96f47bbabac8b13462ebdc3e9b486e0d906dc8af782acbc602d64e54d5d637227e4f2607dce07558884077
TLSH
T13CE0E5E9C812AC3B18F907586160464AE79013AB2A418A4F3B3C92188F7573A458A86C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 8KB
SHA256 7d43af33fbc8657fa5e31458416b37f7a167bfe4ee60d14a41428528e901c5d5
MD5 5985bcb0811dbf03648eec463ee7544b
SHA1 2dd00e553269543c75276c72cccb4d9579b5a2c0
SHA512 d98f0dffbea67554954bee83ded01e1d254cb7c0419548b4b7766bf86f37206d3a5dd835a7e8a93e8f15fde9472d5c29792695502c0e3d61abec0c7a7bc8d193
SSDEEP 3:OlH/lLFkGJ4k6rtLFkG9VtE21XajTQKlQ//bZvtKqK1caa+:K4g4k6sUOQUTQ/DRW
TLSH
T1E6028C6F880C2928C0F2E53E8B0345942B620E1007480E1AE25B8475000071015F1F88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 be20580e56c5c05e03b2e112a94b7305baf842f81bdb53962f37ae9d3742abbf
MD5 2899a70ee04f5bb2854d926f96e12cc6
SHA1 1a0b1664eb80e7de5a4387f2f367a286d8704d22
SHA512 9b302c2426c5202ee2799f7055c0f7be25ebb3900895f11385ef12e68334128dd89d5c4540b2d90880223bab6e64fc3b0f4b21686a7fab49c2ebd50b200eefff
TLSH
T1BFE0868F24E9D66E91A884638279630ECBD23A4AB6CC3F07578D94D03293A046690251
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 1KB
SHA256 730f054e2e958b3c8629c9720bd46aa0f32fed5e4c742baffb479bbaeeedb24c
MD5 b9269e3c9539a0e127c5dbdb34af93bc
SHA1 51473cb42e232ad4bc833186b552cd44df8d3220
SHA512 a34a647da406c6c0e12a8c01a5f42114d01bfe0600aaf67255cc4986556fabcf687b4c3bce14db55ff44940c1dd913cb286f244faccc4e50a9ca515896716a83
TLSH
T12831FEA92BC13797EA3958B2BC06A3435FB7D1D801C5CC8253F879911E81F620F270AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 305B
SHA256 68fc0f2a87dbe59c5696280fdbe55c229856f945f97c58e0befdbc9bef722fc9
MD5 ca3c777b752750615b951b128f2683f7
SHA1 da33b9de289173d9e3b0bae1fa85c9c9f25c242e
SHA512 d126105a37a6e2f682f054c199a926ed8d695d728ed4c2fe0e9eea2cf49c148c5585cad785be3cf7e03d20b64356237c0c86f2bfb62c86ba67cc235f5a683c72
TLSH
T118E0CD5735F9E7EE15848127037CA34EC6E77408D6DD1F4A5F405454528AF04A7E0292
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3c7304f0553add06e019b7336580c6eb5122ba92bd3d67c6d1f95100f659eaa4
MD5 7bae992e6b86c720c8e339955323a14a
SHA1 749adb8f81edfbab85870cb842da86600b50ef24
SHA512 25ec7bebd9f59a2370c8062ef7a0a9db998bb322bcd3669e78e39bb4e602f39e305ef8db92f12d995b780dc517eb73ece4b9e92dd0482d99c206b62154289ae5
TLSH
T161418CF783E4857D990196F4EB156F2FCE691A24432C3C66C9E4AE1B53E2872D20078F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 23dd6bac1e5752bc59ab36426d1cd95c7efa4902afc4089758f81192a54b5a85
MD5 29bed275a2fd344fdba970a538f6669c
SHA1 0eaed746f33393a4cebe663802c62b1b6a391e96
SHA512 b2db2a85b0b38c9acc1b0d1cdbf18afe6579523f63fc887c3a3020203ead8f1be2a86d63fa5999db87120518be6eee3f5bef5e0f5adfb23c321f492a6921fb3f
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoOX:OIEumQv8m1ccnvS62G
TLSH
T1D3F2E1FF07197501C0E49674D6810ECFFD2D051D4B9BBEC09AAC09F3AB865A39538259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cc63e8e53f4c2de748f2d64e228eb384e7dc75d9b84eceeeac2d9b143e76bd2d
