053dce604a30beb849c85d3cf2ce55567ed0139eb1ca19dd7ce8b157c185922e

Resubmissions

01/08/2026, 00:56

260801-bacabathmh8

01/08/2026, 00:50

260801-a69p1sthle3

01/08/2026, 00:36

260801-aycqbaba447

Analysis

user interaction
yes
max time kernel
293s
max time network
294s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
alphares_x64.exe
Size 1.4MB
Sample260801-bacabathmh
SHA256 053dce604a30beb849c85d3cf2ce55567ed0139eb1ca19dd7ce8b157c185922e
MD5 d8fb8aa054c19f84f963b7ff47273963
SHA1 27d132fdb775e7c890f449a9269945c00e3ec210
SHA512 424b635af00d1807372b0a63f248a82fdf74b2093677df2cabc979d39893bcd0967233ef0cc7a5855c85bd846274abf9064257ed125dfa14867061fe8c7cc6c2
SSDEEP 24576:MQ7pzfOKGmGOSxTAlOy8Rft9RNt/4Q8KzOUi01:l7pzfJGmGOSxTDymNPzii
TLSH
T171652957E2E254E8C5FBC13446D2B772BA20B82D41247B2F6A5CD7212F32E509B1FB64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
310	4684	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
1448	ByteBreaker V2_54596887.exe
1124	ByteBreaker V2_54596887.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
168	sites.google.com
169	sites.google.com
215	discord.com
216	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4684	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300193823533438"	chrome.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	ByteBreaker V2_54596887.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\OperaGXStable	ByteBreaker V2_54596887.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\OperaStable	ByteBreaker V2_54596887.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	ByteBreaker V2_54596887.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\OperaGXStable	ByteBreaker V2_54596887.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\OperaStable	ByteBreaker V2_54596887.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	ByteBreaker V2_54596887.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	ByteBreaker V2_54596887.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
1996	chrome.exe
1996	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
2528	7zG.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
1124	ByteBreaker V2_54596887.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4528	4924	chrome.exe	88
PID 4924 wrote to memory of 5028	4924	chrome.exe	89
PID 4924 wrote to memory of 5028	4924	chrome.exe	89
PID 4924 wrote to memory of 4684	4924	chrome.exe	90
PID 4924 wrote to memory of 5000	4924	chrome.exe	91
PID 4924 wrote to memory of 5000	4924	chrome.exe	91
PID 4924 wrote to memory of 2952	4924	chrome.exe	93
PID 4924 wrote to memory of 2952	4924	chrome.exe	93
PID 4924 wrote to memory of 4580	4924	chrome.exe	94
PID 4924 wrote to memory of 4580	4924	chrome.exe	94
PID 4924 wrote to memory of 1844	4924	chrome.exe	95
PID 4924 wrote to memory of 1844	4924	chrome.exe	95
PID 4924 wrote to memory of 2720	4924	chrome.exe	96
PID 4924 wrote to memory of 2720	4924	chrome.exe	96
PID 4924 wrote to memory of 3412	4924	chrome.exe	97
PID 4924 wrote to memory of 1064	4924	chrome.exe	100
PID 4924 wrote to memory of 1064	4924	chrome.exe	100
PID 4924 wrote to memory of 2252	4924	chrome.exe	104
PID 4924 wrote to memory of 2252	4924	chrome.exe	104
PID 4924 wrote to memory of 3972	4924	chrome.exe	106
PID 4924 wrote to memory of 3972	4924	chrome.exe	106
PID 4924 wrote to memory of 3308	4924	chrome.exe	107
PID 4924 wrote to memory of 3308	4924	chrome.exe	107
PID 4924 wrote to memory of 1604	4924	chrome.exe	108
PID 4924 wrote to memory of 1604	4924	chrome.exe	108
PID 4924 wrote to memory of 4692	4924	chrome.exe	112
PID 4924 wrote to memory of 4692	4924	chrome.exe	112
PID 4924 wrote to memory of 4500	4924	chrome.exe	114
PID 4924 wrote to memory of 2896	4924	chrome.exe	115
PID 4924 wrote to memory of 2644	4924	chrome.exe	116
PID 4924 wrote to memory of 3920	4924	chrome.exe	117
PID 4924 wrote to memory of 3920	4924	chrome.exe	117
PID 4924 wrote to memory of 2176	4924	chrome.exe	118
PID 3972 wrote to memory of 392	3972	OpenWith.exe	123
PID 4924 wrote to memory of 3740	4924	chrome.exe	124
PID 4924 wrote to memory of 3740	4924	chrome.exe	124
PID 4924 wrote to memory of 2716	4924	chrome.exe	125
PID 4924 wrote to memory of 2716	4924	chrome.exe	125
PID 4924 wrote to memory of 8	4924	chrome.exe	126
PID 4924 wrote to memory of 8	4924	chrome.exe	126
PID 4924 wrote to memory of 3004	4924	chrome.exe	127
PID 4924 wrote to memory of 3004	4924	chrome.exe	127
PID 4924 wrote to memory of 1588	4924	chrome.exe	128
PID 4924 wrote to memory of 1588	4924	chrome.exe	128
PID 4924 wrote to memory of 3304	4924	chrome.exe	129
PID 4924 wrote to memory of 3304	4924	chrome.exe	129
PID 4924 wrote to memory of 4732	4924	chrome.exe	130
PID 4924 wrote to memory of 4732	4924	chrome.exe	130
PID 4924 wrote to memory of 1996	4924	chrome.exe	131
PID 4924 wrote to memory of 728	4924	chrome.exe	132
PID 4924 wrote to memory of 728	4924	chrome.exe	132
PID 4924 wrote to memory of 4432	4924	chrome.exe	133
PID 4924 wrote to memory of 4432	4924	chrome.exe	133
PID 4924 wrote to memory of 4020	4924	chrome.exe	134
PID 4924 wrote to memory of 4020	4924	chrome.exe	134
PID 4924 wrote to memory of 436	4924	chrome.exe	135
PID 4924 wrote to memory of 436	4924	chrome.exe	135
PID 4924 wrote to memory of 4496	4924	chrome.exe	136
PID 4924 wrote to memory of 4496	4924	chrome.exe	136
PID 4924 wrote to memory of 5032	4924	chrome.exe	137
PID 4924 wrote to memory of 5032	4924	chrome.exe	137
PID 4924 wrote to memory of 3032	4924	chrome.exe	138
PID 4924 wrote to memory of 3032	4924	chrome.exe	138
PID 4924 wrote to memory of 3996	4924	chrome.exe	139

