a30c8218cef8d434ecdf61b8e363ea3fba7f1fb4d261efd1210516fa13076d12

Analysis

user interaction
yes
max time kernel
1260s
max time network
1263s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FL Studio v25.2.5.5319 Full.zip
Size 1.2MB
Sample260802-d1rh2ace82
SHA256 a30c8218cef8d434ecdf61b8e363ea3fba7f1fb4d261efd1210516fa13076d12
MD5 c20250f10a68598221e8f20dd817a90d
SHA1 b7490d61bb7a7356fba17f913463f24ae5ce3635
SHA512 dcb371e7dd5add419df4df2dedf276f83bb5d531276748ccb4d1289b2e0f39bab4ab50f4456ad81427d667afb0ad2389a6e4ee71b4da2cdf402724c71bfe13c0
SSDEEP 24576:RNIJZikxTMEG+vOBmhvspzasKoOMk0ARpoLm/eEAGbLFuSAHEhIZ+prMZ3P:vyikxTlG+vOIh+OTMopAmWEvFZAH54p+
TLSH
T182453307D4CEE571A37B1680359C6D96E24672F47F92E25B671885FA0322CC3123A9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3852	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301149762565358"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0300000004000000020000000100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5\NodeSlot = "8"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5 = 3a001f49471a0359723fa74489c55595fe6b30ee260001002600efbe100000009bc33fa8ad0fdd01edef2d18bb0fdd011c7c98952f22dd0114000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Downloads"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 050000000300000004000000020000000100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 030000000500000004000000020000000100000000000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0400000003000000020000000100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1404	chrome.exe
1404	chrome.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
6640	chrome.exe
5780	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs

