discordrat | 109b28101b9448841de5ce07592dff3f1e52c8f0ce5ba7877eb242b8459eae04

Analysis

user interaction
yes
max time kernel
899s
max time network
895s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 78KB
Sample260722-krydjsfp4v
SHA256 109b28101b9448841de5ce07592dff3f1e52c8f0ce5ba7877eb242b8459eae04
MD5 bd7d0392fb5f1d17c5e5366df9ac9d4c
SHA1 bd5e6d254f5551637fca71ef221a62533c38cd74
SHA512 44e4b615b5cce3cfbfe690ba28a4310e00d69aa96e9698e71f668668a88f42ec23b1a4e49a606fe5c62b8818f3c3477f8fb23d70032b42ff5f5b57edca67e600
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+gPIC:5Zv5PDwbjNrmAE+EIC
TLSH
T19973B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution discordrat persistence ransomware rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTUyOTQwNzQ2OTUzMTY5MzIxNg.GrHSWF.vol8M8fWpHgdX0Kt_2eCObOFw17dORBTCexJjk
server_id
1529407350971301969

Signatures

Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Downloads MZ/PE file 3 IoCs

flow	pid	Process
113	3636	chrome.exe
131	3636	chrome.exe
148	3900	Client-built (1).exe

Executes dropped EXE 5 IoCs

pid	Process
1268	Client-built.exe
2956	Client-built.exe
2784	Client-built.exe
3900	Client-built (1).exe
2836	Client-built (1).exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 26 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
138	discord.com
142	discord.com
150	discord.com
162	discord.com
164	discord.com
167	discord.com
140	discord.com
159	discord.com
168	discord.com
175	discord.com
176	discord.com
181	discord.com
134	discord.com
135	discord.com
149	discord.com
172	discord.com
180	discord.com
54	api.gofile.io
77	api.gofile.io
139	discord.com
147	raw.githubusercontent.com
148	raw.githubusercontent.com
166	discord.com
182	discord.com
56	api.gofile.io
126	api.gofile.io

