24f4dc8451af0489231239903cb3f2ffb650fa2a38be852109e8779903e57a71

Analysis

user interaction
yes
max time kernel
263s
max time network
404s
platform
windows11-21h2_x64
resource
win11-20260513-it
resource tags

arch:x64arch:x86image:win11-20260513-itlocale:it-itos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 11:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
N8Q1I4N3.html
Size 5KB
Sample260802-n3eblahf38
SHA256 24f4dc8451af0489231239903cb3f2ffb650fa2a38be852109e8779903e57a71
MD5 d4312199977791eb5d3b4ac6ae3007aa
SHA1 44f2617d8015bfd34babbd01778bc5193ff219bb
SHA512 e22241db2a99c6526cc208c1252ce78f4d4382b8df7d18d7ccd398b98d3d0b261f585fc9a335bc85213a38ce8ce01c6d12a76e2674d8f0261884a1e644a4d6bb
SSDEEP 96:PNybtoXZzIEb0EaW87V6Sxcd4AdPLxYEJHRTgCOMybz/6HcYzueh8Rmw:PN6tkCBFcd4AEEJxE1bj6Hlyqw
TLSH
T130B15CF38A364216CBBD0B6124BA338CE112F14EFF09945DD956EA1C56FDF2E42685C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	2740	chrome.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ocean-N8Q1I4N3.exe

Executes dropped EXE 2 IoCs

pid	Process
3556	Ocean-N8Q1I4N3.exe
3368	OceanGraper.sys

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ocean-N8Q1I4N3.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\N:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\U:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\V:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\X:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\I:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\J:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\K:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\P:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\S:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\T:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\Z:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\A:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\B:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\E:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\Q:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\W:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\Y:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\H:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\L:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\M:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\O:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\R:	Ocean-N8Q1I4N3.exe
File opened (read-only)	\??\F:	Ocean-N8Q1I4N3.exe

Looks up external IP address via web service 1 TTPs 11 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
69	whatismyipaddress.com
70	whatismyipaddress.com
71	whatismyipaddress.com
72	whatismyipaddress.com
73	whatismyipaddress.com
79	whatismyipaddress.com
179	ifconfig.me
68	whatismyipaddress.com
177	ifconfig.me
178	ifconfig.me
25	whatismyipaddress.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\tracefmt.exe	Ocean-N8Q1I4N3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3556 set thread context of 3148	3556	Ocean-N8Q1I4N3.exe	124