pid	Process
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe
Token: SeShutdownPrivilege	1792	chrome.exe
Token: SeCreatePagefilePrivilege	1792	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
1792	chrome.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe
5780	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5780	taskmgr.exe
6640	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1132	1792	chrome.exe	92
PID 1792 wrote to memory of 3852	1792	chrome.exe	93
PID 1792 wrote to memory of 5548	1792	chrome.exe	94
PID 1792 wrote to memory of 5548	1792	chrome.exe	94
PID 1792 wrote to memory of 5988	1792	chrome.exe	96
PID 1792 wrote to memory of 5988	1792	chrome.exe	96
PID 1792 wrote to memory of 5328	1792	chrome.exe	97
PID 1792 wrote to memory of 5328	1792	chrome.exe	97
PID 1792 wrote to memory of 4524	1792	chrome.exe	98
PID 1792 wrote to memory of 4524	1792	chrome.exe	98
PID 1792 wrote to memory of 4540	1792	chrome.exe	99
PID 1792 wrote to memory of 4540	1792	chrome.exe	99
PID 1792 wrote to memory of 5740	1792	chrome.exe	100
PID 1792 wrote to memory of 5740	1792	chrome.exe	100
PID 1792 wrote to memory of 2272	1792	chrome.exe	101
PID 1792 wrote to memory of 4592	1792	chrome.exe	102
PID 1792 wrote to memory of 4592	1792	chrome.exe	102
PID 1792 wrote to memory of 4536	1792	chrome.exe	103
PID 1792 wrote to memory of 4536	1792	chrome.exe	103
PID 1792 wrote to memory of 5476	1792	chrome.exe	107
PID 1792 wrote to memory of 5420	1792	chrome.exe	108
PID 1792 wrote to memory of 5476	1792	chrome.exe	107
PID 1792 wrote to memory of 5420	1792	chrome.exe	108
PID 1792 wrote to memory of 4680	1792	chrome.exe	109
PID 1792 wrote to memory of 4680	1792	chrome.exe	109
PID 1792 wrote to memory of 2452	1792	chrome.exe	110
PID 1792 wrote to memory of 2452	1792	chrome.exe	110
PID 1792 wrote to memory of 3724	1792	chrome.exe	111
PID 1792 wrote to memory of 3724	1792	chrome.exe	111
PID 1792 wrote to memory of 892	1792	chrome.exe	112
PID 1792 wrote to memory of 892	1792	chrome.exe	112
PID 1792 wrote to memory of 6116	1792	chrome.exe	113
PID 1792 wrote to memory of 4620	1792	chrome.exe	114
PID 1792 wrote to memory of 6116	1792	chrome.exe	113
PID 1792 wrote to memory of 3772	1792	chrome.exe	115
PID 1792 wrote to memory of 4620	1792	chrome.exe	114
PID 1792 wrote to memory of 3772	1792	chrome.exe	115
PID 1792 wrote to memory of 5116	1792	chrome.exe	116
PID 1792 wrote to memory of 5364	1792	chrome.exe	117
PID 1792 wrote to memory of 5116	1792	chrome.exe	116
PID 1792 wrote to memory of 5364	1792	chrome.exe	117
PID 1792 wrote to memory of 2624	1792	chrome.exe	119
PID 1792 wrote to memory of 2624	1792	chrome.exe	119
PID 1792 wrote to memory of 3252	1792	chrome.exe	120
PID 1792 wrote to memory of 4848	1792	chrome.exe	121
PID 1792 wrote to memory of 5892	1792	chrome.exe	122
PID 1792 wrote to memory of 4452	1792	chrome.exe	123
PID 1792 wrote to memory of 4452	1792	chrome.exe	123
PID 1792 wrote to memory of 2828	1792	chrome.exe	124
PID 1792 wrote to memory of 2828	1792	chrome.exe	124
PID 1792 wrote to memory of 2752	1792	chrome.exe	125
PID 1792 wrote to memory of 2752	1792	chrome.exe	125
PID 1792 wrote to memory of 4580	1792	chrome.exe	126
PID 1792 wrote to memory of 4580	1792	chrome.exe	126
PID 1792 wrote to memory of 5076	1792	chrome.exe	127
PID 1792 wrote to memory of 5076	1792	chrome.exe	127
PID 1792 wrote to memory of 6140	1792	chrome.exe	128
PID 1792 wrote to memory of 6140	1792	chrome.exe	128
PID 1792 wrote to memory of 1232	1792	chrome.exe	129
PID 1792 wrote to memory of 1232	1792	chrome.exe	129
PID 1792 wrote to memory of 1404	1792	chrome.exe	130
PID 1792 wrote to memory of 5996	1792	chrome.exe	131
PID 1792 wrote to memory of 5996	1792	chrome.exe	131
PID 1792 wrote to memory of 384	1792	chrome.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\FL Studio v25.2.5.5319 Full.zip"
1⤵
PID:1432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8bb1dc728,0x7ff8bb1dc734,0x7ff8bb1dc740
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1876,i,4656762579554032255,14168287533391027071,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,14799962436859617369,6018454265107615792,262144 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,18103815344027607417,1279774891545774716,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:13
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,10561353108369528348,7030070952048317469,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,13426068052010509982,15844238206107124067,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4664,i,14103368659422518186,14414458173197593810,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,10604786386188030392,10948735459277121399,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,5156535132453296817,7106707089630443077,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,2521230204926373498,1610597461472093842,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5516,i,17493321302948980116,16153301798031539092,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,11907396625870576051,12149805296182229872,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