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp62CF.tmp.png"	Client-built (1).exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3636	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291838597665603"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4188	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4356	chrome.exe
4356	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	Client-built.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe
4468	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2836	Client-built (1).exe
2836	Client-built (1).exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4196	4468	chrome.exe	89
PID 4468 wrote to memory of 3636	4468	chrome.exe	91
PID 4468 wrote to memory of 872	4468	chrome.exe	92
PID 4468 wrote to memory of 872	4468	chrome.exe	92
PID 4468 wrote to memory of 3456	4468	chrome.exe	94
PID 4468 wrote to memory of 3456	4468	chrome.exe	94
PID 4468 wrote to memory of 5052	4468	chrome.exe	95
PID 4468 wrote to memory of 1104	4468	chrome.exe	96
PID 4468 wrote to memory of 5052	4468	chrome.exe	95
PID 4468 wrote to memory of 1104	4468	chrome.exe	96
PID 4468 wrote to memory of 3348	4468	chrome.exe	97
PID 4468 wrote to memory of 3348	4468	chrome.exe	97
PID 4468 wrote to memory of 972	4468	chrome.exe	98
PID 4468 wrote to memory of 972	4468	chrome.exe	98
PID 4468 wrote to memory of 2400	4468	chrome.exe	99
PID 4468 wrote to memory of 2332	4468	chrome.exe	102
PID 4468 wrote to memory of 2332	4468	chrome.exe	102
PID 4468 wrote to memory of 4560	4468	chrome.exe	103
PID 4468 wrote to memory of 4560	4468	chrome.exe	103
PID 4468 wrote to memory of 2896	4468	chrome.exe	105
PID 4468 wrote to memory of 3496	4468	chrome.exe	106
PID 4468 wrote to memory of 3536	4468	chrome.exe	107
PID 4468 wrote to memory of 4664	4468	chrome.exe	114
PID 4468 wrote to memory of 4664	4468	chrome.exe	114
PID 4468 wrote to memory of 4584	4468	chrome.exe	115
PID 4468 wrote to memory of 4584	4468	chrome.exe	115
PID 4468 wrote to memory of 4580	4468	chrome.exe	116
PID 4468 wrote to memory of 4580	4468	chrome.exe	116
PID 4468 wrote to memory of 464	4468	chrome.exe	117
PID 4468 wrote to memory of 1268	4468	chrome.exe	118
PID 4468 wrote to memory of 4356	4468	chrome.exe	119
PID 4468 wrote to memory of 4400	4468	chrome.exe	122
PID 4468 wrote to memory of 4400	4468	chrome.exe	122
PID 4468 wrote to memory of 1292	4468	chrome.exe	123
PID 4468 wrote to memory of 1292	4468	chrome.exe	123
PID 4468 wrote to memory of 3392	4468	chrome.exe	124
PID 4468 wrote to memory of 3392	4468	chrome.exe	124
PID 4468 wrote to memory of 3356	4468	chrome.exe	125
PID 4468 wrote to memory of 3900	4468	chrome.exe	127
PID 3900 wrote to memory of 4188	3900	Client-built (1).exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffcd740c728,0x7ffcd740c734,0x7ffcd740c740
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2000,i,4259343024219266025,1913596476821833905,524288 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,2553399434262427984,2170953848483179994,262144 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,17958728997962704618,821086507209526686,524288 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,9373758783931400847,4874098312375764724,2097152 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,10403785325424854606,1253318749489832882,2097152 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,3545609912756120696,5190353621565787553,2097152 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,15795599500197196292,3420575981292308248,2097152 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,2643557282683643166,15574146371481387509,524288 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5620,i,4025956745691196089,2347068751721528005,2097152 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4764,i,361950460793811023,5916084068585683184,2097152 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,12844997122118740516,5591793606609025014,524288 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3304,i,11286123852581309995,14248820515351213800,524288 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3212,i,17503016892291954200,1007684936212560145,524288 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3412,i,5745965810609940200,7120210172200674855,2097152 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5928,i,13885971408567431384,10117632731901786733,2097152 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5896,i,10211656852151845198,1573437545034367417,2097152 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,9624778834371468570,2788920471299442454,524288 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:464
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6112,i,3934524091141781759,14127702956792413769,262144 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,3586595517729356274,16371630396636360785,524288 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5932,i,3968094284902745910,9124786406766532469,2097152 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6248,i,3494523903312434243,3466466006998177271,2097152 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,14452223599202995578,7696378705068491856,524288 --field-trial-handle=2124,i,13830844893025640367,6418643759118409561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:3356
- C:\Users\Admin\Downloads\Client-built (1).exe
  "C:\Users\Admin\Downloads\Client-built (1).exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "$77Client-built (1).exe" /tr "'C:\Users\Admin\Downloads\Client-built (1).exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1712

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
PID:2956

C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
1⤵
- Executes dropped EXE
PID:2784

