d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84

Analysis

user interaction
yes
max time kernel
899s
max time network
884s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3JJ8KI.html
Size 11KB
Sample260720-k33gmsfs5x
SHA256 d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84
MD5 c229b9d23420402bdea979bae2d31dde
SHA1 cf5cb6cd0c16a3cd252c792a13907df48fa2f0d4
SHA512 bdabdc88c2c5f8c1b6e4730801ad263d8f0172f9cbc19d80de98acaec7d06218f830366b5c10a63cf589de17ed23dd3b84542ab2183f93fe383f9fa3bd6f6fb8
SSDEEP 192:zMilLhIJhKYX5kerCNRupjQ4vYJkTcOHsU:zNOJhda4s4vYJk4OF
TLSH
T1BF32764A1EF280E701E785A97DF2FD0DAD85864BD219FC4832BC80A90FD7D468DC7995
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
149	api.gofile.io
152	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2172	cmd.exe
4692	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
672	chrome.exe
408	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290121336103454"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "4"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "2"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\5	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4 = 14002e80d43aad2469a5304598e1ab02f9417aa80000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Applications\7z.exe\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 050000000400000003000000020000000100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Applications\7z.exe\shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Music"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Applications	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\NodeSlot = "5"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000900444648b4cd1118b70080036b11a030300000078000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "9"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Pictures"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000010000000200000003000000040000000600000005000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
2480	chrome.exe
2480	chrome.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3040	chrome.exe
3040	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
1180	OpenWith.exe
4504	OpenWith.exe
2852	OpenWith.exe
3204	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe
Token: SeShutdownPrivilege	3268	chrome.exe
Token: SeCreatePagefilePrivilege	3268	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
4504	OpenWith.exe
4504	OpenWith.exe
3168	7zG.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
4504	OpenWith.exe
4504	OpenWith.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3268	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe
3564	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
1180	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
4504	OpenWith.exe
2852	OpenWith.exe
2852	OpenWith.exe
2852	OpenWith.exe
2852	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 5092	3268	chrome.exe	85
PID 3268 wrote to memory of 4072	3268	chrome.exe	86
PID 3268 wrote to memory of 4072	3268	chrome.exe	86
PID 3268 wrote to memory of 672	3268	chrome.exe	87
PID 3268 wrote to memory of 4512	3268	chrome.exe	88
PID 3268 wrote to memory of 4512	3268	chrome.exe	88
PID 3268 wrote to memory of 1212	3268	chrome.exe	90
PID 3268 wrote to memory of 5016	3268	chrome.exe	91
PID 3268 wrote to memory of 1212	3268	chrome.exe	90
PID 3268 wrote to memory of 5016	3268	chrome.exe	91
PID 3268 wrote to memory of 388	3268	chrome.exe	92
PID 3268 wrote to memory of 388	3268	chrome.exe	92
PID 3268 wrote to memory of 648	3268	chrome.exe	98
PID 3268 wrote to memory of 4508	3268	chrome.exe	104
PID 3268 wrote to memory of 3492	3268	chrome.exe	105
PID 3268 wrote to memory of 3948	3268	chrome.exe	106
PID 3268 wrote to memory of 2392	3268	chrome.exe	108
PID 3268 wrote to memory of 2392	3268	chrome.exe	108
PID 3268 wrote to memory of 3488	3268	chrome.exe	109
PID 3268 wrote to memory of 3488	3268	chrome.exe	109
PID 3268 wrote to memory of 2596	3268	chrome.exe	110
PID 3268 wrote to memory of 2596	3268	chrome.exe	110
PID 3268 wrote to memory of 2404	3268	chrome.exe	111
PID 3268 wrote to memory of 2404	3268	chrome.exe	111
PID 3268 wrote to memory of 4400	3268	chrome.exe	112
PID 3268 wrote to memory of 4400	3268	chrome.exe	112
PID 3268 wrote to memory of 912	3268	chrome.exe	113
PID 3268 wrote to memory of 912	3268	chrome.exe	113
PID 3268 wrote to memory of 3536	3268	chrome.exe	120
PID 3268 wrote to memory of 3536	3268	chrome.exe	120
PID 3268 wrote to memory of 2620	3268	chrome.exe	123
PID 3268 wrote to memory of 2620	3268	chrome.exe	123
PID 3268 wrote to memory of 768	3268	chrome.exe	124
PID 3268 wrote to memory of 768	3268	chrome.exe	124
PID 3268 wrote to memory of 4732	3268	chrome.exe	125
PID 3268 wrote to memory of 4732	3268	chrome.exe	125
PID 3268 wrote to memory of 2480	3268	chrome.exe	126
PID 3268 wrote to memory of 4904	3268	chrome.exe	127
PID 3268 wrote to memory of 4904	3268	chrome.exe	127
PID 3268 wrote to memory of 4500	3268	chrome.exe	128
PID 4504 wrote to memory of 2628	4504	OpenWith.exe	139
PID 4504 wrote to memory of 4368	4504	OpenWith.exe	142
PID 3268 wrote to memory of 4736	3268	chrome.exe	144
PID 3268 wrote to memory of 4736	3268	chrome.exe	144
PID 2852 wrote to memory of 2188	2852	OpenWith.exe	146
PID 2172 wrote to memory of 4924	2172	cmd.exe	156
PID 2172 wrote to memory of 1228	2172	cmd.exe	157
PID 2172 wrote to memory of 3348	2172	cmd.exe	158
PID 2172 wrote to memory of 464	2172	cmd.exe	159
PID 4692 wrote to memory of 2920	4692	cmd.exe	162
PID 4692 wrote to memory of 2864	4692	cmd.exe	163
PID 4692 wrote to memory of 4748	4692	cmd.exe	164
PID 4692 wrote to memory of 1660	4692	cmd.exe	165
PID 3268 wrote to memory of 4580	3268	chrome.exe	173
PID 3268 wrote to memory of 4580	3268	chrome.exe	173
PID 3268 wrote to memory of 2680	3268	chrome.exe	174
PID 3268 wrote to memory of 2680	3268	chrome.exe	174
PID 3268 wrote to memory of 2892	3268	chrome.exe	175
PID 3268 wrote to memory of 2892	3268	chrome.exe	175
PID 3268 wrote to memory of 2076	3268	chrome.exe	176
PID 3268 wrote to memory of 2076	3268	chrome.exe	176
PID 3268 wrote to memory of 4516	3268	chrome.exe	177
PID 3268 wrote to memory of 4516	3268	chrome.exe	177
PID 3564 wrote to memory of 3348	3564	chrome.exe	180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\3JJ8KI.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffff0f2c728,0x7ffff0f2c734,0x7ffff0f2c740
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,3451327607860241928,13631061058426482970,262144 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1692 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,11492834114268156205,17547272382223200146,524288 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,5329189294775516462,16240989699259175924,524288 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,14661210408021308552,18233396999625853049,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,10863177151379628977,10492376857866027657,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,15293569334756776174,13925240652399114210,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,4157009032006265595,3640450377955209432,524288 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,408741679190282419,7917849956523944020,524288 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,3634642033467495237,14951717585717810868,524288 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,5030514627557309451,4945655544266300851,524288 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=728,i,16698813348076407237,3257978141142596789,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3932,i,8369708525792699640,11116843136196863280,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4612,i,16550222544659536154,13006449878882984079,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3224,i,6310717445716107349,3662132462624626137,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3244,i,10592854187840327265,12598622244345437958,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5604,i,16635703565212130741,5197590647231513887,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3476,i,5802295174361912377,1736267411661143888,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5804,i,8580922012304860750,11155742913741222060,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5856,i,3485060778363411033,4623903695197820995,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3284,i,17272161944268119264,2838903871401016257,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5944,i,6612203003463942185,12034485668528512401,262144 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3444,i,11784055464577221615,15354638966525612755,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,1643706329203050752,5411575887620783360,524288 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3908,i,15760565888382519206,15711193345669908628,524288 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6248,i,6668901060984175529,4200292345043217897,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5728,i,10262483948355126608,10360342931369555770,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6264,i,11461170754604131612,5866712021949481670,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5900,i,15755832958596078447,15967203709202814073,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5772,i,16673868103265771472,4804961384252409330,2097152 --field-trial-handle=1704,i,11868667478762826726,15166855102289694985,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4240