MD5 45e6b82154d68c77a3bd96c3805c862f
SHA1 231ec8396781cad128a098c6aabef0e6523e3a40
SHA512 140af77091d8e4819e888ee92c72cfd010a3a9a49bf82d7da5101505fa43224d7332cdb7ceb28dc36f66f3d7d70251a5740e4fd6bfb10b2655af6948661d41c8
SSDEEP 384:iROqXZuv2bVF7xy1CyoTZUXKrwd0T2ZDqa68:VCZuv2bVF7xy1Cyo1jrwuT2fh
TLSH
T15642D62EAA14783B6CDBC219FD657753EBF9206521D41D84EAFC8A2C04E79CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 40d7c60a1c72c78336f19d4ee700a8b0115d5b5b172638f4685bdbd404368f19
MD5 9a859a7e9672ed4ad771f14c1b2bf16e
SHA1 ab6ab04c2d4be806e115013a22ca2610390cd6e6
SHA512 9185a5b3a17015557ff2e0b897b93f94970704b838901d3709447e6c4c909577b6f10f02f2038c00e4ab84a1d86ac5927cb1899e8d006216a7b6ac8aeb53679d
SSDEEP 384:iROqXZuv2bVF7xy1CyoTZUXKrwd062ZDqaoe:VCZuv2bVF7xy1Cyo1jrwu62fx
TLSH
T15C42D62AA9147C3B6CDBD219F9617753E7F5206521D41E84EAFC8A1C15E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
MD5 c23047ed70b8fe98404f2d539506eb71
SHA1 777411f14fab3beefe67a6f475f14f7e6e56c013
SHA512 0a47725dfc0cd3a51a0c13fc01329dccf73a0e6fe775075f027ab629f4c8fde68db8b61d4cd2ce4269a02632bafb0dcbc043ec6377186b9c4b1d39ea91b3d0ec
SSDEEP 384:8mjoj7KxkXqKf/pUZNCgVLH2HfgslTg97pLuLcSjuvXODof+ErU3i4JHGtovIld:8Goj7KxkXqKf/pUZNCgVLH2HfgsZg97V
TLSH
T1C77208676C4C9E370F94CACCD8167B4F9DB5014B65EE886483FA982903D5BDB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 67bd61d51e6a360653bea45c0740b9211574877c142a6cd651989aa63d1182e8
MD5 bd7f37a2e391f100b657fbec817de1f5
SHA1 4935eb9caa5a00de24133da96e5e754f0230fe6f
SHA512 4af2086044db2997f54693146853dbbef47d3e0a3667639ecb82a111b4cb48998ca60904ae43296eed795a71c850a1616c72a677e2378fa6d8d68f304b36dba3
TLSH
T1E5B0124080015142C50207F42186248873549F10960A1706A3F07A338C25264C114470
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a08c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a08c.TMP
Size 96B
SHA256 00bc61bc7115d4d9d211f622e5f5de872814260aaf5a6b10eef6dca625013a95
MD5 3b5e0ae735241de1446c0260b490ae67
SHA1 9cd00d306f6fb924de7f7ef1cf8c1c6c43f13608
SHA512 6a4e5cf0e1c999145524ebec2d90aba8e191c0a6c28149fc0c034b00c066927512564696b5a1382968d5d304e9033de9df694b6efcc5a7d7d779ab7125db9f07
TLSH
T1FCB00266C10A7612C4C617F1299DD5D872F1DF35C603221A9BE01AE7EC656A05925560
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 bdf4a4ac14975693a13a583bf2202bbb825c1282d0c15a4f5c34392dd8e035e5
MD5 5eb431dea3f0af60336a181373e8b7ec
SHA1 08f554a6dd799a041752a2f8e2088a75b9e084be
SHA512 b8a9d2ebb866ea7f7f4467254f60db695c671002844b8c677774734c187a68cd86cb533cbae2a24713aafe5c397b6cdff3ade13ac36569d526af4d0eab711de5
SSDEEP 6144:9NZ4YNceHqYhV4QQspKICmFRn+ToZxm7Rkm1tYpBeh2BAoh:9NZ4Y649hV3K4RnQoZY9oBGcAoh
TLSH
T1C034123FBE35BA73996AF30C789B5F1E3EF14DA29560CE8540E55F0C52ADA8C1509530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 aac7d2c08a5078b3ac343da3c299dfa0dae064d46b6c47715d94f594ab851046
MD5 6e88b7bae6fefcc8283444c15e72c151