C:\Users\Admin\Downloads\Client-built (1).exe
"C:\Users\Admin\Downloads\Client-built (1).exe"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e0935abee62ef0f27232e4473b85f3e5a3b15dadf18fcddd72eecf81acc4f3f2
MD5 1e57122e217861f6448838be78a5e51f
SHA1 00b063bbadd3e8564cf2d9a9380a98b6fb7cc977
SHA512 0909fc3973db81dbb2f280623b3948b23eb8e1f5ca6cc59c059ac350f48abf1d5a5810437eca829f125974c7101ee51d48470dc8bed4361e76325fb7cca48137
TLSH
T119E02BAAC9209D6B18FD0729B458074AE66523172B508A6B3A3D96098FB96360596C1C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 768B
SHA256 96d221cefd6a47a38500414c8e3ee2770f27361d0fbb23c5e8bca855eb784130
MD5 a0fb47b69f6e33ba664d05f9d014d63b
SHA1 2400fc71ff7a5b24863caf62d500387ae6846004
SHA512 516ad15acbeffefa54c463c4a9d6174b51efec51ccba1ca4416475c12e9a7bbaae0d3c69814a3a3af0777ec4562dc8c5fef8a7e7fd9eb35b4334a93c0f871199
TLSH
T13301C911C86BB262C3045A34DBA8A1A833E3369F05C10C3E101AC5A878A41F0218BFFF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 e9933e80f12420ef123a36d84b77a41f104659e9430bae63d8a1ddb9db78a191
MD5 9b595ee7644de3f86f50206ecbb851b4
SHA1 564ecaff9dd836dcad05fa5a574f8d0b2a533de1
SHA512 9db43e3c0573297e9fb1d1cb3e61e8e8c2d10c4d4b5f132b15c13a7a92418eace595d501d31418057e717f996aad0210bfcc8d295ffecaf77e2c1dbe9527f2af
TLSH
T160C0222200A22002C38C03B08AF003233BF33CE000C2C22B8080A38C8E883B32308083
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0767b21ea35e73e60fc0aeeb808c4174e5f88845bbd84add559b1b6f9b890c4f
MD5 740b22563fdb70fc198911bfbb872a81
SHA1 0041d08f6a1ac9daf9e4a8d8e65a5fb7cb98fb6e
SHA512 1f735e8ffc8630b1e32486083479971c2d0cc90b977cc64e6c30ea848b0e718f495240bb97b3681e5b79fec25bda46951c76c4938c334963bc9cf48eb8909b6c
TLSH
T18F61ACF7D3E8856E8911A2F49B116F1FCE2D0924432C7D66C9E4AE1B53E3872D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e6c93ba224b143cd887d39389d31e0ea61f3bd73601588afe1ab7ccfc1e7b38e
MD5 3f0c684b5fd39c15f3ed4f8583269364
SHA1 e2852e95cbb3ab55025f7696bd75323679243f8c
SHA512 81d51b97311064f321c0ca6ce09a377ef99bdd29bed7da1b175296599749b46edad98987c6092c95ebc9924857493dbf721a2abf4dc94254a4686e420a6e037d
TLSH
T19771BEF7C3E8956E8911A6F49B156E1FCE2D0924432C3D66C9E4AE0B53E3872D20074E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 613a7273b6a42170dfb67c3ebfff7e872ef5f6813fad585ec523e5ab742d24b2
MD5 fd510e8017da96644bca7b16fa8a6654
SHA1 e4fafd68f71725ab65cb0a4ce666c60b686adafb
SHA512 9fe876964b16f21fb2ba50814bc49ff923641cb7db0ed1e45f2860b6e39edebf6995e165dab2a1f4ee1586ddac4c31699450ed9ea035f2335b43e14bb95cfd62
TLSH
T13B71BEF7C3F8856D8A1196F4EB146E1FCE690524432C7DA6C9D4AE1B53E3872D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7c747b6976eaef3442ec71b9987bf63bcba780a1a3f7b8d02fdde624d871bb6b
MD5 3af492be769e18bd88155e49fce650bd
SHA1 d9e861b72b2b13628ee0a69cb5ce4f8fdfb53c53
SHA512 4aad3273052c986d899891b1405760fa046396c1aaabe237dd6bcfaa50cbf4057923f63b9ab62ce4e874ad8c9460c6020618af9c47d0e55ba837f3982ced850a
TLSH
T15C71AEF7C3E8856E8911A2F4AB146E1FCE2D0924432C7D66C9D4AE0B53E3871D24064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ca7d4ea61bb4d541bb60ce620d5ccc031ebccb1441803fb55808f0ccec37d9fe
MD5 21de0deba09830facec7577d9a7a6c36
SHA1 ba69d3939757dc65c19a535bbe02378bd07b0909
SHA512 31545bfee01417397facd83a8c718ee9e8105b7c062210e08291cd90737ba2513dbecbc52bf7fcd02f51f4ce0d252fef3dfefe4d1786856f8456b23d524e5b25