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1180

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" "C:\Program Files\7-Zip\Lang"
  2⤵
  PID:2628
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\Topaz Video Activator v2 (win) - satvrn(2).7z"
  2⤵
  PID:4368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\Topaz Video Activator v2 (win) - satvrn(2).7z"
  2⤵
  PID:2188

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3204

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1192

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap25412:140:7zEvent13353
1⤵
- Suspicious use of FindShellTrayWindow
PID:3168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\TopazVideo-Activator.cmd" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:4924
- C:\Windows\system32\mode.com
  mode con cols=44 lines=19
  2⤵
  PID:1228
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Topaz Labs LLC\Topaz Video"
  2⤵
  PID:3348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -nop -c write-host -fore 'DarkGreen' '"Topaz Video is not installed."'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\TopazVideo-Activator.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:2920
- C:\Windows\system32\mode.com
  mode con cols=44 lines=19
  2⤵
  PID:2864
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Topaz Labs LLC\Topaz Video"
  2⤵
  PID:4748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -nop -c write-host -fore 'DarkGreen' '"Topaz Video is not installed."'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\How to Install.txt
1⤵
PID:4488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffff0f2c728,0x7ffff0f2c734,0x7ffff0f2c740
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,14734715884836776219,9282797899430409857,262144 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2000,i,4682272985809606876,10375005978083054612,524288 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,9868747181691614703,10082096170127204762,524288 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,18033921576295234380,8311578783523701357,2097152 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,11529733655252873237,17108671871588468380,2097152 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4524,i,12455050960165403365,5921657064127937113,2097152 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,7579292951607911052,2878469376472357885,524288 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5208,i,16639662164703250709,10305797398328656665,2097152 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4456,i,14345890720897845082,3858785294833888297,2097152 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3268,i,12386143759738919644,16524378465728538604,2097152 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3284,i,7138144861026492688,2102260246430758108,2097152 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,13051850336575458591,15533981771926941450,524288 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1220 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,1567043375951020132,9089535089799596314,524288 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3228,i,15627087240330581274,3001990641655746481,524288 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3404,i,499407300904644893,18028780618284732605,524288 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,2703907480049390424,8279861674061995805,524288 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4512,i,15682775919669100636,13035000555828895391,262144 --field-trial-handle=1888,i,10470870913901359899,11865929416250508940,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 77bcdb2c3160a7fd4141144587938963255d18e2280ca048bae35e2b889daae1
MD5 f444c4b91d48467daad7fc304bf0b2b7
SHA1 0a54e0644c006f7b684b802915a76b0b9e907f2e
SHA512 954788cc6221a65dba3cd53452e7ffe912bdce7b20bd8cf2525ecbc1a2e6c0ba3448dfbcc8997d4347508beecb9ddb77704805450cb4090f76ac02aea569ca9f
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 65e2b3c5a5d77e1eb96077fad94dbb6d1302f6c0f9db9e32aa0b19e01361167b
MD5 5f219099954850a490d8407e7e83ab67
SHA1 24d3b621e981ad3028dbe906672e8fd52a3033b8
SHA512 1339368e59ee11dcefaf5719bab0ffa36ef69fa6bc43f918bcf759de90f19e2e0d540223279039f2d54745bd379f32d877ea4990ed0a3b13498f178fe0baf02c
TLSH
T128E02BAFCD21DC371DFD471850954745EA55135A3A80495F3A3CC71D4FB063A4586C9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 430626d3ef8b4007807cec9d93c0372f3041e7516b00e04b9c54392d5f134e07
MD5 b778a75568c29e54dcb1d0341b3981a8
SHA1 753810275352d296f6dbd577e29558ac6ff3f605
SHA512 b63e8a35cd3d0dca8684e927cdef8b7c0d75592737a614cc2392c716da53bd82d73109a4982a539e41b8412074172c88c3f24d0c314e6cb11f56acf94a5985fe
TLSH
T1B031FF69356AD141FFF1D23041F56ED438B93E3189078E161879C5B6D483F5458283AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3305e931a15af58976b827f9f01f39fece58848e280887e33c474939ada7ed4c
MD5 c3ce6cb8cf7c0739558b726960509c42
SHA1 ecad96d776033b69fa36ed32080ed6c1c21f6ffc
SHA512 e0f45ac87dec26dd56ec9b39810118c98d389672e8c38808578370a9838488a1543bb2d6381a46342e36228cfc17aefee4ace486bcf9422301f30b0a51a4e4af
TLSH