C:\Users\Admin\AppData\Local\Temp\alphares_x64.exe
"C:\Users\Admin\AppData\Local\Temp\alphares_x64.exe"
1⤵
PID:1996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc00e3c728,0x7ffc00e3c734,0x7ffc00e3c740
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,11860088704713643784,4807960488697268920,262144 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,1839643394395749877,878381221594128958,524288 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,7908947964397871610,12997127256878332438,524288 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2380 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,3994132496290032998,8858398268036650232,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,10292708578114850818,2771020675834392229,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,13952901400653236999,8141537442847768212,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,5260982006350970532,2374160249239694407,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,2977033396015302473,10734534492870261583,524288 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5812,i,3248180100869693580,14812715678629961056,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3344,i,6740434788534684912,10572758200438062199,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5916,i,5025732296107477913,565605299169182078,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5632,i,14507772238176127440,14546188865718715952,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5616,i,12782862170448123528,16505915889419802307,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6220,i,9785569841608125028,7444255216969412153,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3520,i,12014717297477390733,6464017612322888944,524288 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3320,i,3845224893457186445,1200183667758037007,524288 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3480,i,6837895010552533903,6747431079351752254,524288 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4316,i,11242989701969964998,4510192658798214813,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6356,i,11624614450361278700,10999269892252917068,524288 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4544,i,12391154558790889361,16070316768631963697,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6672,i,11252958818055320801,514414752888977426,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6512,i,54653589619784635,6756387361446073527,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5836,i,6145222437244139434,15581456343001245983,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7092,i,15920210929403784186,12382298273141890623,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2688 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6532,i,12828626330606372559,17377612343988144015,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6824,i,13916266605360704483,3433937992897484369,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5824,i,11583690081958649248,1343677298565137198,262144 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6840,i,16174587631187863170,2519218782168976925,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6884,i,5083780252783565727,11025619461715270549,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6808,i,2184395803242322285,248572779200837841,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3324,i,2066796420100865098,4874635415422842728,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6508,i,10801489584040263111,4747497436288216298,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6908,i,675585920379378893,11844099147411191747,524288 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7036,i,3726410630438612400,16890927573582219847,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6532,i,5324973125114391900,5171138094077722124,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=3552,i,6286473387248043322,927977458999761103,2097152 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6684,i,14933955182351512234,8701874754277983372,524288 --field-trial-handle=1908,i,18031232591233877535,901953730808488096,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:2916
- C:\Users\Admin\Downloads\ByteBreaker V2_54596887.exe
  "C:\Users\Admin\Downloads\ByteBreaker V2_54596887.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:1448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4848

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\fffc5da33ab43a787a1126db58901913b0019107c9bcaf4c7cd40a793787691d\" -ad -an -ai#7zMap2846:190:7zEvent23414
1⤵
- Suspicious use of FindShellTrayWindow
PID:2528

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\fffc5da33ab43a787a1126db58901913b0019107c9bcaf4c7cd40a793787691d\fffc5da33ab43a787a1126db58901913b0019107c9bcaf4c7cd40a793787691d
  2⤵
  PID:392

C:\Users\Admin\Downloads\ByteBreaker V2_54596887.exe
"C:\Users\Admin\Downloads\ByteBreaker V2_54596887.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 594a17a7a4e9a91f5e36b7514db001dc93b0ada41e777d8563be52d479cdb90e
MD5 c4d18b2f3a974b3acc196359200b2ca6
SHA1 68a53f858bd081d33caf8f725f2f7f847b60cb3d
SHA512 46810ecaf77299e2c292923c5ed8bb8a647d4c3a5b1bd5cb94eb472a839165b20c3c1ae2ebea135b7d51f20af76249b0d948e0de3ae4aed03ff328c92b731e13
TLSH
T10631E95E5EB23B51BF401E1625D2DA3E7CF5ABC09C6E001B627DD8E715003A63B46819
MD5 SHA1 SHA512 TLSH