TLSH
T12371C0F7C3E8857D891196F4EB146E1FCE690924432C7DA6C9D4AE1B53E3872D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 58c5dbc1fcab8687534ac989e8d25d6e552b43f2f1917ba2bdc93e0c3334569e
MD5 23ad9ec9c33dc60f997dc0bfe204701d
SHA1 493343037a66515c93569c8525039f22cd18ccc6
SHA512 07946e6dcb6f4a151ac0d896c6177ac0e21d1cfe98722a1d8084c9445f5f5fbed352639e71c3526d86750804735afc9c12744a0a38e041ca3c7b49b100be228b
TLSH
T187219153977DF4AB103C586B1E197C063ABBD432419158F4DFAE822DE0D59E72B02463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a0e6efa33f5c0b3c3ee5c5c237a03a273af033cb253c7fc7e950a185722f364b
MD5 3c6626c40083b9d5e8791428520c12b2
SHA1 a76f11ca022560f7b256220aa8cf37eaae8d29f6
SHA512 d632db9760626ed8b45a8d015a71adaf749cdbc585b9a4e8fca8ba682f1bf32c36bd5c6e92cf1cadef538f52c6389264d177bb44d6f5ee0c662a9b38ea79d5b0
SSDEEP 192:3RCCyTDsTpxv72ymhCPRpEtlYy95Hsb+WNn8g3YIpe4khX2t0kwzVyIsnAUgraJ:3RCCpTphQqXly7wjo6ehhX2t01e
TLSH
T19952A52FE9146577ACDAD21AF9127B53E7F6103265901E84EAFC8B1C19E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 056ce0ca77eef20a3f26301dfa3e674a55b2b2302adae7894ababcb78d8b3eed
MD5 7419b70947564e1c5d0f934c58e9cb19
SHA1 a853493053b385147941d604392b420a067a8bb0
SHA512 fccb9156eed84b884912e69e6cd97f7a82739a125925556b8b692b1128378b749cd01b6f6bdfe9e0f2d97305a8e72a06c76bce1ace2673784318aace18277530
SSDEEP 192:3RCCyTDlev72ymhCPRpEtle95Hsb+WNn8g3FRW4khX2t0kwzVyIsnAUgraJ:3RCCwaQqXv7wj/WhhX2t01e
TLSH
T14652B62FB9106977ACDBD22AF9127753E7F6103265901E44EAFC8B1C19E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 25bcd9d0035902e0a269cf0b61bbacdbcb278039f762ac5aad469aad4055cdfd
MD5 5056f6f01be08813920a3b66b7af2811
SHA1 ce135fbf4a7c15b9e679eea47d01056d3d74de73
SHA512 631c08bffc083385d6b76330f70ecc3af4f8ae655cb2aabf9007f84a28b7aa80396467a37d337168e31410f11a71d9bc840f356e2787611a8765923748451e48
SSDEEP 192:3RCLyTD9Uv72ymMCPRpEtlq95Hsb+WNn8g3DE/BWkhX2t0kwzVyIsnAUgraJ:3RCLkQQvXb7wj45fhX2t01e
TLSH
T13452B72FB9145577ACDBD22AF9127723E7F5103265901E44EAFC8B1C19E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f0f652ea34a2940495d51c8e63a7de36422685fbeda9d339314ee6e2a032f9f1
MD5 e1564296a7eb657742f8bbdf5749e41e
SHA1 7abf3fc0fbd2d297021775e9a3911db552800bda
SHA512 d5ba929f6d804809c9f93037e22090b13fde428a5ccb69cae22145624495565c54f403c7ef9cac4673f3fc14a3cbd138efb8c83d5838107d7633853531ed3e98
SSDEEP 192:3RCCyTD9Xv72ymhAPRp2/95Hsb+WNn8g0xkhX2t0kwRVyIsnAUgtaJ:3RCCg/Q8Xo7wj0mhX2t0X8
TLSH
T15442A52EAA14653BACDBD32AF9127713D7F6103665941E84EAF84B2C19E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 262990bfe5665d67b335d603b7300da643417a5e5f833c643c1a1e717e8566e4
MD5 d251e43602b085fe610f3107f73524a2
SHA1 4d347dd1f8345f45b9d42ac9c52d30b4d40ce2ab
SHA512 2b19a39330db90502647c5b762a83fb19470618353f02078887dbcd887a8758afe1058aab299b147e7d4740ae4144a766d7891f25638ec1f8c483c1243174463
SSDEEP 192:3RCCyTDaTpxv72ymMCPRpEtlYy95Hsb+WNn8g35IG9DkhX2t0kwzVyIsnAUgraJ:3RCC7TphQvXly7wjJ59AhX2t01e
TLSH
T1BF52B62FE9106977ACDBD21AF9127753E7F6103665901E84EAFC8B1C19E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5f367052d062c6505363fd87443a961e9f1d556ad546d869f567c46ef6e7e593
MD5 6550f40badd7fdeeaa7cbdda19474233
SHA1 aade9bf189a0875c688853dddef5de6335b77b21
SHA512 1c7fa7f524c62854663d955cd3f944df4b3f5384f4faed5b2bded51860674da3bcb4754da7b116b9d7f3b4e93ab031f2d9d6e7ee6b81566f5a8b6791abf21878