5456,i,6951349123180804152,15101388053610017652,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5780,i,8021997822625416686,4618773898771884955,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5928,i,4838574691998533874,5573235569321126923,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,14270519228290615473,726423859664690087,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5440,i,10616368575408628370,7878727979101465889,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5560,i,16929836917796679064,12655500798160792782,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6312,i,5156452773264585171,112405239142450508,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5596,i,782022135443724125,6598375401541212928,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5536,i,10024750727227673478,11933898639262463209,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5556,i,5214744664270316656,3095468139350790368,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:9
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6748,i,2298845447121478468,7183690792379490545,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,9848360057484819284,1566442058062389032,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6844,i,18382990031706861812,10653462364487709477,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6832,i,8142944508372008353,14750168752741188578,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6524,i,17139786743710360284,3659707588579453013,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5748,i,16586720819733653421,8486262387969156557,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6780,i,3785405143138977605,6414262974392079473,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3644,i,12945895066147790249,14461933927144492249,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3196,i,11551794604164311490,7488818143829168804,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6856,i,13455287753841486036,12811172471923880969,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6564,i,11517741303681795785,17325994470838085224,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4844,i,2404516678866670930,4141823094636209365,262144 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6804,i,5761263453067185231,14116594403704737662,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5580,i,225193291137452336,8826469685758029539,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=3592,i,15721066123275588386,14268429129088521825,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5440,i,1913781213049023702,6214391016146466828,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6944,i,7647059458078673424,14210958296639348929,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=5744,i,5971124759926687223,15119630027129223249,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7612,i,8182178601848953144,12527249100762281590,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:14
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7624,i,12121768508166734911,12064663808685282708,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7456,i,8612588953003406152,4995385511702121562,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7128,i,17512939112204563088,13784609309027305981,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7236,i,17390970942883352922,11641414370318270629,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6368,i,17503765903412652167,497242947672317189,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7784,i,279577081982148508,6818942132570660697,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=6292,i,8113125821672579817,8942835518812009421,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6416,i,2057954807798140959,9446202753634525419,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=8028,i,3473250542027086410,2620615010318605622,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7072,i,4471558687089144936,3269510312639655407,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7860,i,17965936268856040566,10072828008909738842,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=6240,i,9298343149778608287,13739790891809420435,2097152 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:6388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=8212,i,3681454387385044638,7120504684021607315,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=8268 /prefetch:14
  2⤵
  PID:6564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8372,i,2937452937360442850,17724139831073651331,524288 --field-trial-handle=1812,i,11238836311673516644,248977566490946298,262144 --variations-seed-version --mojo-platform-channel-handle=8368 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:6640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1988

C:\Users\Admin\AppData\Local\Temp\85464f6b-bd8c-4170-a3ea-3093c7e8a294_FL Studio v25.2.5.5319 Full.zip.294\FL Studio v25.2.5.5319 Full.exe
"C:\Users\Admin\AppData\Local\Temp\85464f6b-bd8c-4170-a3ea-3093c7e8a294_FL Studio v25.2.5.5319 Full.zip.294\FL Studio v25.2.5.5319 Full.exe"
1⤵
PID:1516