Submit Download

75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA
Size 1KB
SHA256 cf381739bb1e98c86ea7dc55062989ef11b408ec4d7b1f525bcae8056ee40166
MD5 933ff597cd8d9d72d13dd0e992f25b93
SHA1 3636578c6a861c30af1509145ad645f7f5cbb581
SHA512 b1112b2ff3c4e7e18e78bf12de3737d98e255785efc52ba68ed018f2b7b73dfbf7c70a7948d9947983425a337affa83e3919da3c971f93378fff4057800ae0a0
TLSH
T1CA2177E25F6C68B1ADB66E9954E8C23ABD30F1D9ABD24C73A93245731C483731B0805D
MD5 SHA1 SHA512 TLSH

Submit Download

AC4E2962244A136DBC0532A10184FEF3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AC4E2962244A136DBC0532A10184FEF3
Size 359KB
SHA256 832429caf5989da7d4990d7b5537568bf2e3f1e75bbd92392fffc3c77ef8fcd9
MD5 6310c8979020432cf88a98b8c190f650
SHA1 f610487aca4203610a7683d2e286272639de4010
SHA512 071b10b9608838c7b14208c89f2413a32ac787d8fc9226cdfb75342e68ebfdb39b0230bf0f674021de0be258adf44f05131893d4d8c9a945b08b8ce8056e52ef
SSDEEP 3072:ISVU6pmRrDqx0C3eep5XxvLl0f/fRakL5F68yIrI4D6Gqzq:ISVU6pArDEp5Bzlfs5F73s4LF
TLSH
T1BE74B36C4454B67798066B34CADB9DD3EDF693811B99C01E86712F064420FEB8FE72A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 1KB
SHA256 c4343fd68fc8ebe6c1970d39c19020531b2be0ff6f80713e87b9076b2cda5568
MD5 2ab9387e2f34ddb408cbcea0c9bdcbd3
SHA1 94822af9cbb8d2fc27de52046193cbdf50c90a9a
SHA512 52a7540b09f9313d6304b30d67ae2b76abdd793e8c9045a09a916673c9907e44b2e6cfbbf55255ba4b8e44c16f179fda863dc3dbff0231f610906cbdcf7a394a
TLSH
T1EF31B7EE5E195944BE85BE505F8EE33A1C7127E9B8C54C36F428C1829CC87F27D8802D
MD5 SHA1 SHA512 TLSH

Submit Download

C1FCA6D61D8F4CEC04EBECE6E4B83B12_5864C5D103AA2977DAA3610A2E65E58A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C1FCA6D61D8F4CEC04EBECE6E4B83B12_5864C5D103AA2977DAA3610A2E65E58A
Size 472B
SHA256 145aa105f28102907793b5c647dac0e7c4a153add0d9ab25bdca37584553e42c
MD5 b8a047aa62c87ec41453f01e5a7f78ae
SHA1 c4dbb5ab1dbdfed243d3d0d5887539c9d1dae55d
SHA512 d6993a1d5504583618815c6ad189d8b827cc410464c2aa552e14f581fba7983e0df7f7e847936141c0e7973c1ffe6a717aa461012daac3daa868aa7654064446
TLSH
T1B3F0DC6B03FD9CD13C3A8D8527FAEC70340CB0DC0C9408BC14692AADD203BEA061A86D
MD5 SHA1 SHA512 TLSH

Submit Download

D1BEC81CCAFDC823A062FF26A89A6B6D_49003E2DFFA186EC4076AAFA80AAFC42

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_49003E2DFFA186EC4076AAFA80AAFC42
Size 471B
SHA256 4c7be9b6cdd1dadde7249f55336767152139a6abad96c0fd8a7494a22228af46
MD5 220d1177a52397778fce4b8c26171514
SHA1 4e0491af6dbad80fd0811cc4089eb79ff59aaf53
SHA512 6a11fcba9c5af9284b2573a9a6870f2f41df249b852fc3cd2da24e6d44994fd2eae019057efee26e4a80ae252ce55c077fda8be722c4742728717ec3f1e30d2d
TLSH
T130F02335B8F0F421B51FA8380CF8707E3422A51B38A35E3430798AE52E8C26A1817D4C
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 0fa5d88c52e2be597f960a0443489b73ec6dfef12f681a63b6f25d86b1056257
MD5 d8499618cfca98a0c467369a1caa417f
SHA1 7c26c1b47254aaf1cbeb20f9ff3769348342d0bc
SHA512 47a3e86142d2d7be66747b13d26fbc59f2f1ac368fbfb0e47450f0f3203e0640097260c1dd48d9f01df0a300ae1519797d5fd01947db99f72a5d8f0b0d3239ef
TLSH
T15CE026082D79423CFA30D93E9BCE796717AEE215340502F01BA44708B70BE416E9ADB1
MD5 SHA1 SHA512 TLSH

Submit Download

75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA
Size 438B
SHA256 304d67af2e48375962832b52ee0d5322e0289f531587cd17816c08ec2ca1c823
MD5 35bf4f41bdc65a798810e548349dd07c
SHA1 bc0a54ed5eb6cfa37a0ad3ad5e74b88c8ffd89ff
SHA512 d7a7f1d1b87545733d5d1e1b41ef22b6eb4b9b1cecd7b3c7a54a0447f6ff278b7a0f5a5c0c2205ceb4774b2bfbb6d6676eb4e17ed304deef7d95313e3f0d6572
TLSH
T121F06824EAFF821EE236AD7A8BCE6034D83AF773044A93B419E2570D3785C419C62617
MD5 SHA1 SHA512 TLSH