Launches sc.exe 26 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4332	sc.exe
3312	sc.exe
996	sc.exe
2944	sc.exe
4508	sc.exe
2336	sc.exe
1336	sc.exe
2684	sc.exe
4548	sc.exe
956	sc.exe
2892	sc.exe
4888	sc.exe
4796	sc.exe
4360	sc.exe
3624	sc.exe
4144	sc.exe
4940	sc.exe
4740	sc.exe
4872	sc.exe
3372	sc.exe
2820	sc.exe
3988	sc.exe
2400	sc.exe
3124	sc.exe
1076	sc.exe
4808	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Ocean-N8Q1I4N3.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Ocean-N8Q1I4N3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Ocean-N8Q1I4N3.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2740	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Identifier	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Update Revision	Ocean-N8Q1I4N3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Configuration Data	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\VendorIdentifier	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\FeatureSet	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Identifier	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Component Information	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Update Revision	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\VendorIdentifier	Ocean-N8Q1I4N3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Component Information	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Configuration Data	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Component Information	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Update Revision	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Configuration Data	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Identifier	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Ocean-N8Q1I4N3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Configuration Data	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\FeatureSet	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Ocean-N8Q1I4N3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\FeatureSet	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\VendorIdentifier	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Identifier	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Identifier	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\VendorIdentifier	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\FeatureSet	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Component Information	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\VendorIdentifier	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\VendorIdentifier	Ocean-N8Q1I4N3.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\EnclosureType	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Ocean-N8Q1I4N3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Ocean-N8Q1I4N3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Configuration Data	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Component Information	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	Ocean-N8Q1I4N3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Ocean-N8Q1I4N3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Ocean-N8Q1I4N3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Component Information	Ocean-N8Q1I4N3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosMinorRelease	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Identifier	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	Ocean-N8Q1I4N3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemMemorySlots	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Ocean-N8Q1I4N3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Ocean-N8Q1I4N3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	Ocean-N8Q1I4N3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Ocean-N8Q1I4N3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Ocean-N8Q1I4N3.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Ocean-N8Q1I4N3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Configuration Data	Ocean-N8Q1I4N3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Ocean-N8Q1I4N3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	Ocean-N8Q1I4N3.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Ocean-N8Q1I4N3.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Ocean-N8Q1I4N3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	Ocean-N8Q1I4N3.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301454314569753"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	chrome.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Ocean-N8Q1I4N3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Ocean-N8Q1I4N3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Ocean-N8Q1I4N3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Ocean-N8Q1I4N3.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Ocean-N8Q1I4N3.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
1640	chrome.exe
1640	chrome.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe
3556	Ocean-N8Q1I4N3.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe
3592	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3556	Ocean-N8Q1I4N3.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 3292	3592	chrome.exe	79
PID 3592 wrote to memory of 1424	3592	chrome.exe	80
PID 3592 wrote to memory of 2740	3592	chrome.exe	81
PID 3592 wrote to memory of 1424	3592	chrome.exe	80
PID 3592 wrote to memory of 4588	3592	chrome.exe	83
PID 3592 wrote to memory of 4588	3592	chrome.exe	83
PID 3592 wrote to memory of 3364	3592	chrome.exe	84
PID 3592 wrote to memory of 3364	3592	chrome.exe	84
PID 3592 wrote to memory of 1148	3592	chrome.exe	85
PID 3592 wrote to memory of 1148	3592	chrome.exe	85
PID 3592 wrote to memory of 4120	3592	chrome.exe	86
PID 3592 wrote to memory of 4120	3592	chrome.exe	86
PID 3592 wrote to memory of 2196	3592	chrome.exe	88
PID 3592 wrote to memory of 2816	3592	chrome.exe	90
PID 3592 wrote to memory of 3848	3592	chrome.exe	91
PID 3592 wrote to memory of 1468	3592	chrome.exe	92
PID 3592 wrote to memory of 5028	3592	chrome.exe	93
PID 3592 wrote to memory of 5028	3592	chrome.exe	93
PID 3592 wrote to memory of 3148	3592	chrome.exe	94
PID 3592 wrote to memory of 3148	3592	chrome.exe	94
PID 3592 wrote to memory of 3408	3592	chrome.exe	95
PID 3592 wrote to memory of 3408	3592	chrome.exe	95
PID 3592 wrote to memory of 1640	3592	chrome.exe	96
PID 3592 wrote to memory of 4548	3592	chrome.exe	97
PID 3592 wrote to memory of 4548	3592	chrome.exe	97
PID 3592 wrote to memory of 4700	3592	chrome.exe	98
PID 3592 wrote to memory of 4700	3592	chrome.exe	98
PID 3592 wrote to memory of 1832	3592	chrome.exe	99
PID 3592 wrote to memory of 1832	3592	chrome.exe	99
PID 3592 wrote to memory of 1224	3592	chrome.exe	100
PID 3592 wrote to memory of 1224	3592	chrome.exe	100
PID 3592 wrote to memory of 1416	3592	chrome.exe	101
PID 3592 wrote to memory of 1416	3592	chrome.exe	101
PID 3592 wrote to memory of 1880	3592	chrome.exe	102
PID 3592 wrote to memory of 1880	3592	chrome.exe	102
PID 3592 wrote to memory of 3068	3592	chrome.exe	103
PID 3592 wrote to memory of 3068	3592	chrome.exe	103
PID 3592 wrote to memory of 5064	3592	chrome.exe	104
PID 3592 wrote to memory of 5064	3592	chrome.exe	104
PID 3592 wrote to memory of 4180	3592	chrome.exe	105
PID 3592 wrote to memory of 4180	3592	chrome.exe	105
PID 3592 wrote to memory of 1412	3592	chrome.exe	106
PID 3556 wrote to memory of 1416	3556	Ocean-N8Q1I4N3.exe	109
PID 3556 wrote to memory of 4332	3556	Ocean-N8Q1I4N3.exe	111
PID 3556 wrote to memory of 3988	3556	Ocean-N8Q1I4N3.exe	113
PID 3556 wrote to memory of 844	3556	Ocean-N8Q1I4N3.exe	115
PID 3556 wrote to memory of 3312	3556	Ocean-N8Q1I4N3.exe	117
PID 3556 wrote to memory of 4548	3556	Ocean-N8Q1I4N3.exe	119
PID 3556 wrote to memory of 3148	3556	Ocean-N8Q1I4N3.exe	124
PID 3556 wrote to memory of 3148	3556	Ocean-N8Q1I4N3.exe	124
PID 3556 wrote to memory of 3148	3556	Ocean-N8Q1I4N3.exe	124
PID 3556 wrote to memory of 3148	3556	Ocean-N8Q1I4N3.exe	124
PID 3556 wrote to memory of 3148	3556	Ocean-N8Q1I4N3.exe	124
PID 3556 wrote to memory of 3148	3556	Ocean-N8Q1I4N3.exe	124
PID 3556 wrote to memory of 3148	3556	Ocean-N8Q1I4N3.exe	124
PID 3556 wrote to memory of 3148	3556	Ocean-N8Q1I4N3.exe	124
PID 3556 wrote to memory of 3148	3556	Ocean-N8Q1I4N3.exe	124
PID 3556 wrote to memory of 2368	3556	Ocean-N8Q1I4N3.exe	126
PID 3556 wrote to memory of 2988	3556	Ocean-N8Q1I4N3.exe	127
PID 3556 wrote to memory of 276	3556	Ocean-N8Q1I4N3.exe	178