SHA1 59520b4ae0dadd1711df16ef329b2aa9662f2fe7
SHA512 2f351e9e0c09775517f6b30a6ef55e548c17f3a8c2845f21e5a08b174bbf6f9b17fb253e4ee012339b9857c4479f112893a9a49a4935f6df904b70ef49e37ff0
SSDEEP 6144:+Z4YNceHqYhV4QQspKICmFRn+ToZxm7Rkm1tYpBeh2BAoh:+Z4Y649hV3K4RnQoZY9oBGcAoh
TLSH
T10434123FBE35EEB3993AB30C79975F1E2EF15DA39960CE8844E45F0852AD9CC1909520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 602a5beabf4364bb3423652cfa55a8383b99ab43962c1644bfc0a5da9241e701
MD5 b04bc4fc33f863a4f2b73b422bcba01d
SHA1 d1df22487629e3da3dcc099d8139ccefca93768d
SHA512 485124463df28c51b393d7817842d6d657f25ec960fccd57477838fd99890d014b70ccb528f5e92281c94c05ed853c1db0abc21a805a51f7c8916da72707efea
SSDEEP 3072:7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:im7Rkm1tYpBeh2BAoi
TLSH
T187C312375E70E9365979AB0EB48E0B1F2EF14DA6C930DE92C8D85A0437E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 6bea8c99512aac8b91d68546c3a3b54fbf5e121022ceacbc54f37ea8148d07d2
MD5 e58822fb8fef1ef53fcefb576fe3d9d4
SHA1 1a0cba6480150770e52a9e847f29ab9264b5dfeb
SHA512 8bdfbac222e8c2c95611050c8eeb49cbe54a82f4de712a8545e907598cd451e76ab8c48d5750cca62e69fb0ac24c37d5e9a9e1e26f8ee6c11be708f5ed0237e8
SSDEEP 6144:uZ4YNceHqYhV4QQspKICmFRn+ToZxm7Rkm1tYpBeh2BAoh:uZ4Y649hV3K4RnQoZY9oBGcAoh
TLSH
T13734123FBE35EEB3993AB30C79975F1E2EF15DA39960CE8844E45F0852AD9CC1909520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 a6b32d09ef6bb8851544b8a2dd6fd176a337b66b6e08eeef4a6df524fafaaba0
MD5 3fe7e400bc60f9313a4a9e8b50712bec
SHA1 de8d95378fcab7f42acee59ff01d4dc978ac1a1b
SHA512 98c62d829ba768cfee1bbf8ea99a4d26b6cc8b2c8c22d7214ed907a80ff7296a415f95d43764d6382559d91f1618fb4b965e5b478c07c67f9711d9aed15691b0
SSDEEP 6144:aNZ4YNceHqYhV4QQspKICmFRn+ToZxm7Rkm1tYpBeh2BAoh:aNZ4Y649hV3K4RnQoZY9oBGcAoh
TLSH
T1A234123FBE35BA73996AF30C789B5F1E3EF14DA29560CE8540E55F0852ADA8C1509530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 564c4bdfad833c34bf0b5b08a0bcd0aca4d70eb0d5c629eb65c55d0ea0114e46
MD5 8a597dfb431ee07b6e419d48e4da7b33
SHA1 d2204e009c619fe6615bcf8ba820954f4f4699fc
SHA512 a63f786cfc052bd98c02e3ab9f23e4b21ccec834f7be0a46d36e7ccba9774a840735e18d7befd93e0ac29e7633a8e0b6d8772e47989c116cb1dafcaa7e14639c
SSDEEP 192:6GN7q6i5fQmiUy4dIO7X5zPr2oOANZ+jkajGIDU6:6GN7q62h7GO7X532oOm+jJrDU6
TLSH
T10B02C835B9686C779EE3AE55B58737235FE4103BD9986F80DAE81B1C0087B8C130A837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 93d969ac08a907c032d8f4d41c90902393051af3e3981726f5d2513ee6e53904
MD5 ea03d7950d3d4cbd0510c927d67566db
SHA1 c7bc3463f17c7f7b8bf50e134e67561d8c49356d
SHA512 bf9b5273baad398ea266c88e9b508160899fdf1e3fb08107fb8d7592ecf2450a13697801ef3f94a33918cf7dcf1bd5f8538671204b53ee8eb75974881307d3a3
SSDEEP 192:EGNW6i52QmiUy9I87X5zPr2oOANZ+jWVe+S+2aGQcqhyU6:EGNW62S787X532oOm+jWVJS+20byU6
TLSH
T10C12E871B468AC279EE3AE95F48736539FE5213BD9886FC0D5E81F1C0087B4C130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ParallelEn.exe