Submit Download

AC4E2962244A136DBC0532A10184FEF3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AC4E2962244A136DBC0532A10184FEF3
Size 192B
SHA256 e60056bd52890d5c370e9cf99297cfd3dc3a48ef36ee3176208510798649cfc7
MD5 80971f80ef7242b6b7cf04d654f1e6a3
SHA1 e0781e30b13c06ab563493b05a2c59d20b3f8146
SHA512 72b1443137c14edef855db2e8e6d9e30ece7428f499ff6655e042f0ddbf3f309dd0ba711df89224b859e4f4637be70f4be77194e2e4d7f78a1cd7c12df6823ac
TLSH
T109C08C046B1112A2FA284D3EC874772267F88619CA8697884B74013C24AEA07DC31D19
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 432B
SHA256 0279e31a1067c4c975b1fe3865c2d2c491358718a1587b71086a8e567cd5200f
MD5 1212a094b2d42c493a5ec52582318f79
SHA1 f3aff4ebbf1cbc74bdd543b8df403bbb9e6a31f0
SHA512 b30fc6d45eaffa45e9eb14708188366a570468a852a3c458898e204e62a58b7170290f163624918c8a9433601813119c0eac3330b44a7dbc4c048e79bf9b3df6
TLSH
T122E0F12011FE8308F5E8BB390BC93803F077F162400C77630A80571075098400C30E3E
MD5 SHA1 SHA512 TLSH

Submit Download

C1FCA6D61D8F4CEC04EBECE6E4B83B12_5864C5D103AA2977DAA3610A2E65E58A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C1FCA6D61D8F4CEC04EBECE6E4B83B12_5864C5D103AA2977DAA3610A2E65E58A
Size 418B
SHA256 c4ac0b34c3e4d54a0e3d09bb1fb01c278cc9ad714adb12396207ab765862bcd9
MD5 7ae1ce06cf4a0636a3e1b8c28609a68a
SHA1 55077e194c18953e498052b584e2076d4a63c9ef
SHA512 9fc745fc26c6614ae82d04c8461b9ad10d1a70d532b17dcf7b1d05137cb33d3093158884c954684d8cb468ac68c564ee022d6d7ba42d2d0824836ccc0b2a15f1
TLSH
T1B2E0D81C32FEC00DF6A1D97B87C567514896E165601513F106F1870C67499426DA3AB1
MD5 SHA1 SHA512 TLSH