T10F41337432A5D151EFB2C2B850F17ED435B93E318D078E16886DC6BD9483FA558683AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 00b03b02fc8e5601149f3dbf43e4b833d1f4b11761638de618d952851724f3e3
MD5 1739ee8a4fb8884e80d3f0bacbd71f0a
SHA1 b7c812015bdeb201233cd6ea0d155bfc42dc0f03
SHA512 af41795393c983e1d4ae3cfe7da07db53dbf19574ce3f65f8c6997d18072e752ead66ca013937545625823301ef9315d68e8c35e11f06fa2bb60da5540b732d9
TLSH
T15F71AEB936E99442EFBAC57441F03EC839B87B3148074F26A428C579D887FE9295435C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 e144733c0440871744a2d24f4ceb084e39c043817f02c937314df52cd3a40352
MD5 e86fd5ebc1620c643655694c4e4a6635
SHA1 74b2a404b79f3fb1c7dece97eb7cac56ae149a91
SHA512 d6e048857dbc61bc12b864c46217a73b1ac39b4aba508cea2aeb6333e090a8ce9f0531950442c60131b83692ef2a83c20218f8a9e492356ad8f627e5bb18a784
SSDEEP 3:MsEllllkEthXllkl2zEBKltl:/M/xT02ztl
TLSH
T1444402056B801905C910107040D187901370E4124511974B24611422BC869710D01100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 28KB
SHA256 7326aa6bae0e291e4bf76cf6055b49e29a22131638eb533350840a3500055439
MD5 6fd6bfeb50fbecd7e3f2d643a2938d42
SHA1 48a84bcf526b8b33944248be24a6cd217886f1f7
SHA512 2c4aa20fd3c4e4cc19064c014dee7be8a4576d7340eaaca53869855f3e72854f7c8bb722e6be4cb720bcf107826a7e73a93f0befb8bdaac426452ac0d0e24a0d
SSDEEP 192:pcJM7HuB42wc2wU6fHuBp2w92wnHvQQRAt1UAlOPA1me+DqrXKSX9c69:WM7HowxwUMHBwwwnHv7OUu8K9+LM959
TLSH
T115D219CBAA643C63CFA89DFE302561B9DE77800D9F658CD4292448010C7EB9D94D6AF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 9a9c17413ba391232122207ed2c79bc0df2a86b922a0259d91b8ed10d790357b
MD5 32bb9aa5ff0281de410b83e7ff81c58c
SHA1 457e2f705fb438a11402ff8b25aa8c496f9de9f3
SHA512 6e175594375cd3b050a15c71adceb4b2c278a07630cbfa5f71de47fc09e611cd88d087a947b929dd65ab343ea232cbf7e5cf41b37318c4a192c581fdf3a71eef
SSDEEP 384:jH4wZVwd83j/tIkUI3ijV4WNkqpXDDcBBprwwwrwzwXwyJw9HLwcwi:zjZadir64iZkqZDDcBBpELE8gnBkXi
TLSH
T1BAF3955F5A603313CDFCD2BF74A241E66D6EE05FCB2619C06C210464CEA6A6AB0CC5F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 cfa6042dbe096775268899a330744816c9782f2979e961841f32a339a39d1765
MD5 fd1e4923385db90a224f7bf01cf49a0b
SHA1 f6117a00bea19be645dea5ea074f0e3c5099b0ee
SHA512 e8d4db456576e41b010d53290be41582c4e421e539786ab6766e6b391a4ad44992f9287b2c8b34dee5068c9aa3135bc579f91f18722d6c66d25f560b90da6b94
TLSH
T1E5E02652648DC1AE9104811B823A730DDFF03406E7CE7A823B0FBAA1B4C4C08E3E1685
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 360e716ca6a12bda1e06c82bb70cedc2aaa99ede8b9983519a09237c1fd9e186
MD5 139d09f7873dada9e448ac0c1ee2b18d
SHA1 aa522cc476af306727745d728be2677fed60d22e
SHA512 c3306248989b2e51f987ca2fc85733af73deaed9c171a16f0ec051e59e875240f1b9a2e526c7f60c4fe2d534f9d8ee09b3f36a952740888f9ebdef4adb4f3a8c
SSDEEP 192:DLdcnQ9JFRaIaEdGwf5ifEDAVaPIbvSfPYNPHNSPVB:DLdcnQ9JFRaIaEdGwf5ifEDAVawb6fAK
TLSH
T19DD1C0F7C3E8852E892156F8AB116F1FCF290524432C3C66C9D4AE1BE3E2871E25565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d0d6f824b22d6f0d6d29f92e4fafd79a6847799a028e279a559aea0fdae60b4c
MD5 0cd47c19568819b25b84ea79a8e462da
SHA1 95237a94834c62b7838475fea4bbfabeafee38c3
SHA512 92ef1d61f100d088ec5ad198c21ed4adf9b7d31055ee3f586b9a2e2a20dfdd5129c2c9dc9d7084585930f07fe042dbd7dab7e3ea0e8e8ccb86969022f01f8e19
TLSH
T1AE31BBF793F4997E8A10A6E4EA146F1FCE790524131C3CA689E46E1B53F2972D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 31a8f3b747d6e6ca868d28017c7d66dde02530a581e215ee10983af161d67577
MD5 3d2aeeaa7f864db3c63cfd2a8972c149
SHA1 b93c05e29b5bbfbba2b38fcf948f96b3daccaf39
SHA512 1a7afc6261a576febe833ff6ce08d1a8f36340ee1b556b601d159ef0a5d00af5e2ea6af8007bf3dfcfe570aff6b866b44aad9078c19c3ad019ee2490f6027267
SSDEEP 384:Dcl5tJJ5JYKkaOQU+aNQfQWQx5cSa6JW1D10Y4i0baaIvYifEuZVaqbSfqNqSPVB:EDyx2WPupB8W0NCNl
TLSH
T186A2BDF7C3E8C62ED82165F497147D1ADE1C0928871D3D26C9E4BF5BA3E2832E20165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 73e05b6dd8a7e266dbbd47106129d4099bcc12203d3c47e6dc7a14115ad36db8
MD5 b1e56ba7bcfce50b593354f29cc062f5
SHA1 81cc0ea4c509e2538c077d66b963698b11036a56
SHA512 1b0991fd3abb3e63e5f9ecbeec15b4acab1bc65e470969dd299e73f02f007544dd1d4fa5bcf7e502e45341b39067de661ec3ed42b7f1eabbbb919affd81a9796
SSDEEP 384:Dcl5tJJ5JvHsaWQfParQ2Q/QYzcSa6JW1D10Y4i0bicg6IaIvYifEuZVaqbSfqNI:EDJRx2W/QpB8WxRu4Y1
TLSH
T194A2ABF7C3E4C52E982169F49714BD1ADE1C0928871D3D66C9E4BF5BA3E2832E20165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 5b6243f14459c16b18c2e1ad3838cc1ca27063e4389b032ecfc1ebdb019688cd
MD5 c89af49473b0e19d9cf50b86000d7ca1
SHA1 8911186b196480377d1b83823c6c4ac943e3f384
SHA512 84a5990b24ec59de60731de55db07ae2f73a6a84327c3301ab51842e21bedf734752831122da313c501a0f747871760523f8cd38617ae98eb35b2c3f433eb0d6
SSDEEP 384:DcdcnQ9JFJnnhadQdla6QiQjQGKaIvwf5ifEDAVawb6fANqSPVWRuEdw0RYDkYpc:kvgfbI7j8H7
TLSH
T15362ADF7C3E8C62E982165F497157E1ACE1D0918831D3D66CCE4BF1BA3E2871E21165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 5d2075daa4bd5762bbdc8eaff8d77cbb77cad2a8e641e4af1603344941764bf9
MD5 f32f6c080b8e097091ca98e0f8945331
SHA1 6ff8e7e0b0d21ed21fd38221af6e95f3059d00d9
SHA512 30a68fe751a2897c5794713085b4ba0cb22c1efe35736856240b6a220dad1a33932505590f9b2caabcf76d6441275ff947a31e9231bbaddb273a2334cc9815bb
TLSH
T1DB61AEA3927EB89B507D08BB1D047D5B2DB9A4354153A4F8DA9BA22DF0C1CE317124A6