Path C:\Users\Admin\AppData\Local\ParallelEn.exe
Size 2.6MB
SHA256 54ee56421a67088a76359c6fab0ff64a5d105666b8e226b0fe2b8759bfbdde10
MD5 74585993ad66f985febcc9bfe0cf699d
SHA1 bf6739a1d3ca31d3c84ff37b78ec26473881c66c
SHA512 5f8ee722948e08f69ca7c4080df8da1aa40c30a2a03834883a4f2dea0bb9092499007acf81cfed543cbf3dcd6ad935cb1df93bf80a6a100eb55494700ce365af
SSDEEP 49152:9/Qp+T+WQLh5tA5pD5mgQUQFqNNHUhhyHiz55Q/FT/pgMXm:9/Qp+TEN5o5QUm2Uqiz5qpM
TLSH
T16AD51832DAF3813BF5B200F6A6E9562A7D159B209704D3C3A184AB585BF0DD36B76307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

037965b6

Path C:\Users\Admin\AppData\Local\Temp\4680ce72\037965b6
Size 224KB
SHA256 9081c80e48d6086db9fb097aa85fa97e89c25321b1c77f8b5c10a9583c971d03
MD5 c306d4e70c1627eaceb86379d8d5c47a
SHA1 202e7f9fb094df23789ff03ea5cfde549a08919a
SHA512 c06aed3b37f7316f2b118e6b64bb16032f54be6097fba5d978e261fa2f1918c815fc53407e2129b4be2a233eb5b9a203394d42e8e3508d3f42e96b2cf1bdb059
SSDEEP 192:Fvo3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1DC24530A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

078c3ac9

Path C:\Users\Admin\AppData\Local\Temp\4680ce72\078c3ac9
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e1561dc

Path C:\Users\Admin\AppData\Local\Temp\4680ce72\0e1561dc
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62cf2c95

Path C:\Users\Admin\AppData\Local\Temp\4680ce72\62cf2c95
Size 224KB
SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
MD5 4e19802d3c83e4dcd771f44517162143
SHA1 2323b0978ecbcf19633a4e710e70a07534558024
SHA512 9d5b3bfb0f9afdcaeb972abacc44c183954c3200c3afeadc2691cb5a78662bc5d9a7cb6fbc9b7cfdc8e86e05c91eabf88f7619775160d7477522a1fd40c918b0
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v:61zkVmvQhyn+Zoz67
TLSH
T16524D086AC04F52ACF4B3430E6834DF37E51520443486A76CABC0E7F1DB520E9B988E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bc113b0

Path C:\Users\Admin\AppData\Local\Temp\4680ce72\8bc113b0
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8dd7c4b0

Path C:\Users\Admin\AppData\Local\Temp\4680ce72\8dd7c4b0
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab342b04

Path C:\Users\Admin\AppData\Local\Temp\4680ce72\ab342b04
Size 20KB
SHA256 5cf0a0732c42dc77d026b311761df9efa6a11688f988d5d4e624ba5ad8d00ef1
MD5 ccd2a9a072e1acc42feaa30883793258
SHA1 8aa6339dfd1b30238ddbe251905d499629c1e7f2
SHA512 311f0d7aab4f7d5091da79c4e0322f71832925a0f546e85af8969bf2fc5b9180ee44b8848e05b3cf06e389d30f3931fbe4a050b97248cbd51242cf1c45e104fe
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBNd50baWGrjX6gXkXj:TeW9aw/aHLopFMavU1iBNHYaD90T
TLSH
T17792478E1F303210C0F48736E9C6495F2FBD112D9327A5D9ED0054F2CD8229BF5060A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2535163