C:\Users\Admin\Downloads\FL Studio v25.2.5.5319 Full\FL Studio v25.2.5.5319 Full.exe
"C:\Users\Admin\Downloads\FL Studio v25.2.5.5319 Full\FL Studio v25.2.5.5319 Full.exe"
1⤵
PID:948

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4628

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7cb2341a-ea2d-45ee-ae1e-9d5df950162d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7cb2341a-ea2d-45ee-ae1e-9d5df950162d.tmp
Size 126KB
SHA256 6d2bcb3b875e72956ef94c440d97476703e5087df410eb865e074defa7f9ffe7
MD5 79111d37cfcc25762063adb1ce719a22
SHA1 450f6c7934d95989a6fb05ebc76222d5ffcfaa4f
SHA512 e4b56e2bc2aa5deb7d7dd5ae1041ebfb860b0c8a56aa0e18992028d96254a70e8d19d39b360cc79e4239109dd22ba0894fb88c6a7c7747118eb7afbd980a4e19
SSDEEP 3072:eWsyC8UQ/DcT/k6DuqjXKhGqUgkNLlaJbIwcwD:eWLaDuqWhGX9NwJUwcg
TLSH
T1C9C31235D3DD2C49A9ED425CF24A303FDDB6EA1E4A91A49EF4C82949B4C74B84C93077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 71c56c2da3ffafc58b1f9ac63f15cb6dac4fb1c8a79bff1256051cd303154397
MD5 6cc39d5307f7811ccb8fbf0ae6e905d0
SHA1 6e1f480619352392d31939f7da47f4d0ab05b678
SHA512 e57431313138020cbfad9b542f06329cc5ca06982d0e3aa7b1f35db81bc7c89d945c6de4b0b64332168aac077ed9ce59d0524e723369fe7784fbf6aba95444c1
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000037

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037
Size 73KB
SHA256 6dbf4ce8bd7984da3b3dec2833e8107b11b10aa56a537a2e23284cc52a2d9ea9
MD5 86ab42d92e8aaa951eed274da507ad23
SHA1 311714e51063b0fa75cc3854c967f6a1d7ceaf10
SHA512 8272707b178435da9ec5a970dbfc34f76d6b0b0cfbdfa0fcc7c068507e0681318916ec3aecdd2f3227b153a5285bf1a4b9ab367ce2670223a925bee6e56ef655
SSDEEP 1536:moe3GAn1hvFY9yIeaRApCRxZNBo2TePOYqTvPOaYE6meGxfwpw3vidG7:mj1h9rIHApCReO9vWR+V317
TLSH
T1B17302C63DA8481B07FB429B47D08C556C2AB3A5CB7559446FB81C2CFEAA427132E58F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
Size 59KB
SHA256 d90d9ab173cf95dfc88c6996d8fd262e2d63b972bbb5350183503d40701637be
MD5 51fddf787c482afd530eb7c1e05c5496
SHA1 8e486d38a7c5d04ee1948f15915b1a35c429ada2
SHA512 6b162537ff4168fbfeff2a587f000d565ec018471cd7f89354354a6334493fac90c640c31ecc33bd3a817aeae1e0c2950f08683b60253b0570092ed979e0406d
SSDEEP 1536:VtSgPigc5A9YO1os4fn4teUqilMFptvfSNkZYWdK:Pj34M1p4v4toSet3SeYWdK
TLSH
T1ED5302E74EF4ACDAE3DE6A4C2603C6D237434B3B60D06AE15F3D09E9596A41440EB3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000049
Size 60KB
SHA256 61c412fbdbbf1417355373a80125c8cf7e5cbaab4218bae0316fe6ef917bf798
MD5 1033a47731e45f7bd46a1962359e96b4
SHA1 ac6abef8d1819a685db48a9515f77a24a153e2a0
SHA512 84ca95f89e0a16efd962b44bd3f7ffe09b328f33c068acd8a1fefd08101d824929e8b9eeccb0786483aa2fd2c60bd0b76fc2242479268d69faab72c48902e34b
SSDEEP 1536:D0bcbU0BkgaaHDF868T5Io63Udr9xCHGD1AMYN4+:gbcbUq5a4x8VV63ErD1g
TLSH
T1DC5302F28B610140E55B9B74EB449D3CB59806124AF275CEA30BEABEEA1DCD0F0D5D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004b
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 c3cb15a21743ec2d165bf90b86a6c8309bcdf1f9412cd5f56f3b7cbc9525b8d0
MD5 484ca835d75e7c3442fd1f8feddc8786
SHA1 f789433b80fad6f6d1078d72fcae0e58515835b1
SHA512 74634af8f3c164a435e913ad0c1342417b292f2b899295f8943db034349fe539818a355ab90db3254c3b4ff70bcda99d17805ca19f71991ed705b566fdd0aa13
TLSH
T124C0922C5260101CE7BCC6B321B30CE32290293804A36692C8F1D58A94432F61023CA4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a4e81564d98e9e8e209eaaef055409072ac350582208db44a758e98309552c8e
MD5 a2b5dd8102f43e8b6e7e6a19c146a1cf
SHA1 fa0eef29a152f51344773a4e5ee1c6c80c568887
SHA512 70dde1fd7a48aca7667ba3b8eeb76f9de994846048be6e30aabc7581416b2ae402578e75630f85cc34fb7b7df93e1b0b0f8fa09a3e895bda9eaf4b94cfd1cf15
SSDEEP 96:rHlhOP1nrULVv9ES/pA0TC0aST7fGb3jpo/iL:rHlCrUL19X/ZG0aSvmTO4
TLSH
T1B091B891A0B04E10DFD8683906FFE839713A921D9A67AFC6D194C170E14FBF54B21B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ddebef98c6859a3358933b173284e1f93f91c6b95cdeb292bae013c8c98b22eb
MD5 006b5805972272907dd3ab02a1a6f201
SHA1 899573a37828e53f602eaef1faab021f3e042bec
SHA512 566bc76115f717effb3d7f0406697c060768f40f503d5ed33edf6bb5891b5f235c931da2b1b4a66395169279e3c4e6c87ebe30514b011f49d65be8c9b64ebedd
TLSH
T1F751D82191F01A25DB69293826FEBD28B07E0429999B9FCBD198D170C08FFF60B118CC
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