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d8fa5a4b1fe3290f5c09850428f7db7be550a344222020d2242e31a437ef76c7
MD5 03d5b6423b1440fae6ab2786eb584687
SHA1 4cada4012c1288da1447fba6e2f783535ef53d98
SHA512 674c12d9278fa63c32cb53dc271d2d8424fa163129f7680e78222d1868b189b7a1ae0a006774ad0444968ab0aa76cce91c7786c02442ebb3b71313239a9aeb41
SSDEEP 192:LR3cBzgLAjemQFO5txv7hpdPRptHknL1Q95Hsb+WNnSvHMT+jQ25tPCovYVyIsnv:LR3mz+qrQFch9zXYGrwIgR2Hv8E
TLSH
T12A52D62FB910597B5DCBC619F822BB17D7F6147225A01D84EBFC8A2C19EB9CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1334a2c62b895e5268803a63dd821d888087c7211d45d69ff6126946adc55d9c
MD5 05aaf001fd5e6bbd07c5e4f9ab2ac285
SHA1 110a84d166437dd5a9c3ef67a8292148b31dfc13
SHA512 7a87fcd50d63a08dde9235607328f5e596aaec5e396674a7b2c50b2a23396cbc0d352f529523b7ed0c2dad5d8a6125f7aa91cc1b11a7bc689254ef9bfc6c8080
SSDEEP 192:LRLgLAjemQFO5bxv7hpdPRptEnL6695Hsb+WNnSvPxtPCovYVyIsnAUgE:LRL+qrQFuh9zX8G6rwIPvv8E
TLSH
T18F52E82EB900697B9CCBD619F9227B57D7F6147125A01E84E7FC8A2C19EB9CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0c4b85ebd332dac239bb0e0e684b38a1f85588a20312597e1bfd88d823124613
MD5 e9d124b1482e61c534f8530dbeedd28c
SHA1 3c48968ce1ee81ce48e9670cdaa13881f41aaeb9
SHA512 cf03cd8abbf40f42cd34af4a1c3b37e8ffcf4dad4fde45e5ce1bf6cabe78425fc43db9dd2f9edf7df97ec92ae40dcf3ef6a2b2b8dede9737014fb898779ac3e2
SSDEEP 192:LRucBhQLAjemQFO5exv7hpdPRptHevnLNlF795Hsb+WNS8SvHMTRa4AFetYItPCc:LRumhuqrQF7h9zXkPtrwwgPACYUv8E
TLSH
T1D962B52FB910197B4DCBC619F825B75BD7F214A265901E84EBFC8E2C19EBACC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 3b1e8c122ef9aa149d7005645a7b8692b8ab1d188433ffd2450f15aa35a8c987
MD5 37e69d8f8b9c81274cc7263537a39650
SHA1 216b38243459b44177d2b943402526f26ff66711
SHA512 167f9ad8ac7046b150db0857752544b08d7a5007b14f60d9e24f10f7be7e6bef6d152d8041af62fa72ab560600490d12ed330ef3bb271c81e9ce1c183419c970
SSDEEP 192:dR3cBhTLAjemQFO5i/v7hTdPRptHevnLNlFEt95Hsb+WNrHRTEDPMTRa4AFetAEb:dR3mhHqrQFvX9ZXkPerw2IPACAPEtvOe
TLSH
T1E462B52FA4101A7B4DDAC629F825B75BD7F624A265D01E84ABFC8E2C15DBACC3313417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c2c64d2de89a55a80f620fc10e1b55fbe0755e95f045cfedb98435b7ca832bd1
MD5 02eecd86676eb8669b7332ff49a6bb57
SHA1 944789d53e324732dc67bd881c36a5f03cc501fb
SHA512 5bba69f770122a1e74f1e4b6d660193641f4058abe849f428593c0a052699b05fba79695b3a6bcb662ca57122b570632075b97adb79f9259b56bd3adb7b5063f
SSDEEP 192:LR3cBhgLAjemQFO5uxv7hpdPRptHevnLNlF795Hsb+WNS8SvHMTRWl+etYktPCob:LR3mh+qrQFnh9zXkPtrwwgqBYIv8E
TLSH
T14E62B52FB510197B4DCAC619F825BB57D7F614B265A01E84EBFC8E2C19EBACC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4e78daef55c652d2e397fff23b576745fde0a5f5a41c6e4e14fe67b63a700d2c
MD5 7fe848c1b58be36b659f0326bc13baf4
SHA1 f50b2a987ee85a54b6c54001cfc32c5b0f8066b7
SHA512 b5f9e24c9ff95f86d02a3a53b84fa2edd472491891de67d7797248ab62327a048510dbfe68bf59046e0d118940d54d1310e62187dafe612c19f64220cc29be3f
SSDEEP 384:5R3mhuqrQFih9+XkPhrwwdPACAx22Pv8E:bmhuqsFibbPhrwRPc2nj
TLSH
T1F062B52FA5105E7B4DDAC619F825B71BE7F214A265901E84EBFC8E2C19EB9CC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7eff9b4b493e3b9bc39890084702ca18e5505b1f024125fbe2bb602460181a8e
MD5 a0c5aaafbe4d6ad92ca5af7d8eb0903b
SHA1 041fa3c039c924d396f0b736a2d5999fb40d627b
SHA512 01f0188fc1bf20d3ca4c13a80b955ebdfda6c1cf302fa34fe9717fcf131259f91b75830b620c8718b9f262ef1af3d7c16ec1f11a24c91b11c484b70788903e1f
SSDEEP 384:5R3mhHqrQFih9+XkPhrwwdPACAAe3Pv8E:bmhHqsFibbPhrwRP73nj
TLSH
T12E62B52FA5101D7B4DDAC619F825B71BE7F214A265901E84EBFC8E2C15EB9CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 6efe3f8807628295d4eeaa3981f93ee06a3fb4924daa6257cdbdd75468bd335e
MD5 d411b148cd32edf5348b6cffd1f368be
SHA1 c565842ce6138fdf22c164397676bcd07f67acaf
SHA512 0c8e53950e8093f766e975e2263ddde30e16b49d2233fa20929fe6f5b55663583f0361cff90b873e76b808fd71eb3cdc2aafb5d9c413e500ea65ea2b7f36704b
SSDEEP 384:5R3mhHqrQFih9+XkPhrwmdPACAAeKPvRE:bmhHqsFibbPhrwTP7Kn+
TLSH
T1B662B52FA4101D7B4DDAC629F825B75BE7F614A265D01E84EBFC8E2C15DBACC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 effe34fe02fd9c4f235f14bfaf3b515e7b0f385d727494908bd616b91cc8a51b
MD5 11a85ac67751dd661dcdbb41a3534d3e
SHA1 be82ea0b18227a24130bcdd2f04b80976805244f
SHA512 9a910d5b268c0525588bd220758f57f0b958ada311c49c45d419ca444c60f1e33d60a0c073802b809b92850637c38c48691035522d9d3929741d75edf1052155
SSDEEP 192:dR3cBhyLAjemQFO5i3v7hTdPRptHevnLNlFEt95Hsb+WNrHRTEDPMTRa4AFetAEY:dR3mhsqrQFvf9ZXkPerw2IPACAAsjvOe
TLSH
T1EE62B52FA410197B4DDAC619F821B75BE7F624A266D01E84EBFC8E2C15DBACC2313417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 a071e04affe2accae4b77145ee799a288a0e694901337db76dad53eac59cf1e9
MD5 e7424684d14e26f6208f47edf113d5a4
SHA1 3e762d13b9e2c86c88b8b4bfd527a9768ff5edcf
SHA512 b5cb3c73fb1f6d48d948c30971098e3bc9cc4a36e7043594b304bd617eb79a01fff19095ee1ffc87558afb4c165e212c3aeac7556f079c4bce7155ea06f340c1
SSDEEP 192:dR3cBhlLqjemQFO5iNv7hTdPRptHevnLNlFEt95Hsb+WNrHRTEDPMTRa4AFetAEY:dR3mhd8rQFvt9ZXkPerw2IPACAAsjvOe
TLSH
T15062A52FA410597B4DDAC619F821B75BD7F624A266D01E84ABFC8E2C15DBACC3313417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a1e052a9316ed0fe312c78ca754f604eb328bce0e7fb9586881b18b97c85ccbb
MD5 163c51954208780c630e3296351b9beb
SHA1 3eac2491d48ab02d8e69c16cf7c334a021f84529