Path C:\Users\Admin\AppData\Local\Temp\4680ce72\f2535163
Size 288KB
SHA256 633ab1cefc45367e4be849b6a39d176d26a2d41948e0392b4a8af8ac98505e4c
MD5 22e5ff0bb7484070a52d2382ccd93294
SHA1 5f19b6ab00c403b17c9dbc308069fc36b2cc8673
SHA512 d21343a2d22cb030f9aebc84d38bc4b027ee2145dfde6395f5aedb8ed329cb79d353d446c885d82c72b4dc8634e4c61488b9739bc37d530380705f859cc8cfe2
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v/R9+CqV:f1zkVmvQhyn+Zoz67Q9TqV
TLSH
T14B54EB03ED85B10ADB1A7430C5854DF33911AB0843815E2BDAFC1E3E0EB164DBAAC5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f4d-f9c8-b3f4-27c9.tmp

Path C:\Users\Admin\AppData\Local\Temp\7f4d-f9c8-b3f4-27c9.tmp
Size 15KB
SHA256 2d2def0ffe9351348aad614e9768f7cbb4b483da554caf5fe87056e9d652f653
MD5 87cbf54852d80b9ee97cd88bd8eb4516
SHA1 40847135e48ef29276d2e00fb59a89b3b0f38691
SHA512 424d47cff6e7c10936471409c65ab427882aa92d09e0b92c3471653e6d3e61d44713aede84dc8173851975952a8e81181c41261943f618421ff58b09a7c45a5c
SSDEEP 384:gK/4wi0ZOd/fJv8HsoW+Rkked1x1OlzWoLOZqo7hAMg0wtN8:gKArU8/x0Mohzk1OpWeyVAjN8
TLSH
T1BD62D088297ACCF4994E3335CA065A021B0DB27A6D349C45CF907CDE65630F392ACAC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86AA4B7.tmp

Path C:\Users\Admin\AppData\Local\Temp\86AA4B7.tmp
Size 14.1MB
SHA256 1316674e6edaa50bfc3915ea9de4fe1a5e7669437278ad5d1e7003cb30fd0c68
MD5 3fee95efe9b316166fd9bda0be02106e
SHA1 d62d753271ca581951687b37c64fdde76ab420b3
SHA512 c23fac1871b4e26d2c6cc693a6e4073c0a383605eb86c9a27a6ed70e6509a5ce142f7f8766987d90245f97448e521d39e960b2b123ddb8bb566ded9a6e74fb62
SSDEEP 393216:pHExWvoPoUneCCtSxQPeUSlV6xEOL82tneik:6g6oUeCCC3wxP88neik
TLSH
T1AEE63354546F9141B4EB130B916D02F2682AF1E723D926FF2B86B803F20B97191FD9E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86AA4B7.tmp

Path C:\Users\Admin\AppData\Local\Temp\86AA4B7.tmp
Size 14.1MB
SHA256 0eab764af3b1c63ea6686ad4a8840a43dae44d09a8ce26e278a606028066870b
MD5 49681767051a426ad2bd5099a0586268
SHA1 fcb52200e40b1f7899906a98d5261961f741515c
SHA512 0386f78e91e2acdb7ae09331a6bdba54ce5d205a41032a0b9dda37c0e0ae4d7cde7a7529749a9a1ecd6f02a893b3ea3dca9deee39cfe6b753cb6465ea8335a14
SSDEEP 393216:AiExWvoPoUneCCtSxQPeUSlV6xEOL82tneik:8g6oUeCCC3wxP88neik
TLSH
T197E63354546F9141B4EB130B917D02F2682AE1E723D926FF2B86B803F20B97191FD9E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B93C5DB.tmp

Path C:\Users\Admin\AppData\Local\Temp\B93C5DB.tmp
Size 4.9MB
SHA256 80ab8656aa0c8e9729ef06891a39517101085718c466b695b8f5a21d6e0770c6
MD5 36235099fc1e0dc7791eb30c20a7e755
SHA1 38d877f08add421bdce795f259bdd70cbbc958ad
SHA512 2060548a52157787b658641ff4488103fdfb944ae64584dadc39ba52d581b72d67714c1242c6f99f51a73b73b7616370d024403e0c48f18afa8320a0bd277e7a
SSDEEP 98304:P4doowlxW9vdz+3RlDJqwYCVyyoTxsB6ClA34bZdp1XRQjINUxPcHMR:IHExW9A3RlDg9CX7BbAobvp1BQkNmKMR
TLSH
T1583633949D7F7D89C9BB806DA523BF99280E9547AF52DE8539833C80F74B9B016CD023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B93C5DB.tmp