84812548-b87c-433b-879a-563cf0ba2d4c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\84812548-b87c-433b-879a-563cf0ba2d4c.tmp
Size 5KB
SHA256 5568741088b3c3a0b6e280bbfdaef60f734718e59b58a284014d217a5bad8167
MD5 15e823dae40f22357abcff0950a6f197
SHA1 1d4ab291d9cc315107ac1095167bd3f65c358917
SHA512 dc2f3aa73d352ed74f52fd969215e29a97c19081607b8c43e937de2f8f05659913075aee15e6d15adafb48b6e9a0c8b75f296644f5b61471751867dbf3c93555
SSDEEP 96:EUeUDAURiUnUQUhVieUfysUpUwaUNU+UsMUTwkU1NUCUxUGUQUT/U6mUftKUwEUk:EUeUDAURiUnUQUhLUKsUpU9UNU+UsMUw
TLSH
T1CDB19AA7D2BFA917102D49BB2F05B8051E7AB83E9581A8F5DF96C16CB0C19F30703822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 34KB
SHA256 1b7ef91c37c628a7d718f3ca68e9acba95f598a32b066e0a008d22ebc56db173
MD5 88885ebbedbe2b8794059faa3221ab5f
SHA1 477df9e3407be1a865ae2a2983448c10325b2def
SHA512 de377816cd8b70b5ce60b2f410953c4f7a122de3ad7de17cbc6dbeca0cafc6175c62e99ed7b5f904c1f650ba799611f12554cf2e3cf0c38a9ea6050ae38ff4ea
SSDEEP 384:DRo76lffisCBG7qFIjXeQzeCDkk3Qqlyy0eawvJoEBeQBetJSskASpjk8EZuT9IA:HpDSKdijmTmbjPMxSS9Eer4I5
TLSH
T19FF2CDF7C3E5D62E89115BF89A146E1BCF1D0629432C3C2688D5EE47E3E2432E15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 41KB
SHA256 88759a52fa4d3bc16c2e2376d5ed2dc3cad0afcab68b415265f5c84fb8cba42a
MD5 9af8bfb929cea066f77384fb58c1d2e3
SHA1 ff822d213d9709848808d6f9f898ec74a3b1fd28
SHA512 7cce6f5b88371281ae8e6bdd05cb189f4ebbd3c30804f521dbc81201ed49658f07050612f15123766b2d5f780f96b320f4c9049c85a567065903f7b10234b21d
SSDEEP 384:DO0uTh059ZUl04ft+4eOteQIMqvYJ5mwae8wRJXlBepBehJ+6t/KdLWtxJJA/PWc:SHK6R2dHjvLbid8xSZUJe9ro31CRi
TLSH
T10E139CF783A1D66E89115BF89A14AE1BCF1D0625432C3C2689D4EE47E3E3433E15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 41KB
SHA256 5ff15f1e5c9ccf317da19c4d756e40c8fd4c2388381588c38d259a2ba9664cc0
MD5 eda516b23648ce979138896bbf0a662e
SHA1 a470fdb41294f9c55b20e5f37e5cef371faa7c29
SHA512 78a5eafe4a13aac91872245152d71c19fe654bd5b7b2db108d0ad5c42bd78823e262e9436ab94bad21b066efa7b3efad9dabb7ad5f9c5a98c281080c5a95b78c
SSDEEP 384:DO0uTh059ZUl04ft+4eOteQIqvYJ5mwae8wRJXlBepBehJ+6t/KdLWtxJJA/PWxT:RHK6RFdHjvLbid8xSZUJe9roY1CRn
TLSH
T1C113ACF783A1D66E89115BF89A14AE1BCF1D0625432C3C2689D4EE47E3E3433E15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 48KB
SHA256 336145c2305ed68906c6011d6407b058e8563bb5acc09aa05c44d900e4916cff
MD5 709a9a46c864cb39cafe2d1776781168
SHA1 f00dc5b8a0c9ac009de6cee5f65bb845f3c05bee
SHA512 eb0981727c0e2244b3bffe296c6feb215230da388e7df23b3f169e26a8dfd27706db5803609b8d64f416b89c239f96c96cee9bf2c6e3e70b37c7b1dbcf321c8a
SSDEEP 384:DO0uTmhfisCBG7qFIjXeQzeCDkk3Qqlyy0eawvJoEBeQBetJSszSD7awvAaJpl2l:1pDS8xdijmTmbjPMxSS9eedr871Xak
TLSH
T14623AAF7C3E5C62E891157F89B146E1BCE1D0A29432C3C2689D5EE47E3E2432E15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 ae5bd14b27a31b2f9f316320f701f70ae7abc596159ae967e791920dbbb34a26
MD5 0a39eb3d42012f3f8665b6fa1a6591f8
SHA1 28726396469a4003bdd14511de99afb37226cfe2
SHA512 5c236f7681ebf282e12af05ebebea10a23f08f323ea0d8013dbdc05013c110f54d27777f48139951bc1a5f877f89115972f355724ee22bb049c7e5b2d436819a
SSDEEP 48:YALlq8qrq6h4hrhQsJAXLsJR1foKsJRsKfsCOBgNsjosMqzsQ+sktsOKs0cspla:DRo76lQASpjugw8wCZutE
TLSH
T1B3919EB3C3D8C62DC91156F4DB257E1FCE2A0A28531C3C26C8D8AE5B53E2972D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d3f80814-1fc6-4f0b-890d-aadbd4fed9aa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d3f80814-1fc6-4f0b-890d-aadbd4fed9aa.tmp
Size 43KB