SHA512 11b64b54fdd9b8b3921041c20ce1a1f051946f9ee0f3503aea70188bc5a26b0b5a2ff7f91beaf9ea731a934a78ecda6bc5343a8ee6f5ab0b2c09f86c479dfa82
SSDEEP 192:LRLgLAjemQFO55tv7hpAPRp2Enk95Hsb+WNnSvPRtPCogYVyIsnAUge:LRL+qrQFQN9UXtkrwIPPg8e
TLSH
T1DD42B62EB910697B5CCBC219F9267B17D7F7146235A42D84EAFC892C19EB9CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 87b2d70055157263260aedf877112dc5021ddd82ec2dc953d0f506fb3885b054
MD5 e5987297f8dabe72683aaa6b84dd8c4b
SHA1 fa2d259048aec119a2752b2550a34bdf7c08aba9
SHA512 3810def336a138d6310390d9dc7927c54d9d27a8d1968463ec7e514d7689cbe27f00e1fac4ac6010b5a3c31a2669a6d20a039316c47e4f6579a520f68ec31153
SSDEEP 192:dR3cBhyLAjemQFO5i/v7hTdPRptHevnLNlFEt95Hsb+WNrHRTEDPMTRa4AFetAEZ:dR3mhsqrQFvX9ZXkPerw2IPACAXutvOe
TLSH
T17262B62FA410597B4DDAC62DF821B75BD7F624A266D01E84ABFC8E2C15DBACC2313417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 1afda0555eef4f7844f329192bfdb732f5b6be58b83f00b9d3f30925f36db7da
MD5 886230b93582a6bb7b414d500bc28aaa
SHA1 06bcee7715f127421c9349b60276390fa80b812a
SHA512 02b9ba393bfc5e5eccd2e6ab87113a3d10ddb093da4bf20849dc9ac8be468a4460180f14f4217b916f8b0aaa8cd48503361df0fded64f46ee6ba079646dce6be
SSDEEP 192:dR3cBhlLqjemQFO5iNv7eTdPRptHevnLNlFEt95Hsb+WNrHRTEDPMTRa4AFetAEY:dR3mhd8rQFvtKZXkPerw2IPACAAsjvOe
TLSH
T15B62B52FA4101A7B4DDAC619F821B75BD7F624A266D01E84ABFC8E2C15DBACC3313417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 91c6d1a8b91b6aaa1f798eae8534d0aac1436014d1e588cbb26d60c2810740e9
MD5 96ccf0c82e8e0ae140d98a9d208754c8
SHA1 e9898268251aa165238c9086b8b46c54ae3f1d7e
SHA512 d1916c47eda51861e51d67251176c4fb25a54b2605b828798b1c9e11842126cf8eead34349d7e8039ba4f03f5d3334666d4c2444380c555dc5f1f4d49b2148b0
SSDEEP 192:LRLgLAjemQFO5JTv7hpAPRp2Enk95Hsb+WNnSvPMtPCohYVyIsnAUgE:LRL+qrQF8r9UXtkrwIPgh8E
TLSH
T19A42C62EB900697B5CCBD619F9227B57D7F6146225D01E84EAFC8A1C19EB9CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 df77dca7f499cf74f957adfcffaf6b54267bd75b0b494e75f6a0032a5e7af038
MD5 ff0f3542c8e9d95554a758989ee754d3
SHA1 55f3d2f4aa1f1eb4fc2f3af18d4f9d6219434b3b
SHA512 9c4881af029c89847deae7e55c09eb276f1d74e9f2381cbae04aefd8026005b86400c8fd3483186d5cde777406d75af822338db67ab52cf713101d189ea77f2e
SSDEEP 192:LR3cBhQLAjemQFO5exv7hpdPRptHevnLNlF795Hsb+WNS8SvHMTRQvWetYutPCob:LR3mhuqrQF7h9zXkPtrwwg2ZYyv8E
TLSH
T1EC62B52FB510197B4DCAC619F825BB5BD7F614A265901E84EBFC8E2C15EBACC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 884fd60f3addce4b21da97f560b9c8ed16517c4e5716c986f337ab6d6f22b99c
MD5 1746dd59e2d335eb21cdfc10f4cfb75e
SHA1 ae178c24ef2d3d98b924231831d36158d4f9465e
SHA512 f508ed5f250bed3881191627066243c1543b8a0751a6cbfca04c8f50599b8e1271c42b24132a117eb81757188ea40f089ce940e464a77eab97b1c1577400e56b
SSDEEP 192:LRLgLAjemQFO5pbv7hpAPRp2E295Hsb+WNnSvPRtPCogYVyIsnAUge:LRL+qrQF2j9UXErwIPPg8e
TLSH
T13D42C62EB910697B9CCBC219F9267717D7F7146135A42D84EBFC892C19EB9CC222341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 be06d1a9f9af8134ca162d5a0fd41d21640d8bb6a2c3486448acd61b792bbc72
MD5 99cd22c90ebfade371cfe0446a1ed8e4
SHA1 7ee51742c1de339f38a601f9630ec186eef025ee
SHA512 2ded3316bca4ade0d33b6edcf7b001e630b48b8e135f8d9313ccdb231d8bb54fd226b00a89120bae291f40252fa964d54f350658036e6902d9ab3244734cb836
SSDEEP 96:F1mKmMNORwcnDh1JcsOyLXbXFXKXTwFXSXTr3XFXKXT5xhXsX60XbXNXKXTMPuZN:F13/NBmDhEsnL1ajiCj71ajh89L9ajMS
TLSH
T1C4A15C6EB50A184EE4AE4936CD78571B5F69CF0C27FE3767A9DF8B0405B0A5701086B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 c8ab00b16a51f9fef7c4f160090eaef44269a7d27544e639e87afe9646956e9e
MD5 38ff429983a63d32f8497c61b1a7db14
SHA1 22a7eb2bec613d6d215e8a4fe3fecd480dd5eff2
SHA512 09014abbf6ea4975292b92746cca66a0323d469e20c98c1e55a491f7108ec0427763de24773ca0b7256d2c70e855120233c0f474009a251a25876d79b4028c3e
TLSH
T1DAE026822DCEC2FD509A82030235A30E9AE9F406D2CC39067F0FEB8421C6C08F2A2640
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 706fce91ada41ec85c35f57195f5bb4c8f03310b5aa4cf2e3de064d4eee680f6
MD5 446e4a5f4de29ebc47807b62ccc35988
SHA1 f960f3624a19ba94017364daadf6198db170c171
SHA512 cb56c2e23b7c5a54ce785991f8b3a7a56976615fb1fbea436b04c5f3666477b06b7e26d6a7b9bab9143120ada92536c2d0263a1dd788dffb1cec54606b086686
TLSH
T18EB012448045D501C01202F4154674C871249F10A60A1B0593E07972D8269618116060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 95a35574dc852825c15a5fc8fddc8cff17530b5bc15624d94d6e16c5db7353ad
MD5 3a54dc198c5904ed2a300c31cc64dde0
SHA1 a97f45e86e0bd47a5637a2eec3594ce29c062464
SHA512 b74cf588abae2a7b957ef13503a083973d3d81fab8ec919ab4d0388c2cd0c5d0f060c5c1a1003aa28f09b5a309bc13504820adf27745806c6faef2332f01efdb
TLSH
T150C01251C107B321C05A03F42487DDADF1A4AF28D60E27484AF46E37DC35510D017256
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c251.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c251.TMP
Size 96B
SHA256 23071d943974bd51eb406809bef1f83cd45a1d82b468b448951d82be5ef19bd9
MD5 6a0b46e54e939594e5263a1075e2c966
SHA1 1cbfb20ab33b242340b6199b509dc2fc248bd0e4
SHA512 6cf51676f28282c8bc6895674ef99b328641359a8989a4828c53bad2e7848d45c412bf4d8e535b1973c6bb37e63f91903ca175d3fd59e6fde7f45730e1d04712
TLSH
T115B02202CC032202C08203B02BA0C0CC30F8CF20C2230202A3E00BA2CC3EAA003320A0
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13429012520926569