SSDEEP 192:3RC+yTD9Uv72ymMCPRpEtlq95Hsb+WNn8g3DE/BWkhX2t0kwzVyIsnAUgraJ:3RC+kQQvXb7wj45fhX2t01e
TLSH
T19E52B72FB9145977ACDBD22AF9127723E7F5103265901E44EAFC8B1C19E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d959aa9843f88ea3f5618a958a21fbfdb98d20c456915b74cf97f2a20fb98994
MD5 b51b3267ee1977d7afad80e8367a3a87
SHA1 25768d26bc7206b9b11e2bfd53b70bb9af40f142
SHA512 c1952468ca6b03b3cc0eced9c62b4cf53130ffd1cfdae1b3abaed9b3653a1d8e85d67861d3abfa8d038d95e67ac8b304537d96310fac94ca31214d388490bdc8
SSDEEP 192:3R5LUTD9nv72ymMCPRpEtlq95Hsb+WNn8g3Hl42khX2t0kwzVyIsnAUgraJ:3R5LSvQvXb7wjV4/hX2t01e
TLSH
T1CC52B82FB9145577ACDBD21AF9127753E7F6103265901E44EAFC8B1C19EB6CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5648cb2567dba329dd01b7a828a4a68a8808363da4ba4d046d8fc07bf07244fe
MD5 c36d249a4e9985f2229e20ac4a335911
SHA1 dec4479f475c50e978ac6f7007c127c420f352bd
SHA512 1353335b0417c56efa55e897217c0ceddfe799577fdd42a32067a4064bcbb2194ad06d077dfb446a6152b1a97a58bf77aa423e460c9bd8d77b19664d636c4407
SSDEEP 192:3RCCyTDeXv72ymhAPRp2tlV95Hsb+WNn8g34E21khX2t0kwRVyIsnAUgtaJ:3RCCv/Q8XO7wjL2qhX2t0X8
TLSH
T1A352B72FEA146537ACDBD22AF9127713E7F6103665941E44EAFC8B1C19E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3c4a554670096e8a6bcd7b9f4ca929f4c3c90911bb70dc4d5637a8925a35e311
MD5 68b5f8faebf008d0dd6b8b95f9e3a76c
SHA1 a2493f4be4bdcd8a3fff300b9124d378fdec99d9
SHA512 5d70cf31f7041a4361a70f3c7d003d81693b3e9cf7f824ae6d0233340e78dc89876ea6576e63c85841dc3f2680df8860cdedfeadba39e79aea562147e60e3620
SSDEEP 192:3RCLUTD9nv72ymMCPRpEtlq95Hsb+WNn8g3Rf3a8khX2t0kwzVyIsnAUgraJ:3RCLSvQvXb7wj13aVhX2t01e
TLSH
T15152B62FE910597BACDBD21AF9127763E7F6103265901E44EAFC8B1C19E76CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1fa9e91200bcab7a9dc3d420b19a07f93e6c104c6ee907ad16a3ccf4fccbf665
MD5 4b10f7535c70e80ce1368c9385e32913
SHA1 01fdc657e7e42648c70ad63a4617c55de655d920
SHA512 7650404f6da11c84e26cfdc98bc5fb1349b546b5c05a56884f7cc5bf0e2a07c4d2b5efed749b557285397470c5413a9a8aca103d810eb89e42ac42b063f5cd60
SSDEEP 192:3RCLUTD9zv72ymMCPRpEtlq95Hsb+WNn8g3DE/BWkhX2t0kwzVyIsnAUgraJ:3RCLSLQvXb7wj45fhX2t01e
TLSH
T12252B72FA9145537ACDBD22AF9127723E7F6103665901E44EAFC8B1C19E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 facd2e3c9f49b8c01520cd215ee88fe62f531cd1fc6a43fa8398f7b513fc4a77
MD5 179a8cb4f4e12d0d5279d50d5c316d90
SHA1 15c803a697f198554496753d07d1b307a601e895
SHA512 159563f411da7edd822a6acf060d606987fb44b0b49aa25fedb40279f3fba47046aae3a9fc9b701bfd517be2e3cf0831c536393b20fe4326ea1e6de5cdf36ca5
SSDEEP 192:3RC+yTDadxv72ymMCPRpEtlky95Hsb+WNn8g39IKLnkhX2t0kwzVyIsnAUgraJ:3RC+7dhQvX1y7wjNlLkhX2t01e
TLSH
T1CE52B62FE9106977ACDBD21AF9127713E7F6103665901E84EAFC8B1C19E76CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7ff3294c288046f03ee41e5c632890e49455ff8b96c0b8f9e4ed013ac9fb5597
MD5 a9f06be7c0917efa8475efacfc5a734a
SHA1 2db5d0fa6de256661101f2bd8a3244b22bf3488a
SHA512 8de7ce881e9604a9bfa6146451c05ced4b5dff511bc14ca317d0c71d1a9eea3acb95104053a4c26284753eb12ae8d8bb6bdfa607224c8b40484213e37d91c89f
TLSH
T1AEB0124090429502C04203F4514757D8B114AF14D60A270343F079729826160D019551
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587683.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587683.TMP
Size 96B
SHA256 21463b3629c13ccc3bbcc503c242f1f9f7d8c829a1449124a30fef24952ded7d
MD5 51adf66a2605687ae0288e5fb233c2a8