SHA256 7e1a460faadb937265199c2ee4ec6426da85d45cfaeca8fb9560161e59f9ff01
MD5 68fc25e447c3c2de2d88e395635390b7
SHA1 c30cea2bcab9c77e181d69bb2c99514a0cb404f4
SHA512 276af0991030ade31e575ab9e53edb7c12f97aac69cf0eb7273013309607a7159a7e2859a27331a3d89788411da4b5be30e943396555a3a2125283ebc22aeec4
SSDEEP 384:DO0uTmh059ZUl04ft+4eOteQIMqvYJ5mwae8wRJXlBepBehJ+6t/K7awvAaJpl2z:THK624dHjvLbid8xSZUJe9rAy1XaB
TLSH
T1FD139BF783E5D62E891157F89B14AE1BCF1D0629432C3C2689D4EE47E3E2432E15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 22623efcb472126fc60d4098e137604ab72bfb2bda4b8cf839d11a7ba4490c0e
MD5 5df2490e660d52bc7473cb7e5543ff20
SHA1 ff4d570b35b144d3ef299284ada5875e657c6ef9
SHA512 ded37fb701811e8dfd67b158e08e374c616c7ab1c364afdb7601280caa53d3ec41d7b2511bb5716f9746469824fc09929d5c1d5c18b5588856f6595470073d8c
SSDEEP 192:ERnhQYbvkv7LAPRp2b9rHsb+WNnvd0RH2reEI60HVyIsnAUge:ERhQKAKXw5w10V20he
TLSH
T13E32C62EAA25797B6CCFC219FA267B63E7F5102525D02E80E7FC892C15D75CC221B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 84d0bfd8fd1c121a4fc3f7b5a2ff242d397fb8bfe012b2a28967e1907cc5405a
MD5 4bd6b0b217d3fea757199daedae296a9
SHA1 7f7a874db3e65b278d7a973031e34f6ed25fb9cf
SHA512 f8d788808df3563e44386d9c89b7136acdaa8c8eb2d8471c10e8bb20b77c3ccb5730c7c6702c426482bf5e5c7b778b21af7053c31ad77d54e49bf8f788b5df40
SSDEEP 192:5RnvcBzIYckv7pdPRp+LZpJkeoypg9rHstb+WN2jV8OB1+6wWzZ1IgH2reEI6HHO:5RvmzItA/XX5QksyIW2HhE
TLSH
T13962B46BA9202DBB5DDFC229F921B766E3F5103626D02E90EBFC892C15D76DC2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 222189e5d8b52d820ce1cbb907753e71b403d828ac89d7ad0396ba1e3bbb9238
MD5 0f8ad627accef875384b92867b1895fb
SHA1 693c6e6071514c634b4b9015d2042fb434475847
SHA512 54b2c805c12fa908fbc02fde39c3ab8f726fdc98d50820f741ffdc1768dc0be6b708d1fad4c66c3646e240e29c1d9e26b6c1135a8d37398b8905a317604ef64a
SSDEEP 192:5RnvcBzIYcwv7pdPRp+dlZpJkeoypg9rHstb+WN2jV8OB1+6wWzZ1ilx2eH2reE2:5RvmzIts/Xf5Qksya2Y2Dh+
TLSH
T18962B56BA9203DBB5EDFC229F961B766E3F6102255D02E90EBFC892C15D76DC2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 35abb7e71af43a7b0dd40e3015fdd71a6327857cc886fbe6aa7f177b81362c0c
MD5 4eaf3b7b694e6d655b8ce8328d73e338
SHA1 ed9bbb07f48ecbd25b301b1f3d305b6ceb9c75bf
SHA512 3e15128e4a3e3ac299510fcc13cd3afb17d8f14dbbb1e045007d06de471514f3057630e35bea24fa1d71f58be02fd0f9088df8c040043d28449ce78459e81a13
SSDEEP 192:6RnhQYevkv7LAPRp2b9rHstb+WNnciBzR2iH2reEI6THVyIsnAUgE:6RhQPAKXw5Qxn2k2ThE
TLSH
T19A42B62EA92179BB6DDFD219F9227763E3F5102625D02E80E7FC892C15D75CC221B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 86f1bfdbe860de6f002d44098c06217087cada948cda08d7d553e39f050735a2
MD5 d144908f6365f9b0ad7a99ff2b15522a
SHA1 48cddd4132d45ba0884c4dfdd16577861f7582b9
SHA512 0026f78e552344fbb24e1acda2fe6c44e4cceb117a302e99399b74bcd9c6cb91def331ab46f7e620955c410ed8c5a3183215d6f0987aa5ba54c394920424c0fd
SSDEEP 192:6RnhQYevkv7LdPRp+b9rHstb+WNnciB64ENH2reEI6HHVyIsnAUgE:6RhQPAtXI5Qx3E52HhE
TLSH
T12842B62AA92179BB6DDFD219F9267B62E2F5103625D02E80E7FC892C15D75CC221B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6aee94f3c10b715fb82ea2e4cd85ab188fa05be51735c204d098451c4cc10a71
MD5 b8ad7bcd899876c856a03a52b6b2ddb7
SHA1 10433316478c1107997892014d82f3e774678c97
SHA512 ba3e02c691f1e624bb3b6027ad429e1e8d9dc72d6a664bf42eb4bc43b321cc42008aec0c541aea2655752bb99815cfccb3582db7031269ec5a90f07083363e74
SSDEEP 192:6RnhQYTkv7LdPRp+Mr9rHstb+WNncirXd+2H8g4H2reEI6HHVyIsnAUgE:6RhQmAtXH5Qxpkge2HhE
TLSH