Submit Download

D1BEC81CCAFDC823A062FF26A89A6B6D_49003E2DFFA186EC4076AAFA80AAFC42

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_49003E2DFFA186EC4076AAFA80AAFC42
Size 418B
SHA256 e1c4f00688cf73136aae8fabd7e363e0377219dce0add2bb1dc8029fdae2d3dd
MD5 5f1a98f0d862b5b68899d776c959aaea
SHA1 4a50aa58e36a09ad392093fb9cbe1c6ef9073854
SHA512 ebec76637e3cf2a026318f2ca5632f14664c05f8d1b2fca3edf4a5c4c64a103a2ecaa5ecdc4d560a4c0772b0e089f95232a47b945dbffb800562a51394fc5658
TLSH
T184E0680422FF521DF576A9F943C96433E969E26B5900DAF12E820344A704A00CC16828
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bec28a1241b7984ba5193e18f23debdc10cafa387e8ee34a67710434e58955e9
MD5 82eed2f4d4319e8109c0a61d0772f568
SHA1 0432828eb543b646fe4d67859668ae0a203034f0
SHA512 d821abad23811003f387917e96315040297cf8ce1ae38035eee3b5a8e207b16d2a52f895f92a21d5c0cef7cd0f77188de886e34fb81aae7f31d931f6c8a4bba1
TLSH
T17AE02B6ACC25AC2718FE471951944B46E750135B2A915D1F763E620CCFB062652C6C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f63491088dcc0f8f817eb2284b64d94d4f5667d9e1b202613d88e0a67a9b0b08
MD5 edb06e7d37f69870ddb6ee07326b74c3
SHA1 03836336be762ed19cdb83847385ffa51fa53550
SHA512 9546d6aefc50bcee072d7a033044e81b4fcafabc25103ee94fe5f95d882bd08420db8dfff8bedb22f8b690ebf4d3dc1a99f5dfd1c71b5cf97f083ff1a7c4958e
TLSH
T18841764805D9A9A2CF62D533BD8E0E8F3C12D605643967C761D98044ED7F6E1D1B48E6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 c057928bc97fc7e98af4823ff892932e3c483ce0da2d96505673f2da54387e12
MD5 31c6f2013117fe93d04decad6c288288
SHA1 b7a1a01bf30a6e053b0d33ec41bf5e8e597a96e5
SHA512 608e53f8b031337529b71331f7a849c413580202c8f2154531f5535d4305a7569e25a531357704aeb48364c40a55cc78581db4a85c4b1cbfc73841a994216d56
TLSH
T151F0AB443162D8E1CFB0CA714ECA49A80C090B264E40B3DBB4DD1258A585575A4F8C4F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 409751d604ecbe7679d57568778179366e4c5a25b5c892c81060779695508a8d
MD5 6c99e23285220bc59b3d1f9e9c5ffdc0
SHA1 8d68ec723354ded5589373c93dfdfcd96e59fab8
SHA512 b9a52c8b881ac62742636fc699416b218d4571b0722752a53683f1bb09311a2ad6371bc810fd47e7ac47c5326e1ca17e4db51dcdf5518f205ba06d3194e673a0
TLSH
T1AC4195490ADD69A1CF52D433FD8E0E8F3C12D605653D67C761D89004EDBF6A0E1A0CEA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 2b51db8fd41e20e77b68c9707e983054bd94d174bc943aca4693e90150a45a7d
MD5 71c2e0fb21b15ca66f51e64007d76fad
SHA1 1f6b42253cdb7e04d3ab79f431167a187a7fc356
SHA512 dc1019858032a17ad86ead1e94afe19f3023c15f0044ca345182a9c5525037e930d534dfde19fb38d93d6bfed9cfa4b1b91ba137edf80b15ee69fc8a45c61888
SSDEEP 96:DoJ8vSylaaSHxlD5pbF+GNP91iCr54hlK:DoJ8vSylaaSHxlD5pbF/NP91iCr54hlK
TLSH
T109C1DFF7C3E8862DC91152F4EB116F2FCE290A18431C3C6AC8D5AF5B93E1972E25524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 a945f7005462817f29d0e30d18e1c15ae8d11819b56a75b0cc371b75fafd1cad
MD5 71b60dc6bf5dda5bb967fecab5018e6e
SHA1 34b93f737ecca9bb7a185c8df80a819cf44e83a2
SHA512 5b2415b6d1526d36685cba907dfa92e40baff77318991e7d7695a8593aeef932509413dd2dbf6eab741347832de3fd38d98608ba9cfb30f557d6349bf2df6397
SSDEEP 384:DoJ8vSydrSZMJZJ7e7w7gnFy0aaSJPCr5mBOhvDvag129IrYav0fkNwetn7W747M:VzNASY7zg0jIqbYZxPMKmy96UGO
TLSH
T13C726DF7C3E8862DC81156F5EB156E1BCE1A0928831C3D2BC8D5AF5B93E2472E24564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 c4172128b183d4b8b90b29a1a9ed01120f4454e8d3abd69bf81706664358a06b
MD5 c61ff41be3990215030bf91b79089ce6
SHA1 41468ad9846179efc1a508cf110ae2e55960318b
SHA512 e649dcd8af24a942f2a7cc2cf5f36ca67dcaf31758c611e847c0db45d1e5241b8721be6a0b775972c8cf4312077bcd6a89759416f91ce949c5d286a4ca74b6e5
SSDEEP 384:DoJ8vSydrSZMJZJ7e7w7gnFyoq7T7Y7j7s7Cd7yW4aaSJPCr5ThvDvag129IrYai:VzNASjPK/mio7zg0jIqn8Fy968VM+Wxj
TLSH
T185A25BF7C3E8862DC81156F59B156E1BCE190928832C3D2BC8D5EF5BE3E2472E24564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e52779cb7def2aa09bb210103e29ef05e91b08c9f8d1e73be0ec79f45865b424
MD5 d834eac03e1a8f59794aa5d63b1f4368
SHA1 dad4e9d1e8e2ad0995fb1bce37651a2dbeed9551
SHA512 5b883456f0277e1f936bdccca2a45b9dc061ab5086c51b8cbaedd58a934fd5afba045e24ebf27b6fc8b30ed180466e69870a6670566be0563751fc87cc93c27e
SSDEEP 192:5R2cBzR86eorAv7spAPRp22m9C9wHsb+WNn3k4B22sLPkwkabfVyIsnAUgtaJ:5R2mzRBgYUX/9Kw0L2SPEC58
TLSH
T15452E52EF914693B5CDED219F9627B07DBF5102122942E94E6FC992C14EB9CC322742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 32249389a4dfd6d8f9a94d18041adaea81b7f4022ca96ea6b4f09dbff361702a
MD5 1d31df75c343f78d9632f3d18c5cd756
SHA1 86f96a8460602e5ab14459162c5f6350d9f22e20
SHA512 21233871ef927bbfd645837a026364aa09eaa56dda1b943171e2322e6db11f46710ea34530d5bfecaa3a91b14060023b26886948d7f7d951abab4f64bda666d2