Path C:\Users\Admin\AppData\Local\Temp\B93C5DB.tmp
Size 4.9MB
SHA256 569cf21204e256a6ff6ca1ebb5d25561cbd333005a7a4130ee154d605a8e4b90
MD5 c960ba24cc55afba7032842f8a77625b
SHA1 9fadc1153e8c0bb77341f308d6158de5be130ca2
SHA512 2cd75b962935e8fc0f446ba1b5a2bfa77c18df679c03ef8f1c1f510f9f6aafa2b49d7ee5ef2c92f2f0514e997443564fa68837e7e236cb5f62103a845173d9dc
SSDEEP 98304:C4dkowlxW9vdz+3RlDJqwYCVyyoTxsB6ClA34bZdp1XRQjINUxPcHMR:ZDExW9A3RlDg9CX7BbAobvp1BQkNmKMR
TLSH
T1C73633849D7F7D89C9BB806DA523BF99280E9547AF52DE8539833C80F74B9B016CD023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DB9DC73.tmp

Path C:\Users\Admin\AppData\Local\Temp\DB9DC73.tmp
Size 40B
SHA256 5d1c707b5784ccf10933398e0c29618606138a49bd0920a7f829243f1b793c0c
MD5 eea1e87f82478172a9a5134dfd59dc53
SHA1 d630e9eca30506cc1e4c016dc8a78ecfe85faf13
SHA512 80bf1bb3c89f10e3d353e63308ea2fa528983f57fe027d0adfa72b95a1b22324904e75a68705ae2df0b2daf0bcf65f56f9011865a9946c4f3e0cba592d2d6a21
MD5 SHA1 SHA512

Submit Download

EE9E8D6.tmp

Path C:\Users\Admin\AppData\Local\Temp\EE9E8D6.tmp
Size 40B
SHA256 5c6f9c83f988056fced18b6581761846ee14d5fa92837dd75949e76be06dafd6
MD5 b8019876aa3a785c26e4eb106fae88bb
SHA1 4406dac848f64bf1d5e3337d80ec197a206598bb
SHA512 8b90617f2f9e18c87642b9f8133fe4059ad59b9da5f606e5cb2f7549f38373d89fd1290b77547776a836edcde2c178061b2b4475aae748a47ec72b4ea910f2f4
MD5 SHA1 SHA512

Submit Download

WEmulator.exe

Path C:\Users\Admin\AppData\Local\Temp\WEmulator.exe
Size 298KB
SHA256 ae7f750cc8e002804edbf463059b60d9ac9d1c97155f532de4380a81a22a0f39
MD5 16b92c67941b88d3a350b50fac597909
SHA1 b4438fffc5c4cfc2960b28d6353d72814108e971
SHA512 c0427996dc071967f846814ed7459790c1d3d53012e035670fe7f6584dbd57b9038c262378e785ba60c430a2104cfdaea00f974d5ed77a5dbd7d6fe8f7dcfd09
SSDEEP 6144:uIh7SRcY/zlwgqtDBcMqhvxfYZXQmoadW:P7SflVq9BcjoNM
TLSH
T1DC548E2AF3A814F8ECA7C27CC9464916E77278050360CADF17A046663F376E05E7EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eztwain4.dll

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\PDAUTAITGWFCNLQTKN\Eztwain4.dll
Size 1006KB
SHA256 3ba8def47d369dfdf0c15cbeaf33baa1677342c57de97d1d659a120b6c64c792
MD5 69ccf0eafa559e506b4e6e2773cbdb48
SHA1 79969ff9b3907bd8ce65c28408d5412d37ef40fc
SHA512 06da3d3b9d2b8d08cd83f63e3027a0b4c6cef0bd0af635f4231cb91301060636043cb3130af63841915a03a9acf389b36e7de05a7cf89675126ba436ef22467b
SSDEEP 12288:rDIQ1WJW6u5JqsaT8GNqHvfKn1QlTtY2X8RuCLITH5a:rDIQ18EHoQonIz0
TLSH
T1FD25070099F0C4A2C8700C7FD5AA96F56D76AC59FB1682E396483D7339F13C01636AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tech_C.exe