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\N8Q1I4N3.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff958b3c728,0x7ff958b3c734,0x7ff958b3c740
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,4934915985680417897,15013631202833447783,262144 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,495431060224293038,5264919041591561077,524288 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1496 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,16201355647979784767,8417720660620951373,524288 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:13
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,4537411982606337358,9833006557641439793,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,5523564990034466560,16967363977228647164,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,7804840267426138561,10077185046202007787,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4348 /prefetch:9
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,14294712672488742926,7442085993379934311,524288 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,7257364363598705654,17177913835037078788,524288 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,3641117670113520372,17904567550685727421,524288 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4660 /prefetch:14
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,6256033843858576970,13988710396785646846,524288 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4816,i,15924006378377205603,4323980062217736944,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3816,i,6178313876001981440,6521446419393126970,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3320,i,13236096934100818130,7866125371487171614,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3520,i,600179984374668900,10840893882626562422,262144 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5752,i,1650292717026786926,16696263723076649733,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3948,i,5581653970172480461,14733811352310223572,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=1552,i,17287106863824929660,3689509228341028023,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5892,i,872593745184523669,4674817392854782032,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3384,i,393975107906177828,10404085126633032991,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5664,i,9837638665007591104,16460346892535248614,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3496,i,11072170836117088398,14103779662840484684,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6388,i,15633984694950287028,17220986105501659580,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5744,i,9078962112104503177,10233258805050776681,2097152 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,12842482198193482312,2739854453941390938,524288 --field-trial-handle=1996,i,7480558272146184125,17851631018711296617,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5060

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1536

C:\Users\Admin\Downloads\Ocean-N8Q1I4N3.exe
"C:\Users\Admin\Downloads\Ocean-N8Q1I4N3.exe"
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload OceanGraper
  2⤵
  PID:1416
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop OceanGraper
  2⤵
  - Launches sc.exe
  PID:4332
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete OceanGraper
  2⤵
  - Launches sc.exe
  PID:3988
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload Ocean service grapper
  2⤵
  PID:844
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop Ocean service grapper
  2⤵
  - Launches sc.exe
  PID:3312
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete Ocean service grapper
  2⤵
  - Launches sc.exe
  PID:4548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3148
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="NTKernelLoggerService", ExecutablePath="cmd.exe", CommandLineTemplate="/c logman create trace \"NT Kernel Logger\" -ets -o \"C:\Windows\system32\Logfiles\WMI\NT Kernel Logger.etl\" -p \"Windows Kernel Trace\" 0x4 -bs 4 -ft 3 -mode circular -max 500"
  2⤵
  PID:2368
- C:\Windows\System32\logman.exe
  "C:\Windows\System32\logman.exe" create trace autosession\Microsoft-Windows-DXGI -p Microsoft-Windows-DXGI 0x1 0x80 -o C:\Windows\System32\LogFiles\WMI\DXGI.etl -max 4096 -f bincirc
  2⤵
  PID:2988
- C:\Windows\System32\tracefmt.exe
  C:\Windows\System32\tracefmt.exe C:\Windows\System32\LogFiles\WMI\DXGI.etl -displayonly
  2⤵
  PID:276
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\subscription PATH __EventFilter CREATE Name="NTKernelTrigger", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 60 AND TargetInstance.SystemUpTime < 120"
  2⤵
  PID:1840
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"NTKernelTrigger\"", Consumer="CommandLineEventConsumer.Name=\"NTKernelLoggerService\""
  2⤵
  PID:4572
- C:\Windows\System32\tracefmt.exe
  C:\Windows\System32\tracefmt.exe "C:\Windows\system32\Logfiles\WMI\NT Kernel Logger.etl" -displayonly
  2⤵
  PID:664
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="NTKernelLoggerService", ExecutablePath="cmd.exe", CommandLineTemplate="/c logman create trace \"NT Kernel Logger\" -ets -o \"C:\Windows\system32\Logfiles\WMI\NT Kernel Logger.etl\" -p \"Windows Kernel Trace\" 0x4 -bs 4 -ft 3 -mode circular -max 500"
  2⤵
  PID:844
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\subscription PATH __EventFilter CREATE Name="NTKernelTrigger", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 60 AND TargetInstance.SystemUpTime < 120"
  2⤵
  PID:3612
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"NTKernelTrigger\"", Consumer="CommandLineEventConsumer.Name=\"NTKernelLoggerService\""
  2⤵
  PID:2904
- C:\Windows\System32\tracefmt.exe
  C:\Windows\System32\tracefmt.exe "C:\Windows\system32\Logfiles\WMI\NT Kernel Logger.etl" -displayonly
  2⤵
  PID:1820
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload OceanDrv
  2⤵
  PID:2012
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop OceanDrv
  2⤵
  - Launches sc.exe
  PID:956
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete OceanDrv
  2⤵
  - Launches sc.exe
  PID:996
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload OceanGraper
  2⤵
  PID:1444
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop OceanGraper
  2⤵
  - Launches sc.exe
  PID:2400
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete OceanGraper
  2⤵
  - Launches sc.exe
  PID:2944
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload Ocean service grapper
  2⤵
  PID:5088
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop Ocean service grapper
  2⤵
  - Launches sc.exe
  PID:4144
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete Ocean service grapper
  2⤵
  - Launches sc.exe
  PID:4508
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:4940
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:2892
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "OceanGraper"
  2⤵
  PID:1808
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:4888
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:2336
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:276
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "Ocean service grapper"
  2⤵
  PID:3256
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:1336
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:4740
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "OceanGraper"
  2⤵
  PID:1596
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:4796
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:4872
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "Ocean service grapper"
  2⤵
  PID:1640
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:3124
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:2684
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "OceanGraper"
  2⤵
  PID:2624
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:4360
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:3372
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "Ocean service grapper"
  2⤵
  PID:3780
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:1076
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "OceanGraper"
  2⤵
  - Launches sc.exe
  PID:4808
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "OceanGraper"
  2⤵
  PID:1508
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:3624
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete "Ocean service grapper"
  2⤵
  - Launches sc.exe
  PID:2820
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload "Ocean service grapper"
  2⤵
  PID:2400