SSDEEP 192:+R2cBz986elrAv7spaPRp720xnBJbszzgynDWx9wHsb+WNv+EQTO2YkoX+l+h9EZ:+R2mz9kgYmXS0uOxKwvgIwqELPECue
TLSH
T15062D56EB8202A7B5DDEC629F951BF1BD3F2202125D01E94AAFD9D2C14EB9CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5eef6296ab64c86ed67b04eae007d1c8a5a23b2073b3149c7bc723c594497bd1
MD5 4894e791849d4dafaa2edc960d58cde6
SHA1 b0d53f7c7347fd694a69f19cac188d6db48590e9
SHA512 040d1af2fedd3b0061e95cc4d3bc5b8738131fc273971e0383ff0e3ff112c74bb821b2d7c2a19a0112e9fa36d51e84a3d9e649a6f670b1a84345db89d63c146f
SSDEEP 192:+R2cBz986ePrAv7spaPRp72/BzzSWx9wHsb+WN1hO2U+l+z3n7WNiLPkwkabWVyr:+R2mz9GgYmXS93xKwLL6X7WN0PECue
TLSH
T1ED62F66EB8146A7B5CDEC629F951BF17D7F1102122902E94E6FC9E2C14EB9CC3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 3565636c15d0389464fd795d07145a47f6f62a0835b6b422d4096fe552afb696
MD5 93a266b10cb146362bfdefb787e3dd93
SHA1 5afbc070e2999e4ddc869c325ec2f842aa94dec9
SHA512 c0b71b68547ce223dab36d4b0fc6d281a833de231a3953f769ef04a25f8f9378ff7d210d0a1441c19b208ed8aad8e0c7e434ba8ce3a84536f7efdcbf7fc11d8b
SSDEEP 384:+R2mzUkyYmXS4GtOxKwENgghwqEmPECut:lmzUk/wtxKwEqpCw
TLSH
T15672D5AEB4202A779DDEC629F911BF1BD3F2202115D01E94AAFD9E2C14DBACD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 4892f17d077219a57db1e27c2671551df4494986cd64246466830bc4c7eb77c4
MD5 55ba74b6511bb933e6a24f8a60f31c73
SHA1 9c8aa5db949203af1850213712d065eb8c1b71c1
SHA512 f051b25ada3e1055a96c600ad0d76acf89dea7c76ca7a4e9c034f70a3f8a05b85f9795ce99f5fde0a91b732303fc7071aa83c6e8b06e6e0140d238650403b29b
SSDEEP 192:+R2cBz986elFAv7spaPRp720xnBJbszzgynDWx9wHsb+WNv+EQTO2Ytrl+l+h9ER:+R2mz9keYmXS0uOxKwvgmWqEgPECut
TLSH
T1F772E56EB8202A778DDEC629F911BF1BD3F2202115D01E94AAFD9D2C14DBACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 d062a19a90bd2825744c657fd6e915abc843615d4fdf712a322c769a0b2d56fa
MD5 e7698ec1574bfec88ba4341bb52dde71
SHA1 d64b46457ac9f8735a9d598bfe874057eab4cf64
SHA512 b2bb44bad88622ba25f7eda674915d799fbd65ea6c706ce9bd57bf07cce25a864971f7c69157d64ad7fad6b9dd55622538254e20e7690365af87e82056617960
SSDEEP 192:+R2cBz986elEAv7spaPRp720xnBJbszzgynDWx9wHsb+WNv+EQTO2Ytrl+l+h9E6:+R2mz9kjYmXS0uOxKwvgmWqEgPECue
TLSH
T19462E56EB8202A779DDEC629F911BF1BD3F2202165D01E94A6FD9D2C14EBACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 f167bffc4d5a018976d146729b9136c90e24e9451daeeea868ab5e175e26e041
MD5 0f7ad8070c016f90ee56f5fc62ca0aa2
SHA1 78b0875d9c8c3fc6f8b238ffe402e96edaa03758
SHA512 69e3dd031bd1f34e1076d3b111bc0d1072c3e4d95693377a1d4c079575ff85ea73f46a36bdd23c87038a54f2056327e48004a9f8997e37c255db874aea7759d5
SSDEEP 192:+R2cBz986elwAv7spaPRp720xnBJbCGzzgynDWx9wHsb+WNv+EQTO2Y6Ocy+l+hB:+R2mz9kfYmXS0lOxKwvggqqEpPECut
TLSH
T12C72D46EB8202A7B9DDEC629F951BF1BD3F2202115D01E94AAFD9D2C14EB9CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3ff3b22aea5116a1e4f63a1ce6b419eeadbcd2ec16af10eb61728072100454e2
MD5 b9bbd0d7c106d1aee70aff5de736d4e7
SHA1 748c55f5742e78bf103281163a525f02b809adee
SHA512 5f68b446646339fe826aacebc4d68da312dd88a758b604996a8a44a40ec05d2f184de0a65a62be399fc345628b99afc2b06888b5bd6d48693175c5579d41430e
SSDEEP 192:5R2cBz986eorAv7spAPRp22/B9GWx9wHsb+WN1h3kZwf+B222LPkwkabqVyIsnAq:5R2mz9BgYUX/jxKw8eB2APECqe
TLSH
T1EF52E66EF8146A7B5CDAD22AF961BB17D7F1102122D02E90E6FD9E2C14EB9CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e9f06c892958c3ac0c8a18aeb97e0c9f428aaa4e3136df606e41660bdb19194a
MD5 19d1411b645c1a7664e2a8dffd6fd2a9
SHA1 a32e89b2aba1686d9ca38bae76ba89a25279d747
SHA512 3a17ec5662c7312d10bde7b32e8009bf445247d159bca973b4247629ef4ab6945b34e3cb16211c460818292f9e3fbff524e8fc3f343ed30308cd0123b1fa97c0
TLSH
T175B01200C0417101C14302B01953148872145F21970A1B0583E0FA22C8251668018052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5899f9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5899f9.TMP
Size 96B
SHA256 88e1e3d82311380e808d7b903ae055fff0a68ac62b580b38751b1102ecef547c
MD5 dba2151d7443d890bb725ef5d488d46f
SHA1 66ce96d5611d523fcfd2c8bc2d6fe84fa9bc2825
SHA512 6604c8661bf79d9b0ae85d71b789a6076eb0e91d22e1ce48217aa892be69d78324145b86805e005d9528bc0d48966aed779d37b881adb8cbc4fa8c4d36d39373
TLSH
T19AB02202C002B203C38203F03AC0C0C8B020CF22C2032202E2F00E33CC2AAB00020020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 62bb440df6bd7de55b0902986dd8088aca29e274d199ce3b39e730012174e88b
MD5 09e6002ddee430fc7a8a3c5d691ebcff
SHA1 bdec42cb6e88596d2c3a8e2e4c9197522089eec1
SHA512 c8e261450e8c3b34e200640def0dbdbcf6fa7752e410c20704161f3cb94c565ac6ac43e0d561fe2a5f6e930d6485f8396ec85a344ebd072d7c2943a95a3ed234
TLSH
T12EA0025002402429C51943706592028132A059108986A24553A85554DD55F829231883
MD5 SHA1 SHA512 TLSH