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13429012520926569
Size 22KB
SHA256 80d92879ba93b8194d89df6d269a57612cd00f470345a29ca6fe58584dc5eb61
MD5 cfd058d8f8313110e12b8de29c7f1975
SHA1 9739f86be1e0c0e1b2d771ff1459295061def493
SHA512 30f057042c2d42e1db02bc96cb311db6dd78284e0de35d02229a1249ebaafc8309b099613dfc3f7dc976dcf7d0526bc3f3f27e43d4e9e5f29cd2731ef4a8ff3e
SSDEEP 384:5GOq+UOlwCAL8PA8P5woSwmwnHMM9nEyHwAHRSAShGWAhZ8VHS:SOqvohFHVJwgftWoN
TLSH
T174A2D0516EE4043FE17F8A3D95F511F6BE35B51279D18E1E05A142080923B02EFB5FEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 088f2c051dd30a9041b6ec7d98f31b843cc4165b131aa7623e235bfbe66da32b
MD5 fb0039b45ddcdeb38944f9a14b99e7c3
SHA1 88064b5578383259126314364a602f91e0269e37
SHA512 cd9ea5cfa7498d4811645ce1e12ac15081779d4e0b339911bc8203d23b2223f3004442299346dc4a59bfa7ae5b706d3f68257749fbccebab5425497510f78428
TLSH
T1C6B022330000200BEB28033022C2CCCC33200C20C3C28C83E0A0833CC8233032FB2220
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 307B
SHA256 b11b1c7f4c4a89df0d9a1eae022987d623d3d61433d6dd53ca66a4cda1486d9f
MD5 f8bf27fb0a4fcb18f26c0195c5b2e7eb
SHA1 ad3744cc613d73538826ea1c293b48091a11a667
SHA512 3ba8cd4c51cad206bd2f3959116e24dff0a181013a99f355b448724e91f9e510f67750a5f6c44e7ff87afc8be8417d9a50d3d35920f5ef578dcb48c0986f0145
TLSH
T149E02B483F145106E8DEBA3416174B4B6740F061759280A7D8608FF45C6B5E16DF7CC4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 55cbf07a9fd9b9ba19afddc51057060efedb4967f11c7caa47af5798e408848f
MD5 01d60b0b75937402fe826d6efcd03db6
SHA1 a6f84d60200162dd97584990a3a9345ea22defb1
SHA512 ef5b9e46238d5581e31547f2a07912b5113a831b1efe7846c8eb535f18d4193c87ff8451f59b14155e86ab127d1fc5ac8345bd9d35608649fe40e4753dd54ddb
TLSH
T1D8E0D82929CD866E908941AB6235F30D99F7B402D6DDA4622F0EA240528AC04F292341
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 5f8f6317ba4381f318d7e30d1e21c769259ca806a21986a81afc4e29726cd111
MD5 1164d18ca10d5189589faaac8f05881f
SHA1 66ef1a5e17775c0f068cf14d5f15d98e42cc88c8
SHA512 3971c56adfaa0a3c3b66e0c7b42c7cff9c641206b7dd38c9e6b567533ee5a9ccfed5f5ccc9955245abd194515ac117a56861ac2f5217ee14d14ad502ecf2895a
TLSH
T173E0267A29CCC2BD4088C1674274B31E9AF9B80693CDB502670E51447180C04E2B1B80
MD5 SHA1 SHA512 TLSH