T1DC42C72AA9257DBB6DDFD219F9217B67E3F5102626D02E80E7FC8A2C15E75CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a1b56886df396e69c7d0c23e4396c46efa9132c13444176d5550a956bd156020
MD5 7c1f38cb8f2f9dda7136b6459b4c10df
SHA1 4a7968ee24f9ec53232ed0d77b78ac82a3fde88a
SHA512 9a0543a1824694f7ed0aadae44c6ddc462bf620f49d44f8604f873a15883f3c3ead6959e18a3218cd79ae779d165087dc6c849bd51f47a0da69ed588ba289f59
SSDEEP 192:6RnzQYTkv7LdPRp+L5Jpoyz9rHstb+WN2bcir6wW2H8gZH2reEI6HHVyIsnAUgE:6RzQmAtXI5QO1cgN2HhE
TLSH
T1D452A52AA9203DBB6DDFD219F9217766E3F5103626D02E94E7FC892C15E75CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9920b94fee0de6ed06e6556bbceb82c215b2d07bb7a8025c00fa2b7dda2a6d41
MD5 320e878dd063ca7a51c6b3d2323e3f0c
SHA1 60ac1b40768d8f8354bc72c05fe07345d108ec94
SHA512 da0a67811c07cb09712522b73aef1a7a49ee21f0e181c30e86bacb679b57ab37696ee075fc97934784a4b262578efa0fe04a4d396fd3c63dfd7484aed6e1106d
SSDEEP 192:6RnhQY9Jkv7LdPRp+b9rHstb+WNnciB2H8gtH2reEI6HHVyIsnAUgE:6RhQCAtXI5QxrgZ2HhE
TLSH
T10942B72AA921797B6DDFD219F9217B63E3F5103626D02E80E7FC892C15E75CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 21426541282f24a96d07d73c4dbd3e0b5c6c16a13fc2631fdc8fe2f067787aee
MD5 d38baece0c9ddc33388465b112f6fbbf
SHA1 f1e8c80a9e74b91ad1b1b66a865d7e45adffe6ce
SHA512 db65e8c02e8b893c5614cf51280a32979ef2b585ec74eb491a7770c857911d4eee9e108a64b8654c588528590ab1760964cd8a2fe3e0a8ea5c58e9bc8526d036
SSDEEP 192:5RnvcBzIvcwv7pdPRp+dlZpJkeoypg9rHstb+WN2jV8OB1+6wWzZ1ilx2eH2reE2:5RvmzIEs/Xf5Qksya2Y2Dh+
TLSH
T1A362B56BA9203DBB5EDFC229F961B766E3F6102255D02E90EBFC892C15D76DC2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 37ff172a4cab39e2d6b07de4f722c977ed73952c0b28568ed6f9f9c9aeb01007
MD5 1c974865bdb1baafa3e023f332b052e6
SHA1 7e53e77e3c8cd049c553d623a183aa9cb896b05f
SHA512 3f951197e439435149be8205c64ddb94d1afd11a427e7de8355eb082871c2c9ee8c91dbd50033a2409b847138044dd2bebf89d1c6ee777159395870c4d4fd3b6
SSDEEP 192:ERnhQYHvkv7LAPRp2b9rHstb+WNnvd0RH2reEI60HVyIsnAUge:ERhQeAKXw5Q10V20he
TLSH
T11932B52EAA25787B6CDFC219FA267763E3F5102525D02E80E7FC892C15D75CC221B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 37eba5d376f7f542da2b1c116e92850bef41ce11d5186c1323fb2c91fceafd13
MD5 c35cb846940cb2a9ccc1e80756eb91da
SHA1 667a6b5fe01720147c186ad65e7552ff61ad1861
SHA512 a3df87ac4abdd8495523fff505802a58c299af56ace0f276f0a1d0733d09631ed9eb09fc5c4be54a67455e2773e7a6e25e359b40ea480ea644dc0812922ca233
SSDEEP 192:6RnzIYTkv7LdPRp+L5Jpoyz9rHstb+WN2R8Ocir6wW2H8gZH2reEI6HHVyIsnAU3:6RzImAtXI5QC1cgN2HhE
TLSH
T1BC52B62AA9203DBB6DDFD219F961B766E3F5103626D02E90E7FC892C15D76DC2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 fe6e0aff0d0b9ca1b117b70abb082b31ad25d8ddb3fdbd4d1012fb38ef49815b
MD5 8aceade5e13743073f06bf849795a07d
SHA1 9dbbce0c4bc329f84837f0bfae5807945908b202
SHA512 f1832bc46b4f1e8cd570d0b3dc49bdbb120e9d51aef94f852a40347d5a4a3ae8c54d00bccb78f11933d30dd08c3f44345d64b3c14b5eee97c31e4558aa633ceb
SSDEEP 384:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsXODzi+ErU3xrHGm2uTS:vVzm7KxkXqKf/pUZNCgVLH2Hfgsr+OXw
TLSH
T134520967644D9A7B0FD8C64CDC12BF8FADB5014662B40D2892FBAC0903957DB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ebf53a78fc61534c8bc414889be43175b58af97c6bc1feffb44959145070717b
MD5 0f723aeb90d22c5a679f8d4a4c8c0d8a
SHA1 ee1808ee748bb911800bf65ec5b662d45553025e
SHA512 d658081cb58acbf10021db4b23f1685ce79985d944d3825bc44c126c301c85bf3c8355672beed6c7ff28688ae4601d78ddded4b3609788f5ff7bce1216b11539
TLSH
T18BB0121480566E10CC8041B0A946104831004F258100970387D0FDFAC8E70E00115240
MD5 SHA1 SHA512 TLSH