Submit Download

e7e730b2-6411-4cf7-9599-ced5998b00ed.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e7e730b2-6411-4cf7-9599-ced5998b00ed.tmp
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 7128dc05a0655c4465a69d2f5d50b24a20446a60e54bb3db4729f45e9f44f048
MD5 69a9365ad1d0697a7e793ace9355c1eb
SHA1 1c1d8ce48738dce7b966af611e43a456d99d11bc
SHA512 bb09f12caa228c419b467ef053073e5851b50cdccd39b7ca83260c20242ba18540beee4b916e9d38e9cb98959d47253076853b2c70991206697f2d472435e7c4
SSDEEP 6144:pL4svfL4au1Ne33FBsPrYYMca8Fm7Rkm1tYpBeh2BAoUz:voNe33wDQis9oBGcAo0
TLSH
T18B3423769E3978741D65EB64388F0B1D2EF28EDA9C51A6B258E06F0077DEB8D0644C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 bdb57ba50c3c159d512a18a9d8355a6fbfcda561562e13fbef69172373aacfad
MD5 47d5c572482f03debb52c27a87eb05f2
SHA1 4c28fd883316bca026f412a5cdcdb8d87463d16b
SHA512 a8d398a89be20395b46e7ade1eeaf0f6fd17278e77d27ad4492308146f6c3778de4637f3ddc3c53f820159b26744d8de62374abfc0a2ae13ba5b55d8f7b27903
SSDEEP 6144:d1L4svfL4au1Ne33FBsPrYYMca8Fm7Rkm1tYpBeh2BAoUz:BoNe33wDQis9oBGcAo0
TLSH
T1EC34127A9E3578740D65EA28744F161D2EF28FEADC15DAA2A8D02F0077DF7890A44C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 f3f5a3368912404f75e2050d9b0d30e4afaa8334c9370ecb922b7ad434f05e3f
MD5 46055e07669db9d27c3c24ede3edc537
SHA1 8824529efe0bf568c74b2d816391ce6c36d677be
SHA512 c0e003ff2121d70553ba133d7b0b4db9f871c6b2565dae8c5bac00d5b5f4cafe7ddf651beee0322c570fbbf8f822a251f4dc330debb18a74ce8ebdbc448e334e
SSDEEP 6144:YL4svfL4au1Ne33FBsPrYYMca8Fm7Rkm1tYpBeh2BAoUz:goNe33wDQis9oBGcAo0
TLSH
T1E63423369E3978741D65EB64388F0B1D2EF28EDA9C55A6B258E06F0077DEB8D0644C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 5f9fe843cf55bb3881dfb2d1cc42c77c8f3425ae382804fb9c297c4e0a00ec3f
MD5 2e17168d69f27e0a13902959f6460677
SHA1 3aa702c515fe29a5b9eaea5351e3f5a9b9a424a3
SHA512 9dfbc5e2ce290aa214dca68c4ef8380b1985cd6a48c6546cf9203b465f17bec8e6fe226e98add7b59fdac7be5ae8a399ff8b589a06e43f78edb72910e0f3c939
SSDEEP 6144:41L4svfL4au1Ne33FBsPrYYMca8Fm7Rkm1tYpBeh2BAoUz:GoNe33wDQis9oBGcAo0
TLSH
T1F534127A9E3578740D65EA28744F161D2EF28FEADC15DAA2A8D02F0077DF7890A44C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 658a368903e1427d1082dfbfbf85d62870f416e907f786022a9129ec16e2e432
MD5 733dd4d2c0df4a3dd0789ff0b4e7136a
SHA1 42589f4783922b9a9951d24f0d639f6b75b5de1b
SHA512 bd3c609e628500991928d93b07a2a6ecae7131d4b80608deb75a777efeeb772163a1bb3951622ac81eda857fd0a1d710cac7d18609848bbb1f3b6c8b3d896a34
SSDEEP 3072:kGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Hm7Rkm1tYpBeh2BAoK
TLSH
T11EC3123B5D75E9779979BB0EB08E0B1F1EF149A2D920DE92C8D86A0437E97CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 f2abe2a9f404c8b09fb1230e09f5a0836d1132201bb49ff233cdbf6cc20df99e
MD5 4d591adc6a1640fa049983344e2dc7c9
SHA1 f97032d1e34445c361a4359a021d90fd009dabfa
SHA512 e051bafead80610b8e5074a65bc8edeceb103d5aca8691cf85a9ef510e2cc4095560f8da7b850e9649c8fbc259dd6c7eb13575cc73d222d3a50031ddd3ecfcab
SSDEEP 6144:D1L4svfL4au1Ne33FBsPrYYMca8Fm7Rkm1tYpBeh2BAoUz:HoNe33wDQis9oBGcAo0
TLSH
T11834127A9E3578740D65EA28744F161D2EF28FEADC15DAA2A8D02F0077DF7890A44C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 c668af4ff2e3f2d424f8ada52d29eb93c011368d674cbe93430c1606ab8f23a0
MD5 d4fcc7e26c830fbc78c3a4cdca9aff40
SHA1 ab8fe1823e4b961b44b7a6b6fedcc95abae6a915
SHA512 f0ea2f5625759a1e865b7cf0b948acf44541085e76cf49ff51d9e4432a5f34a00df243b262b2f33e0572ec983b67ddc4e7144f485db557b0a1089229ccf8ae65
SSDEEP 6144:q1L4svfL4au1Ne33FBsPrYYMca8Fm7Rkm1tYpBeh2BAoUz:IoNe33wDQis9oBGcAo0
TLSH
T1D434127A9E3578740D65EA28744F161D2EF28FEACC15DAA2A8D02F0077DF7890A44C7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo[1].png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D6NN03DP\logo[1].png
Size 1KB
SHA256 c97e703578120c1f7a570acac3b461178a5e051ce16be9e266c1789c1d610ac0
MD5 2d4e9e8198f0c3eade53c619cd1fe4ea
SHA1 80b29f8dd0c4951ce7cad0db1fad1d9fdb275fc9
SHA512 afef06bfc6bf857a1b7966a04a8779aabf3e8a6d79b4c51867335190959acc469a4e1929b4c66430a3eece1aa5d1decddad005b326ec830c2b3a57179f3c626e
TLSH
T16A210B4723B4BEC7A2A30085230E0056A13687501168B7E58B87ED57719518542A2B86
MD5 SHA1 SHA512 TLSH