Submit Download

Top Sites

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Top Sites
Size 20KB
SHA256 f3bc5ab113bf7c8d2404f7b8ee9e033dfb2b5506b3c8ccade874eb3ac1ebb55f
MD5 e5a19d06a8c136579920d6afdb7f6f2a
SHA1 50311df37f778b547f5b3b8797ea6c9af9cc4297
SHA512 99e82abd398e151c67cff788dac776c93f029644e873ab51657de3d22add105044d88cc1c26f0a35bc1377b7651f0e43319ae4287883810d1c11e6525cb58624
SSDEEP 12:TL17CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSB1yF11s+ccogb62QccogL:TLVCZwE8I6Uwcco5fBB1MsmW1L
TLSH
T16D92D0CF2F542837E8B49B3DE2D741EC9EBA815CCB95EF9490545C22AEC0940618F4E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e35a4a60d7b026bbefbe9006e977a3cec2d63f1cb00e7fe8482869ab2adf8d71
MD5 a98f79d5392808556a0429df752600a6
SHA1 d3dbde0beaab58b9efe806240650e83f0351ced8
SHA512 cd42cc580b3d661f6d9249acfe531cf757ac0580be8af65cf1550fffb22aa9d4aa9c34c7ebfd86bc0a1a5aa6b4c7dbd7562be13e9895bf8596c80a5bcf1a554e
SSDEEP 1536:kLCyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:wQqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1C8C30237ABC21E335DD2CB74B9130FD757B644A99034D301ABBD2BFB688345565828AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c6356d19963fd4ef9999a348b4e00e7f4a90b69c47469b51aae644961dd36e45
MD5 6d68fb421cfc372d9f737ccd268c1d82
SHA1 bbc3e6066f854073a7b9a5d61f209023437e54ef
SHA512 02f2ec7c49a12602c40cac73689d1125d1887f84efed91cef92ac7a05b3d3f00cabc8fc23ec23757c86aafae845977d61d00413812fb17ad73ecf15e05d64d0d
SSDEEP 1536:RLCyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:1Qqfd7NtZL8cHQRZEQ6Sps9
TLSH
T182C30237ABC21E335DC2DB74B9130FD767B644A99034D301ABBD2BFB688345565824AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 90c933e43813ee64b62013d785bcd42be39ec47add3d23aad6c88e37d660e546
MD5 7393f50ea7af736f4790c792bc3a7123
SHA1 5965fb3aec708503ba6e04cc177b77bc156e0a68
SHA512 26212bc890e44eeb9b8e387a89e05462550f63c618404e80b936f628a9f8b78a036e4fdeb7dc16725e7e9bbb7379a2623e0159dce08eb39d59e0918b24d52a2c
SSDEEP 1536:6ryD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:4qfd7NtZL8cHQRZEQ6Sps9
TLSH
T191C30237EBC21F335D82CB64BA534FDA67B644A99030D301AABD3BFB6C9345164424AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 274KB
SHA256 a8dfc4bcc0ed69ef45eb888c74a00c8f7608bc388dc338be767ee1d2daece577
MD5 3e68676e61a5b3252196f7b9ac2a2bd5
SHA1 8eec36c97ce1d88b9df751057ce6fe9a6adc1e4e
SHA512 b754f2a2fb5e04516093ce933a72c961f7610d5edc20e360a88eef59f1b33cb1e171feb73300c40c1e78a80fe4e514fd82c520d8ca38458089c22dfa1b0fbdd0
SSDEEP 6144:Zdo5B8CzE/Nqwp0afMAt/4bFmSpQKVN+cuqZ/ZLW3Exf:ZdPo7QJSKguqZ/piQf
TLSH
T101541223DBD44E264964C620F227EFEDDBF610B99464B30186D83EEB79D748414D2E78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 5728f9493c0789df8dfe2330f8bf39a61cc28942916ad965dbc6048ef93b0ca5
MD5 9b06197c93b7f75cb09750e1287df506
SHA1 b20e2b795348da732e14d8539139101e56ed27fc
SHA512 8eff327dc05ed6aa10d65b150cdf791a83b3422446ce178b4af8eae84f4676c9a4a2f2ff82e0df8ab0652b45966e659f3cfebeea53e08e97f26d68bc466213c7
SSDEEP 1536:peByD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:ofqfd7NtZL8cHQRZEQ6Sps9
TLSH
T150C30237EBC21E339DC2DB64BA130FD657F64499D030D301EABD2BAB689345565828AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 158KB
SHA256 8e47376cdf080442801fe64c6fd7fd7f011733bad9cc5da9a69e7679e4cf333f
MD5 78ac95df44a0e151016e48b65b44c152
SHA1 5be903aae8bbd8d4b6d4acd56e51b7b5d4b00fda
SHA512 89903ed82b8747312907b0f6cf1b9f2397936c31e2d11ae626f4b123400398f73516beba9966bfadba3c85cec264b4c2f6c70d4b6f32acddf8950ba6c153de74
SSDEEP 3072:fuqKo5B0LjnmzvMy1qfd7NtZL8cHQRZEQ6Sps9:2do5B8CzEy1qZ/ZLW3Ex9
TLSH
T15BF312369B861F334D96DB60F6134FDA97B504A99020E2059ABD3BEB798288560C1DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 267KB
SHA256 be146bc177901ad23baf36c0f416c2df762b89b4192be9dea6a018baea5d0dc8
MD5 9d8ed9b93b4b2c770a8987cc588ac89f
SHA1 4ef29e74a934291f9882bc7cffc7dfd6624b6b53
SHA512 148aa8a0328bc616b9a1c5f4a79ff25c19f5722cfd6469e2f09a8c4511c4e914e0ca571dae4f186847d06bce36d84375c6d767d29aae46bf50eed11ac0b536fe
SSDEEP 6144:X5dPAc/kPNqwp0afMAt/4bFmSpQKVN+cuqZ/ZLW3Exf:X5d9/ao7QJSKguqZ/piQf
TLSH
T11A441233EBD05E265D74C7607517FFEE9EE61096C468B201D6883BBF24D30605992A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 267KB
SHA256 e6421a062f52f28b3e35354d176598957b3cb2237adb97d9dfdfb7e99f27ba66
MD5 39c2ad9a30f09e7f11ecdd6a63a6b8c8
SHA1 83a7b58a56b5d7eb7fc07aa5606aab5cc39ca701
SHA512 2cfad45ad03e52a827eb39d8d226975fabe5a973d10757da9e00a58a8a27ee5eebc75a05a0ff87b7c4a1238e258e0d8f211dfaa7816cd162c982b4ac7d1617fd
SSDEEP 6144:H5dPAc/k+Nqwp0afMAt/4bFmSpQKVN+cuqZ/ZLW3Exf:H5d9/do7QJSKguqZ/piQf
TLSH
T130441233EBD05E265D68C7607517FFEE9EE6109AC468B301D7883BBF24D30605992A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 2b9a473037627298403ad5ba7753897a5ebb509cc27130bbc8a633cbdc738897
MD5 d46a09ea01c9ce1a7d23d4c6d25ae944
SHA1 c4ff3b3bb783ecaac6d5161ec02c8a5606a1ae18
SHA512 18ba3d29aa377ee20daed7da2a7867d334b59878deaf23aff52bd857a32abb7844ffe343077b1d552bf0d724f47d9d569eff961971d328b173f4866587a2f7f1
SSDEEP 1536:p0RyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:ePqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1CCC30237EBC21E335DC2DB64BA130FD657F644999030D305EABD2BBB688345565828AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 85779d97811074b6e1633300f6dcb37db4652009cc40528f03a152c2aa634712
MD5 dee56ff5f2d4a788e4b9d27e01f27d5f
SHA1 7fc243dc0cdf5b0f95e183ef375e4b0bf4c91c92
SHA512 b521ed8f7c73740176a313766530bb7a0eaf48c52e71e470b621b5d3bdc99c548b96e93d8be58cf72b97b1a1f92c7e8243fa792f7b4266f3824105eabebe9416
SSDEEP 1536:pRByD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:jfqfd7NtZL8cHQRZEQ6Sps9
TLSH
T124C30237EBC21E339DC2DB64BA130FD757B64499D030D301EABD2BAB689345565828AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 155KB
SHA256 089da329102b54bc9fe913addd3218739a825f7b0c777b817330e331a278a032
MD5 48e775d10b6ab308fe41fb6bef0b126e
SHA1 269025ec7bcc161448dc54021ce020446227e9fa
SHA512 37a2b4d94565a3177fcdb944091677bfbec263b1593f812dea2d8f2601110bb580042cb771e370616cd731492304c7f9baea2a5e7540026767411c242c23bf5e
SSDEEP 3072:iKgrZxhZHrnDKqfd7NtZL8cHQRZEQ6Sps9:ihXzDKqZ/ZLW3Ex9
TLSH
T1D3F3027A9BC21F339D86DBB4B6031F8B67BB04AA5070D305EA5C2BF77DC24646543468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 df4bfa80af1eacbab41bfa7935ef9b1c77cc8851f4db2c5535373ff8f3a0e58a
MD5 270b0f7dd041d3baef137b309d6e6cf6
SHA1 8aa4246dec9a9393a8dfabc1e90d8bf7ea7c0587
SHA512 7db19afb0bce97bfe4e182d26212736a8d2d982907a1e424325ce0c3b87f5b5da49dd550a9226d2c97b49e6906b42577c0f648a7cd7cb2f91e950e6c62f07993
SSDEEP 3:MsEllllkEthXllkl2zEolgdKltl:/M/xT02zDgIXl
TLSH
T1514402066B801505C9101070542587A01370E89409125743646114126CC69A00C00104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 9173d078f9cf0a39bd24014a466c6d0b07d08cd3be0af2267691aec10017ec80
MD5 c34c0e1133e4ede598d44fdae47cda00
SHA1 68a87087280e879635acad2cce569d885c667dc0
SHA512 71d48a73c63e44a29b11e610b7ec59f23497f85dcfaba1e5f587e1d0a42f6f071f8cffcdd18635597aaf44b9f679c9e1168415695dc8a9d5e98e56cf08c7ed07
SSDEEP 96:QUcfHhg/co4uYC2D2w+2wcUD/MI0ze76K2uhEfDZXtdQSU5Bb:QUcpHuBS2w+2wdAI0ze76KQttZOBb
TLSH
T1E023658E33541499F0A1693EBA9118427D7C5B148B6F1EC119E008799CB6ABB70DF1BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 feee2506c8579b4a400c6b7e0dd32eb07a532912e614f542898b68f7a4441766
MD5 0010e45da1eef35915d34b4be0c0bde5
SHA1 945c8dae5708cf05b4b88cc4762f21dc813a4133
SHA512 da6f9ddca2018cb2c5332eccbdd4a3233ff0612c712bcd40b480e6330d25ca8f7e9bba8214d43f47d91a17bb27c54640f7564109eb2a062c461738027ec89324
TLSH
T1F3117637B39C8A21CC96153A409DAC1172B683C781AEDF9F6FC4D215A0BF984CB712A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_haig4dy3.u2h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_haig4dy3.u2h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