C:\Users\Admin\.oceancache\OceanGraper.sys
C:\Users\Admin\.oceancache\OceanGraper.sys
1⤵
- Executes dropped EXE
PID:3368

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

AXP9JZB39Y.bin

Path C:\Users\Admin\.oceancache\AXP9JZB39Y.bin
Size 10.0MB
SHA256 80adafb8184e8b3dcfe376cdb9da5265cf21091d24730088c617384727eddda4
MD5 4bb32958f3025a132fa9d16e97620fd3
SHA1 e09b04bf202eb7e3d5e9c8531f3590f33fbdfc5a
SHA512 74c3a559d7f19e321fee50cca1d2f15dcb053de9df4f568d10a5d31f5fb49c59357cf633d828211b796250744c611ae4309a393148b76f315614fc6e61992611
SSDEEP 98304:wDXPmFHDP6gUpSk67BhcbM7rxk2/QLlaJc+QeeeV5//5T55CBA6vY6:wSjlamBhcbM7rxk2/QLlaJck7A
TLSH
T1C6B61001BFD4E5C1F2754A329CBACF865A36BD516D214A0F32D4330F8DFAB81A953626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N285K2P8TE.bin

Path C:\Users\Admin\.oceancache\N285K2P8TE.bin
Size 8KB
SHA256 624057603f7bfedb26601b7e972986e421d04f47935295bb72976cde1ad6f335
MD5 6a26c676640f5513872e5ca07f4b4868
SHA1 5dab6c708e7c156d918eb59b2a3c59b0bbecddcd
SHA512 e00569fc75b6c122befaa93b52ab1350ad33444ab72e065d75ba5f99261772aa10691261829d1f8e1dc23e788bdcfb504a17ae413b9120316af7c9b026a843f4
SSDEEP 12:q5dkjklXkpb9fXyu5t5+EX3q95MI/SGhUMOz:q0jnVJCuHKDM7wU
TLSH
T1BAF112563AC89666D9AB2E308DA2D3942335E9644E114347314A131F0D732D08923685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OceanGraper.sys