Submit Download

geo[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YK6WTHFY\geo[1].htm
Size 18B
SHA256 41fbf024b0285e7d81075c1bbb9bc4b8cde83c8e495aecca335d45fba74c9cd8
MD5 7242788aa0f42e038b1db97e06e93471
SHA1 0370e5db36213a47ae0170e27a7f476a552ed357
SHA512 dd86476e88ec502c78a58ec5b0ed66cf2f2f6c25acde7a9b5ab1932723695baf8eafdd80c20a0119f0eee30c0fa5df5e1cb65fc0f7446bd3597ac54607cfb0d7
MD5 SHA1 SHA512

Submit Download

ByteBreaker V2_54596887.exe

Path C:\Users\Admin\Downloads\ByteBreaker V2_54596887.exe
Size 702KB
SHA256 35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63
MD5 cd85c75fa053954c4ae4ee338d3bcb63
SHA1 fb2fb89c667d901ef01600dae3f027c7dbfe16be
SHA512 f0d7e4732df889e6513f67e266c68bf7490c513bb78736b4fac4d90ed49040415a500ae8f0f9b696e100a92c871d5cf80fdb628bec0f42e3a531e1a636873f6d
SSDEEP 12288:utflJ50c6GeHR6Kjx288tG6rmC0tzeIiZ4fFo:ut9J6MB8gGaUtze74f+
TLSH
T123E48C16B6A801FCE1B7D179C9524912F7B1B847437297CF03A05A66AF2BAE05F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fffc5da33ab43a787a1126db58901913b0019107c9bcaf4c7cd40a793787691d.zip.crdownload

Path C:\Users\Admin\Downloads\fffc5da33ab43a787a1126db58901913b0019107c9bcaf4c7cd40a793787691d.zip.crdownload
Size 1.6MB
SHA256 4bef9b68c3c37ce934c8de207a92705309e6864356158598aea81d18a4eb09dd
MD5 438b8dce613422a7b2a7aabb5b56ceb1
SHA1 f63589bd7d6c7a935cbcf0ace9a4ac27a4ede7ed
SHA512 b3bf7118b2744c31aebb1468232c73179749cd79777c30ae4bc51b2d46034766aa8996d7d5c267c35d867e195076d7f18da7373e72ef4b6151d9156cb8c2d917
SSDEEP 49152:Y59jAYCJEpAfjZP3pXpPn33cywp+d7/11:YsDjZhFJwpub
TLSH
T1B4753319C87DB82E678ECE160A232C83CE5F7C5F5CAC97605777F26A506418B9ACB11C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1996-0-0x00007FF7B1640000-0x00007FF7B17B4000-memory.dmp

Download