SHA1 cc3f66e2ebd791765df9eea56afc20bc2b62754f
SHA512 915070458479aea541d6a9414d98eb4ffe7f9d8387f2930254e7150457cfd950b68c09fdb49f1d3beca129a44f7d1a4dc5233761e38f9ce333722fc8f606fd49
TLSH
T1D8B0025AC2426213C04303B02D95B6E87160EF65D7031336E2F01EAEEC2666445A6971
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 d6eadb1a366407b166d149cc31379b0489606fe75fb3694d4b1b10faf1b7342d
MD5 5e39f99f906ab510c496381ade486681
SHA1 c822f2f5f970611d3f96e4d80a5d4b9c891308e6
SHA512 e44229f9a4e9a7be86a627a00e6745ab8839cd45697d846da9e3098097cd1c7d45fe010dd1c708316e64165c7d9b6b09193bbdaade317e8040536ec601115849
SSDEEP 6144:pCFpSdPuSqk1v9mpwwzW8FVxvCz66ND/qZ/ZLW3Exf:rPnv9m6wzxvxvCz6g/qZ/piQf
TLSH
T17834223A9BD70C374CD6CA34FE1276AE1FB90572C5B1D618282877EBBC5B4C22856498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a8e6b4fe877841a5e5326d8bdd5e0cb22f5e26d00e6a7bb1b257ccd2354bcdb1
MD5 02818b558f50f6a4cace71d96b794986
SHA1 877aba180151b7a3cbce15e769bcef3b88976973
SHA512 bbfb640bbba8a485dedf5f28a2a39f0cd0397df462d82d9631419986e01e7222893c47d913929d82ce1d8d36b7cee04a2cd97045e36e298d0cfa3dc5b4087b72
SSDEEP 1536:TSQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:zqfd7NtZL8cHQRZEQ6Spsk
TLSH
T13CC30237DBC21F339D96CB60B9530FD697B644A99034D301AA6D77BF6C83491644289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 8332ed75cfef9141b5108f0585e036ec51927bd8fa61de6bf5ee3e4dd29c1895
MD5 8b517597ee29eb30537a24672bee760f
SHA1 3fa93dda4d5d80512a8377a57b7cc961e7a14891
SHA512 5a708caea9c5814f4213ea6bd060e3e00b9ff74b90a0e282610152b660c59a8acd739b8d031c43db028ffeeec47071f2dcf37301d7ac9de5f4f9dd52a3717d5f
SSDEEP 6144:gWFpSdPuSqk1v9mpwwzW8FVxvCz66ND/qZ/ZLW3Exf:gFPnv9m6wzxvxvCz6g/qZ/piQf
TLSH
T1AA3422269BEB1C3B08D6CA31FE1267AE1B7904B1D5B1D7181D3877EBAC574C234960AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 e11bdf59c3e4b19e83a5d19234b72f3ecaad4495455a235db39ef5061ae63ac2
MD5 c62ea2736d720bcf2eef0f2be8f56a31
SHA1 b1c8a22020066327504b0438e7d4fa9fabc420c2
SHA512 59a2ad3d4d73b0d2e5eebe380152b9b9e49aea0e6027c6a9834094168311308837be31ac7d19415fab12718e8ef59a556ce25ebdefaa5845ebee3c8daea72170
SSDEEP 6144:RCFpSdPuSqk1v9mpwwzW8FVxvCz66ND/qZ/ZLW3Exf:zPnv9m6wzxvxvCz6g/qZ/piQf
TLSH
T1F634223A9BD71C374CD6CA34FE0276AE1FB90572C5B1D618282C77EBBC5B4C22856498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 c376b20eef449c164d46ceb4a8da9dcf555fbe50303a2d64ef4502453c99e1c5
MD5 ca8661e23b8a46807b0aa071a4af1816
SHA1 a16344291b4e37ea257c09f5818eb1d617376ed0
SHA512 2c8a06f585aad770ad93cb26730900df9f5f8cd6e1ced7cc39558b070f32d65fb29e104f701c03b4f31940fc915c01e5d608c2e364878fea52b2cf1af9fb93aa
SSDEEP 6144:1CFpSdPuSqk1v9mpwwzW8FVxvCz66ND/qZ/ZLW3Exf:XPnv9m6wzxvxvCz6g/qZ/piQf
TLSH
T1CD34223A9BD71C374CD6CA34FE0276AE1FB90572C5B1D618282C77EBBC5B4C22856498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 d8027bbdd21ce2c15f8384f5954e5b670c97c401ba58121102944c5a64e98126
MD5 eb46321a6ed9021284adc9d8dfff9fc3
SHA1 0867a5423e5149bdc7e2fd2421777ff6c9035b91
SHA512 894fd9b043a8229f9ba80b45adbcb9488064077a3641fbf955631c8cec79f7660ce25e4b4f4645319f5bc7917e0324bbcc78b24ef36c0a5cb03925f9461f0ded
SSDEEP 6144:jWFpSdPuSqk1v9mpwwzW8FVxvCz66ND/qZ/ZLW3Exf:jFPnv9m6wzxvxvCz6g/qZ/piQf
TLSH
T19234222697EB1C3B08D6CA30FE1267AE1B7904B1D5B1D7181D3877EBAC574C234960AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client-built (1).exe