Path C:\Users\Admin\.oceancache\OceanGraper.sys
Size 23KB
SHA256 4f412f9aa89994cda45422d23d6d961809225de9a4f5a8bfbfb9ac0e8725917e
MD5 3ee985c5fd1f5784e15a4d11b3ca70a1
SHA1 33148c93465908ddad71cf189e22091dc0058ac4
SHA512 65fa049521fd659debd7986b80a3ab67f20281b2ed8f37213a46fce1495c1d2391c42e93ac8b1c0c593bbeb284c867a8484b99cfea20a889c30e37febed32981
SSDEEP 384:0OaLMjdtjzvWPkgnrJrc8c5oQiWKx1ah3liYlORR9zu3:PaYjwkgn23Y23lBK9zA
TLSH
T171B25BC1C56810C2CA6A7C78C3A4EA53BD3D739713219ADB06A9D6650F533C9BB3861E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fa139fd95ee75351ea1c0f9eae0840917de778b52bf606508f91d2e7ec94bf4b
MD5 adf7e090e3ff515eb7537db5d83d1733
SHA1 7bc3789ecb6e1b6dc5c7f6278e07c00f03ca4dad
SHA512 1114cc09618efa10c5bb4517e7f35e7e6fadcb78969b4dcf2d39f1757021d5a81dc580389f940d416b73ed01d95578d02a44af06ba0ee4b949e4c5ac8a736ee0
TLSH
T175E02BA5C835AC2B0DFD575D91548B16E74613571A60892F3A3D514CCFB1136064585C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
Size 76KB
SHA256 a93a4a8ffade70623e004495b5325b38520cbb2933ce55e981a46920ffabb9f1
MD5 5f05668cce58e05e45f76ed7845e164b
SHA1 f02531c35d78e5088b0756d8a38d0156b6d4a743
SHA512 f7352671decffae99d46f092241427f50da6d1ec33d0f724328a5f21bdd1c47fc276b8befc34d71a374bc80d85c09c662e7823e7fd5b2c6cd9c95d4d0f085b9e
SSDEEP 1536:cAJbHd2yJbLJyJxB7HYqHZzQD3zgW3/hCzLFMZF1qPvW8pyWhPqROFO7e:cktbty/bYqG3zgGeKFYPu8lhABK
TLSH
T19E73026769951D1B6648191C7E398C8C9279CA0FB0D3F39FBA123B01FA19BE4D6B4F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2b865717cf5cebd846f5f5a08a2fee6a95edf5ff4c3d4491e40d1af4592ba86b
MD5 ffe3b1affcd04208e744e80fd4856767
SHA1 55fdc98f1d24d85517397046f66ff3963875e7a5
SHA512 17f7040d7683268d260d4f8a9f7cc2fff66ca28d2888831f23166bcf4745a4f6d9c182bde5fe7f1002fc0d067665d7abf8971f731801da5c225a56eac384c429
TLSH
T169312D046CDA95A2CF597A337BA85FA73020473D82A26BD7609067FBF28F393D060064
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 62624bb97133afaa12f2424a217e400911dd23cd5a1491c68d469b4fa1e35070
MD5 ef1f62f567247eab006b3c772191b5ad
SHA1 385a322a2528fcdb52f3a437890d4fddcb24514a
SHA512 f4037f2cee11b5bdb41bf31c9c325cd14bd6077dd6793067c553bb5091b30dd4f439d83de51101bff91cd77a44b5c10634f0fe9816cd1d4f367f9a45346dd15f
TLSH
T12A418EF793F4857D8A1192E4EA156E2FCE690524131C3CA688E46E1B43F3972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 f49259e136ab150fc29c5215a0a406e43fec07d2ffff3b83ca4d855eb651075e
MD5 c54e8b367d06453b781039ba91b38d8a
SHA1 0285175ea3ebf54cea3410edf67b96d874e20fb4
SHA512 7093ba06a368342f77b8b582b8a3280324ff1f75e3a9f5f30616a93dd83f806d39449ebbb37258e67acf912c15eb36e5787c741065b127720d686e5da1dff973
SSDEEP 384:DJtW67OICaR3A9IEetah3Ult9tL5aIXkvttMwhMNtSHqPsCFtCNI9FVxDzai+6Ev:PBRvLaI/ispXryl
TLSH
T124629DF7D2E8C22C995156F0DB54AE2BCE2E0958432C3D5EC8D4BE8B93E2472D20175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 ada0ed8b895fa09f4c6ad06a7b15604d0e61f21705f487ffb85dffbd21a9d3a8
MD5 3f25350dee1a915407c44db6a7ac2163
SHA1 38a48e6bbed1116be485e903336587951524a59f
SHA512 3a56296b9b0fed01abecfa19d05a35817f1e64589471c7be7a5b9ecda38aa565207d440bd11a622d0f0eef741432d5088bca4aec3a2547e111f08f267331d19b
TLSH