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\PDAUTAITGWFCNLQTKN\Tech_C.exe
Size 576KB
SHA256 3769996f8267fb2ee2a1819ed2cdf1746257283e2dcfb28f71dd9f8b4d994b55
MD5 c78fcfeeba6e2ae52f28efd2e054ae89
SHA1 894b2932d7e3cde0a42d2249063c5e058a8b9b38
SHA512 883e8e7cb17596544d7e80415cb9c06484c116d1de71add047084356208ff4529a691b23dbaeacdd770f104ae9a325cff3bbe2b532055749ab8f7aff4ca2e596
SSDEEP 6144:qQ/wOnH9FzvPHuifBbUvqBPfGXO0XnUsFTb90nKg2Gedar:qIJ9FbHuOuXXNT55T1dar
TLSH
T10EC419203715853ACA7252B298A86FBF302DEF144BE44DC7A3D87A2DFA715D35A31607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridgefmt.rc

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\PDAUTAITGWFCNLQTKN\bridgefmt.rc
Size 18KB
SHA256 0128fae3ce35c1a5a51cc47a1caab3d848df518f4227b32818547dede86b3809
MD5 c27a3cb0761fe426f12a475bd20f0bd6
SHA1 481328e47607e173dad8182cb18336d73ba54dfe
SHA512 61b9387b053a61740dc62a11b9ad75fad07c88e9e60fa528aabe1704f478af2ca39ad12c1c8cc57095fd80d5ca8a9ed81e6e75afd53ebebcfb093c107f39c94e
SSDEEP 384:fWNP9FpeI/ZY9Vp/HZv+eFnyEUKX1woJ13r/3pfCxLR4XNJ3fvkTrY+:faVFMcZsZ5yEUKN1z5fCxLorvvYp
TLSH
T15D828C79CE166B35BC2915BDCA69F1919640B8B16EDF6CF325ED28077C38248C636C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc140u.dll

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\PDAUTAITGWFCNLQTKN\mfc140u.dll
Size 4.6MB
SHA256 a7c07cc937b9a58794472010d5c90bc5c3c644b339d42b5917573ecd6bf0615a
MD5 958eea0559ac31d5b97c2454233fbfb1
SHA1 acc8f7a765ccd7a389acd39450a14d4d05a33267
SHA512 d32d28b0a9b876abb63efd1788f0c05caf68e865f482e82d578862af524b6195441b297e71b0af2c02b62087b5a79cce3d4df992905419381fb5f5f9ebc864ad
SSDEEP 98304:Lpv7jCfioUprPFRs+6+23X5nFg/5s1iBWHBvFLOAkGkzdnEVomFHKnP3Rr:xHnrPzs+z2HMCoBWHBvFLOyomFHKnPB
TLSH
T12836AE507D8800B5F98E117A8A6CAEB5E56EAC28133E11D77111B71BE431FE31E393A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\PDAUTAITGWFCNLQTKN\msvcp140.dll
Size 439KB
SHA256 2c0a3e328419b3b50b0430f38c6b5882e302177f4b003aba6a0e7e035807043d
MD5 c53b950681b9f07a8d56f2ff272cbf5c
SHA1 0ec5c6084b6ce4e9a0ed3cca02ba464450f19d36
SHA512 a48c886ff9dd34344094c00c8ff18ee91a359f06dac4cd42c2e054857cd0a12121ba4baf8e85d158fad5a62dfe4c694e5d80c4682564fe07205ca69139a364f5
SSDEEP 12288:n82bIggWBCs9B+zJT8N/oaTvlbJLsRXhUgiW6QR7t5s03Ooc8dHkC2esjeX8:nbTgWBCs9B+zJT8yaTvlbJLsR003Ooce
TLSH
T1E1A418227B064DF1E58923B572C6431293F9FC654361E3C3A7DEF0692F662C6A633291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registrydef.yaml