Path C:\Users\Admin\Downloads\Client-built (1).exe
Size 78KB
SHA256 a966bad853bd45fa40621ac745c40770495f78ff8cf4686bf66879a84d4dc7c8
MD5 0d2ab9d65a2568c9906969a0a166bebd
SHA1 69c63e14773f5b77977e48d3dc9c03db46d57f1f
SHA512 d63fe59fb906ca69f48db23d86d48f6ce5e9974924fc3ae9c3c29750baf4df8cbe841f6ec3be63a675aa7adf843a2d264b13a5ad4e25ed6f247f9e3251c30ee5
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+fPIC:5Zv5PDwbjNrmAE+nIC
TLSH
T1C373B8C877AD8903FBBF5EFD147141524B72BB17E935F68D088C54E611A2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client-built.exe

Path C:\Users\Admin\Downloads\Client-built.exe
Size 78KB
SHA256 109b28101b9448841de5ce07592dff3f1e52c8f0ce5ba7877eb242b8459eae04
MD5 bd7d0392fb5f1d17c5e5366df9ac9d4c
SHA1 bd5e6d254f5551637fca71ef221a62533c38cd74
SHA512 44e4b615b5cce3cfbfe690ba28a4310e00d69aa96e9698e71f668668a88f42ec23b1a4e49a606fe5c62b8818f3c3477f8fb23d70032b42ff5f5b57edca67e600
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+gPIC:5Zv5PDwbjNrmAE+EIC
TLSH
T19973B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3900-467-0x00000272B2E20000-0x00000272B2E3E000-memory.dmp

Download

memory/3900-465-0x00000272B31D0000-0x00000272B3246000-memory.dmp

Download

memory/3900-466-0x00000272B2AF0000-0x00000272B2B02000-memory.dmp

Download

memory/3900-432-0x0000027298550000-0x0000027298568000-memory.dmp

Download

memory/4552-38-0x00000228F3F80000-0x00000228F3F90000-memory.dmp

Download

memory/4552-3-0x00000228F49B0000-0x00000228F4ED8000-memory.dmp

Download

memory/4552-0-0x00000228D9A50000-0x00000228D9A68000-memory.dmp

Download

memory/4552-2-0x00000228F3F80000-0x00000228F3F90000-memory.dmp

Download

memory/4552-1-0x00000228F4070000-0x00000228F4232000-memory.dmp

Download