T1A641D177917EF817902D49BF2D447C0539BAA835419168F4FF57816DA0826F31F2A066
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6acce5354ade5110a328ca3fc3d50b355214a30408cb69c7a673309c8af1900b
MD5 897176f8940483b6a903855d812c599e
SHA1 0a11d1fca9ba04f3bcfc8de8d1c5a4ecd8d5b500
SHA512 66e68a940984ea4a17642a7ef3536afe7571f60a95b352a690b2465f1ce72958a068d395ad33d0299dd8a471e04c699baef4025d7ddba4d0e605d0864ecd3257
SSDEEP 192:CRKXG57R0qv7mpAPRp27R9EHsb+WNn/TPIXI2HeCIf/a/gVyIsnAUge:CRKXvmaUX6awLPF2jIHa8e
TLSH
T11442D62EE924693B6DCBC719F9657753D3F6102161D02E84EBFC8A6C29EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 754b11f71b182975afc03fdd68ef576f5f22b0e46e16b7ec6c95078f10d93643
MD5 08de156c3a0df7f0d9510a02913da553
SHA1 c475d363baaec996ac462c156a2f6f1e897a3492
SHA512 646ac969c361438ed4745fc0b4fea10368c9684c3a99720eb628470fe33f1308a1e1d7a0bd139c46e3425827f8a77a03a28c5d850fb6433de786bd7a95bb299b
SSDEEP 192:CRKXG57R1nv7mp+PRps7R9EHsb+WNn/TP+XI2HeCIf/a/dVyIsnAUgG7:CRKXwvaCXIawLPr2jIHazw
TLSH
T16252D72EE924693B6DCBC719F9657B53D3F5102161D02E84EBFC8A2C29EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cbae560c62f28184f78ae5eff557851d8d6ebdca543bbc67e324d97fd520f3cb
MD5 bdfa9f1b298bc61c682d0b1a3c398e29
SHA1 a1616b863a593743afc60eb7eb3ac4bca2854583
SHA512 e5274e011f1c475958bc0588f339a7e7f2cbe65a5ae3bb9344ba810961a22be24b19875c35f4d4318849e44f0418fc952084d923a17a7a22fdb154ce9da4cd7a
SSDEEP 192:CRKXG57R0xv7mpAPRp27R9EHsb+WNn/TPIXI2HeCIf/a/gVyIsnAUgg7:CRKXvhaUX6awLPF2jIHa8K
TLSH
T1E142D72EE924793B6DCBC619F9657753D3F6102161D02E84EBFC896C19EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ebff20c46eed9fb570e779d3bdfe81ff9d920a88a5343c4d009c9722156f15fd
MD5 bbb09fa8bfd61782361f6397bba9e9a0
SHA1 1b479f82a5cec74de2950aa1b7fba945d12e92b6
SHA512 7bacf9567c254173bbf5e711fa9507496627a2064a2b96268c6637c6e7f8e9a261709dbeb5e34923f0b78cd4acfb67886f34462fc6b2f3e508b143af7b60cb21
SSDEEP 192:CRKXG57R29v7mp+PRps7R9EHsb+WNn/TP+XI2HeCIf/a/dVyIsnAUgG7:CRKXz9aCXIawLPr2jIHazw
TLSH
T14352D72EE924693B6DCBC619F9657B53D3F5102161D02E84EBFC8A6C19EB5CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d7e93a2aae1599647fb0b4aaab9ae7ff433f707b2b390c0160dff3a19d438557
MD5 4cae1288aa300a8aaba1769bb7b1999b
SHA1 1d8fc8c1a262d40e95a2bc7a185a15a793a70416
SHA512 c0f09d219c5ba7962e184895f39122d6c8c965ac30edacb424d4100cfe44e917c0e766343f42da0e3c0dd1fb58cacdcc7ed2c461eab0d60fa7a6e6dff74453bd
SSDEEP 192:CRKXG57R0bv7mpAPRp27R9EHsb+WNn/TPyXI2HeCIf/a/rVyIsnAUgG7:CRKXvjaUX6awLPH2jIHalw
TLSH
T19542C62EE924693B6DCBC61AF9657753D3F6102161D02E84EBFC8A2C25EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4acd21a5d00c1b0fda9136c8fd2db5c0ca0115408be314ac8311914d046f3724
MD5 75eb057ba24c9544677aa8765f8ada6a
SHA1 938048c7a96d9bc0a8848fad34f271457fa75654
SHA512 5b98369590a46e3a99de036c76d1f5e584ba1bbdd5e1b6c78450f8d76a676e07b641265de1e2593814c19c5687d6d163bcd70bac4af8bed2fe98ab728ab79a39
SSDEEP 192:CRKXG57RF9v7mp+PRps7R9EHsb+WNn/TP+XI2HeCIf/a/dVyIsnAUgG7:CRKXQ9aCXIawLPr2jIHazw
TLSH
T18E52C72EE924693B6DCBC619F9657B53D3F5102161D02E84EBFC8A6C29EB5CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d837125d48343b6c71a19c3aaee2b2a0ed6a4510d5954c12070baa3c5044fd55
MD5 b6d598be8a65acc2ebbe1ed06c247178