How to Install.txt

Path C:\Users\Admin\Desktop\How to Install.txt
Size 161B
SHA256 c3a8c042bb5ef6d9205870a8d0e2ed0c9cf80dafb9c401c1639e86fa57cea63e
MD5 0f75781a7b72fbb284ca8a1d98d9aa4a
SHA1 bb29b45c0a785aa11cd61dced2906622949bb89d
SHA512 7c9fba8e7e4d423af1bb1c9f145023ffdccd708328f13348542a1a8dc4b480dd08dbce192a5121ca49a8c928ceff8b78c7f6dc0a8af7095b2d502afda3133932
TLSH
T18BC0803B490B63310D2C56E4131D6385551D1149D65D54507C6B3C0CF75947551434DB
MD5 SHA1 SHA512 TLSH

Submit Download

TopazVideo-Activator.cmd

Path C:\Users\Admin\Desktop\TopazVideo-Activator.cmd
Size 2KB
SHA256 03f9a759afca51ad9bf7a1898a02d37106507775f14185438d8b3f9e2e4350a4
MD5 122a6d0aef21c9a85a99c3cbf1f7e65f
SHA1 a8e13b29ef08bc10ac76f1b04022b47ddf2969c3
SHA512 332db3dd6a221eac04f212003c3243748c463e3381fe99ad0281125e5a464ca183de58b8b8214280055434e5f35470cf0d1d9fbe124edb28241e91da2fe57eda
TLSH
T1B251313658518B358AEA2BF32B3FE1EEF563C38AC3191ED431ED814583165C84A9E894
MD5 SHA1 SHA512 TLSH

Submit Download

Topaz Video Activator v2 (win) - satvrn(2).7z

Path C:\Users\Admin\Downloads\Topaz Video Activator v2 (win) - satvrn(2).7z
Size 1KB
SHA256 db3c9486ea7daffbe2d59f3e706eeb9c8a9fca72849cfb2f044c7bb54424d526
MD5 0711f1cccedb02f19dd8d9ca902c5aa2
SHA1 bfaa56c92ab12d831d34b08d03552f6f6efd7f72
SHA512 11989c6312bae1535a898e259c6a1f633ca5486eeecf07bba061da1b7c58579f860442187902ef69369d94ff2e9d4760baafe2ef3fce4dd6ee222f5377872cd5
TLSH
T109310A192D82BE5AE30691B646B738CC6F26157ED708F9EA90499C8724C31B2691FD1C
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 372510.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 372510.crdownload
Size 10KB
SHA256 11fc3b6215d96c3179d6bf666af459f50323abb0fe29f7ea4815ebc3690a980c
MD5 3b109184c6a4e85447135b1e424c664a
SHA1 1c08ccee7178d48ccb85cf94230fa9fcbecec845
SHA512 4bfcaf893e9d3a83268fafcd25b0f19d801b3d4461b4c572e3a009f73ebcef7bcd7ceff9fb2d93f2b2db301d2da4715c55574adde800cc900a415a5c4afffa2a
SSDEEP 96:X8yU88y08cy4Gcm8GIRgehGORBQUBRhxYSgIvYVglfa:Xn8y08Tcm2RGOdBRYSgIvYQfa
TLSH
T10F32C4593CCEEF1BDA879B380D4AC99D02A2FC46CF66D14731A5F31F853DB00991020A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-422-0x00000227EEF00000-0x00000227EEF22000-memory.dmp

Download