Submit Download

6dda05ab57624417_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\6dda05ab57624417_0
Size 63KB
SHA256 1bf3dd5e85a22edeb9ada7642324f3a967364da969de3d9a7bb7a0716de23c46
MD5 00441bb5a764bbdcc6ccaa6db19ec3b6
SHA1 47945354662f81d29198b6d1986e193a1b119a38
SHA512 3853b79b75892e0931e5b94d3b8110797dadbd1026c85e2bd517f310247cc2063fbbe48cd1bfe0de7c2a5c64a50d028e66b1e424827b4afecf94c853b75c3b26
SSDEEP 768:Qo7D6c61j/SAXPeEFfgoAaWhrJTt9/XTghUyqxTBXSD74+EACmiQsNnTBVR8noGS:Z61j5RmtRXNyqx9XY4JuqdV6no83iPj
TLSH
T137536BA6337178B3827BA1B190AF170B713ED167B404C4F8A198EEE54A54B9A0177F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 50960963af3bab94b46fa4a412e9204cee65a024a889ad1f175dee9f02473eb8
MD5 30627c0f99b586599d36e8cf5d677762
SHA1 0457813f1eb9807e9a50fcb0239aedde6d0716f6
SHA512 d58e6327da8218014b6c2f9be4f62cfc9032f0eb311cc36d65c1896ae4fc4595f328ea28096ed61a5b97f43d040f3d53445f73d07f0fdbeacd24c2d848d1633c
TLSH
T159B012143C901B50CC4807345BD120905220A8001397021350C90047890F3C62A21A24
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 c62c66c400421945e51ba800fe5051cfce14ada6b51badecce2b4c1bdc06fc31
MD5 deab9b59f24b7005eee3b193a2d897fc
SHA1 3ce91f92a604a7c63b44faf6546d9f7b4e6672e1
SHA512 31527d492ec85f6074d45ff6aa723a851e8dd78d9f96f2584a29614e2c16fefaaadd690e44e2beabd8fade0fe7cb3f4fdf89a6f70e52db3a3776939e0e7bb1d6
TLSH
T105A002249A543011D8900A706BD2464067585D105392021161D804C8C95A1C2AF05318
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 557e6d3e217fc2bc100a202466201a687df3c205a06af95da8fa3b54094fd232
MD5 2565712818e694ccec2bab87c9bb8cb2
SHA1 bfe15ae784d767b2312491f12179f9cac6a016f1
SHA512 23b8fb8602893606d731ebc1e37b852ed065ffdfd42194ad9251fea84a8314a247914666aafa7c53cf3269aa0fd5e9586bc8c3582762108ad81c29d4d7620913
TLSH
T1FDA00220A1F01833CE70C270A8B1054B22554C2457965313A4A90D58CCDFAD0E103128
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f41a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59f41a.TMP
Size 48B
SHA256 6112952394b1a266b7e32547b04933ca7e1756422a4005acdd7124b24fd2518f
MD5 e46f28dc2c3e4a6af1ff9e38e50376d4
SHA1 4075fa268887345285e437580599528358224e10
SHA512 e62d9824e7f236e030535c9f561a9ebfa45b32a1556eb08ff75454ac0475b175fd20569316a465eb13d7201f63164d227d94db88339a1f6b8f745f73a7eaa904
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 c7e7d16dd221e6d5bf7926cfddaf0d8ecaa07e90c361ebada6e66ebd87b8eaca
MD5 5f0506644637bf1be869f0ab54f9dd34
SHA1 1fa8d9e096e56d77e537c6f49efd26830809154b
SHA512 8e311e7b2fef8d94f27744c5194883136934f3c4b2c8b83c7f5bbad0f4eb45e61bc2a6dc0445ca85ede6873ffb05b2c72bda1474a0fc958e82549c96121645f2
SSDEEP 3072:xxyC8UQ/DcT/k6DuqjXKhGqUgkNLlaJbIwcwD:xAaDuqWhGX9NwJUwcg
TLSH
T1AAC31231D3DC3C5AB5ED8254F29E103FDAB7E91D4A9194AAF4C4261AB4C74B84CA2077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 8ba9843aa847e452c04f02e70a4271e4bb6f2105cb4fa2d9534204e4e58386f7
MD5 a397807220cd8e4c399c9a75872c9591
SHA1 b408b8475ece2c300be671c78447acbf19f3c142
SHA512 37a0225ac904c8a61d77a80520b924017bc75785e0bd323c00db0fb4edde8c15957d582473e778794196f59d33f3be0452c4e354bec2ca2ceac5110b27b0c8b2
SSDEEP 3072:GoyC8UQ/DcT/k6DuqjXKhGqUgkNLlaJbIwcwD:GHaDuqWhGX9NwJUwcg
TLSH
T156C31231D3DC3C5AB5ED8354F29E103FDAB7E91D4A9194AAF4C4261AB4C74B84CA2077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 99866e3a87e256c52a1ae9ae623f87735f5db26e8338efd1a20f1eac1580baea
MD5 54a8ecf84c7cc5376e9c43c730ead5cc
SHA1 c495335403ffe4b3eb612b8c3206d10132d72488
SHA512 f5a057eafffbef307421c05b7b57f7c77a2af0a1319abacff26720dc87e271af658a7f69ef7d3adb1a33362003aee89d79447d3143b46305f6215b536a7e59ef
SSDEEP 3072:GWsyC8UQ/DcT/k6DuqjXKhGqUgkNLlaJbIwcwD:GWLaDuqWhGX9NwJUwcg
TLSH
T145C31235D7DC2C49A9ED4258F24A303FDDF6EA1E4A91A4AEF4C82949B4C74B84C93077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 565039c9ad1121dad50980e0789aa3a1c671279d21289f07827e0ae0c00742e2
MD5 984bc6ad6ffe31d699387b39ed3055c0
SHA1 d863b96c2d4f09049d9f0624c43d4144d5ce36bc
SHA512 ee2c85751e3c27f5678cac04c68b915b338d553a18513ad9f112c3ead77670277041938edfd1568bfdac976089fa89ae663a1af11181507ee17052d6d5552ab0
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok58AFADvB6xGyv4YR5gVObETev7:TC0cTkJaRZi/CF2lIDUD72ZZIR5gVObV
TLSH
T1D2A14C3164699CF76976D989B4433A43DFB9722B7D10AE84D9DD1E0C19FB0AC0342023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 cfd1781a56dae178bc0b333ae61cd0905657cff5d811a80d67f55942ee5edcc5
MD5 a42b63caf98f6c05442ec19d43d1d451
SHA1 5e9b1ea01af07873e42ca6bd1bf3a7559b496944
SHA512 ae5915149a75b2d21c404eabb1fc4f55418f4b299d1317d7f7933d4a373f4e9ee7675298614fbd210f9c8ba27e3e6bc5ead16c0542a3f96ffb1721d758ded5b5
SSDEEP 3072:GZsyC8UQ/DcT/k6DuqjXKhGqUgkNLlaJbIwcwD:GZLaDuqWhGX9NwJUwcg
TLSH
T1E1C31235D3DC2C49A9ED4258F24A303FDDF6EA1E4A91A4AEF4C82949B4C74B84C93077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1786819077\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5780-1029-0x0000026EAD360000-0x0000026EAD361000-memory.dmp

Download

memory/5780-1027-0x0000026EAD360000-0x0000026EAD361000-memory.dmp

Download

memory/5780-1034-0x0000026EAD360000-0x0000026EAD361000-memory.dmp

Download

memory/5780-1036-0x0000026EAD360000-0x0000026EAD361000-memory.dmp

Download

memory/5780-1033-0x0000026EAD360000-0x0000026EAD361000-memory.dmp

Download

memory/5780-1035-0x0000026EAD360000-0x0000026EAD361000-memory.dmp

Download

memory/5780-1038-0x0000026EAD360000-0x0000026EAD361000-memory.dmp

Download

memory/5780-1037-0x0000026EAD360000-0x0000026EAD361000-memory.dmp

Download