SHA1 ee1741da02374bea37ba23eed1bc319a3e206259
SHA512 9a8da0e3dff0185b0e02f1d1fc3cfee36c37098bd2d63befb7a7fc3a610111d15d0afe7a517817d4ee32546a685d0e930b232bd9070ee32d28cfc4f733c26561
SSDEEP 192:CRKXG57RH9v7mp+PRps7R9EHsb+WNn/TP+XI2HeCIf/a/dVyIsnAUgG7:CRKXG9aCXIawLPr2jIHazw
TLSH
T1A752C72EE924693B6DCBC619F9657B53D3F5102161D02E84EBFC8A6C29EB5CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cd213d2459f4c78d975612c9c275e8b831f91f93c0b59580ece6b0748180c3ac
MD5 78a1e331ad3a5d73fb91209e1d818545
SHA1 993abc17ea28dc4855083ef306ad0405d17b5f34
SHA512 2f668fdd8dfc6673072b6b44910f01b07d28d4fed246c83bb32d66006c00a0d13b330bcdcaa2feef1361be685b5aba2bb444d1d97510973c139bf6b3503d58dd
SSDEEP 192:CRKXG57RV9v7mp+PRps7R9EHsb+WNn/TP+XI2HeCIf/a/dVyIsnAUgG7:CRKXg9aCXIawLPr2jIHazw
TLSH
T18952D72EE924693B6DCBC619F9657B53D3F5102161D02E84EBFC8A6C19EB5CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 8ed134cc561c0082c8a56562d688aa6b47463c6122659431e037b43e3a5c75ba
MD5 64b3610ff139c668b0b46ce3e772e1a1
SHA1 fac0e0328205c7f7656a030af7e3fc71f270d838
SHA512 eb5e7660e19bd36dc81f6920f83bd6a813dbb128bb071e0181034ed70de85199dc42aade5984fb00fbccb32fdc16daa76ae9ee6eb28c45d7f8de56c8a64758b3
SSDEEP 192:FRKcBzvG57Rw9v7mw+PRps7O1oKakt9EHsb+WNH1IPQkZv+tC2DJXI2HeCIf/a/s:FRKmzvB9aHX5awLWv2Da2jIHazjU
TLSH
T12E62D55EE820297B5EDBC619F961B797D3F6102161C12E84E7FC8D6C2AEB6DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c27fe426b061d40ec9a54987d6a5046d38c12cb12d3f232e532e9e5701fc5695
MD5 8f205d46c8c1c6732c1b7fffdfff7101
SHA1 74ed42ee656dbc5a6c3d6877ec98a7a6a5a22842
SHA512 e032c0ed2ab01667af708579ba2207f18a6c0cf3859b181d6d583665c0832d28e0eb45c4ef6a45573c99e872cb21c8807a387c1dd12fd53d5b60f51ea7795de8
SSDEEP 192:FRKcBzXG57Rw9v7mw+PRpsA1oK9M9EHsb+WNnPQkZv+tC2+XI2HeCIf/a/dVyIsh:FRKmzXB9aHXyawYWv2r2jIHazjU
TLSH
T11C52D52EE824697B2ECBC619F9657B57E3F6102161902E84E7FCCD6C29EB6CC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6dfc0e4d26b89a2cf64f2971f920ebcd5ec19eed085cfe49e223a45af0663543
MD5 8a83f5e9dd8f7bb652746c8e98db9fe4
SHA1 d0d6460d6e4501a37b7112da613c79f7cb73fe3e
SHA512 1b8fc3b14b67557553f62262168dfd5daf1166a568de45576f6c1658b565133d9e390b6599abc591ff92b1a6574039bdcf4626fa62e956dc1a1901fac2e0b768
SSDEEP 384:7NjnO7KxkXqKf/pUZNCgVLH2HfgslOv7pLALchjZkXODnq+ErU3B9Hfu4n3T5:7NnO7KxkXqKf/pUZNCgVLH2Hfgs8v7pN
TLSH
T10D72F9A76C4C9D370F94C6CCDC1ABB4FADB5024B65E9886483FA582903D5ACB114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\f2e018a7a192ce3b27793258559461228352f6de\dd52d2a6-1aeb-4b97-b0b4-869479e27e57\index-dir\the-real-index
Size 120B
SHA256 e816991e654423c447d9fc0d958dd5a3348c746a12108f7078d3342dd1569f18
MD5 fac76fd0a83258839834851e14534ac2
SHA1 21c30e9c79d391c55bea156a2d7cef58196c8c99
SHA512 6a673d48fb7e50dc9bb051036f81eabfe1b2891e66b007b6cc765e22b68c4db8a459da0a3d20744dfab03ab7eb25dc68c914050c18a4856407187948835a97c2
TLSH
T1F2B012505C032E03C90292B2439500A551004C64111C1E030AF90C48C8393400D06000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8b3a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\f2e018a7a192ce3b27793258559461228352f6de\dd52d2a6-1aeb-4b97-b0b4-869479e27e57\index-dir\the-real-index~RFe5a8b3a.TMP