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\PDAUTAITGWFCNLQTKN\registrydef.yaml
Size 3.6MB
SHA256 3ac184309af366312f26fb69bca016d11840d078446f7354c67ec1c93d105afa
MD5 11dbfcd5a89430c92b0c89fc7b116640
SHA1 89f7700d6f9627374a28676e646c51013cd70a34
SHA512 6f40bc6b5bc24a26596b3034ac6b644d5d03b20a19d65ef4a149759dbb985bfd477e2ad21c51df6a0b85d5c26c8b09cd6fcc122d8ad7ce604a19fc7ebb62ae3a
SSDEEP 49152:Ww/RgtQQFzZineY0JQTL3pIN6PP4FpQjobVJdQlRryTo1dXcnrRLaVm+fhQl7/Ra:DaQQ/m3pIN6IQsClR7DStYh8I
TLSH
T18D06239D4CA895FEE81605B04C62EAAE77BC27F363DD394C2E8E05640989275C1C9F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\web_store_shell_v5\PDAUTAITGWFCNLQTKN\vcruntime140.dll
Size 88KB
SHA256 bf33857f46e56ea7930c1eea25c5f7175a6aaa3df36bf8301a785e6ca726a0b9
MD5 c33386a6e67be415a24d9c431ffd42ac
SHA1 f2f23860916471bdc332b3bd3e88deef64d4432b
SHA512 bc6d5e908bfaa7a35a8f2e01912412b9460604ea19fd27ee5c6f1a05eb0180a07bf7bc26d430326afc9b81d7f19fb1899e6245196a37710c3e5346d0bc2b4c98
SSDEEP 1536:EbiyVUrqIQsn1xtg6RxkkBGCGHDWbWXaecbGasQLvBrzU6LzNa:eiyLyt/xcRjWaXaecbGzurJBa
TLSH
T100937E5235E482B2DDAF04F0D97AEB076A3DA6900FF129F76B949949DE617C0D73020B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1720-84-0x00007FFBC6860000-0x00007FFBC6A69000-memory.dmp

Download

memory/2404-71-0x00007FF7C37F0000-0x00007FF7C3A24000-memory.dmp

Download

memory/2404-392-0x00007FF7C37F0000-0x00007FF7C3A24000-memory.dmp

Download

memory/2404-383-0x00007FF7C37F0000-0x00007FF7C3A24000-memory.dmp

Download

memory/2404-187-0x00007FF7C37F0000-0x00007FF7C3A24000-memory.dmp

Download

memory/2404-93-0x00007FF7C37F0000-0x00007FF7C3A24000-memory.dmp

Download

memory/2404-144-0x00007FF7C37F0000-0x00007FF7C3A24000-memory.dmp

Download

memory/2404-268-0x00007FF7C37F0000-0x00007FF7C3A24000-memory.dmp

Download

memory/3944-12-0x0000000074A00000-0x0000000074A4F000-memory.dmp

Download

memory/3944-13-0x0000000074A00000-0x0000000074A4F000-memory.dmp

Download

memory/3944-10-0x0000000074A2B000-0x0000000074A2C000-memory.dmp

Download

memory/3944-32-0x0000000074A00000-0x0000000074A4F000-memory.dmp

Download

memory/3944-45-0x0000000074A00000-0x0000000074A4F000-memory.dmp

Download

memory/3944-1-0x00007FFBC6860000-0x00007FFBC6A69000-memory.dmp

Download

memory/3944-57-0x0000000074A00000-0x0000000074A4F000-memory.dmp

Download

memory/3944-47-0x0000000074A2B000-0x0000000074A2C000-memory.dmp

Download

memory/3944-0-0x0000000074A00000-0x0000000074A4F000-memory.dmp

Download

memory/4000-150-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4000-74-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4000-422-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4000-308-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4000-431-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4000-445-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4000-265-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4000-269-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4000-78-0x00007FFBC6860000-0x00007FFBC6A69000-memory.dmp

Download

memory/4000-413-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4000-94-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4000-66-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4000-173-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4000-101-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4000-385-0x0000000000F90000-0x000000000133A000-memory.dmp

Download

memory/4392-51-0x00007FFBC6860000-0x00007FFBC6A69000-memory.dmp

Download

memory/4392-86-0x0000000000470000-0x0000000000504000-memory.dmp

Download

memory/4392-50-0x0000000074A00000-0x0000000074A4F000-memory.dmp

Download

memory/4392-54-0x0000000074A00000-0x0000000074A4F000-memory.dmp

Download

memory/4392-60-0x0000000074A00000-0x0000000074A4F000-memory.dmp

Download

memory/4392-64-0x0000000074A00000-0x0000000074A4F000-memory.dmp

Download

memory/4936-91-0x00007FFBC6860000-0x00007FFBC6A69000-memory.dmp

Download

memory/4936-132-0x0000000074A00000-0x0000000074A4F000-memory.dmp

Download