Size 48B
SHA256 190ad2c60188a6cc4225af67a842772994953bb54116227b052217bea5454bdc
MD5 ef019166652b5fda57e2b8447d852351
SHA1 f3bb06944476129ed7a0924b8ee2325b08219e12
SHA512 f42f95fedf32c4d3fdedc601fb196ddd3bbdf0d266203ad55e75c58c1726f9fe444dda9cbdfa4466fddbc7f253dfecba4dd76d89591f405089fca6a386875213
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\f2e018a7a192ce3b27793258559461228352f6de\index.txt
Size 126B
SHA256 67c669e314c426adcc1786b3190088f7960c860c87020f48d7480431b5210dd9
MD5 34ba03f73b857c89cbfaa8a6569eb218
SHA1 16eeaa05f3a9a9fd36fe3ec09dba5038ebfa90ce
SHA512 d181c9e4d6e66003b06fec6ae5fd54da92fe4dad42101d36163b1116838f6b9acbced8d07c92035371281619cebb4e01a83ae4f55b95babdac8e307251264646
TLSH
T1A8B0222A33C20BA02EA2828008A0A2F8F00C8E888880A00E0802C28BC8C00BA0A00080
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a8b69.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\f2e018a7a192ce3b27793258559461228352f6de\index.txt~RFe5a8b69.TMP
Size 131B
SHA256 d47224d89b84f5adf121fcf186e70137be111f9b2193bef6a6b178dcd8b28016
MD5 e243f19bb67921aa3e37bd536012834b
SHA1 239b5cce3b398333e169c6c23ff85e9993e89c9a
SHA512 4d436d38a2a0311270a36361c3381192ea62a80d70375206e160d9d15888d55bfa5951ec3c24dad4754ed02aefb3ef6269b3491e55d962861e6e595df40b5020
TLSH
T1E8C02B2A31C107A45E524141486060E4B01D0D844840800C0403B187D4F00B64608040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 cefd5e6568e9e953585b5629cacae4883255dd3a8e759f9d94c5cf035cb74122
MD5 fcdde7676bdedf95fb975b49f6527f2f
SHA1 f92ecda3375e0ed594bc251866f87befc0f0a345
SHA512 4b84783546a734da619ad5e79e97c20bb82c4925a8abde5c0480349cb2d3776af67c268f4f0aeb85da7346e615fba05db351e5c0766c442d025c7e862cf3c69c
TLSH
T16BB0125084026102C10607F41142249871189F21D70A270553F07922CC655A081180A1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 d108585f10f4a9b41efd0f38155d03a4cb6a51776d96cc1a03afbb662736cb69
MD5 67e592171ba5b047ed69b356628394f5
SHA1 6c6517c8e77ad7270b0dfd2c8feaf8daf92c2e9b
SHA512 18105dd406543261b65e56a0391285fdd0dad6c94bfa7436e4a6f372e06bde1558c4c9d6515b95660d5fd3a65fea06fc3296f31fcb4a3986b81a73ea8fd5bacc
TLSH
T1B2C01215CC066222C00A43B5104BDEB8B16C9F38DA1B2348E7F06A169C39621C0151A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58468a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58468a.TMP
Size 96B
SHA256 c8bdb56bbfbfc14f6b091faded09a4e6ec55a5887f0017174742a67717d709e2
MD5 18071948419b7a397b2c112074905359
SHA1 8c2354715f0bce157008203b3f9f8cae668823df
SHA512 7ede0584fd07899c8f20200f7e6856893b87edb99c0e71539a988b6d892496800f89015a9e15ab985af72a9d9ea92463efac25cc35e05b80168e61b5063598dd
TLSH
T151B0025AD2026613D18203B02A95A6E8B160DF25CB031316B2E06EA6DC2A764552D5A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 224df771d1eb90117f8c9269f4c3a1f98bac3b65bf16108b69c955d97de96090
MD5 a930e9055ef4b7ee0c83ca5ebb3d9ea2
SHA1 f016818a9cf443105184f5a1ede89edd44ebb4ea
SHA512 26843ea8dc91142cdf445ef821ad2613b481ea522ea5ed249ae0dd033b4451e77186816368246a72034e9d6909b7d3c5d2f373a408bec410fb4727ff6b1af919
TLSH
T13FB0121074C12A40C800C7B99BC112C012420471474142422C801000D63A2570112281
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 175cf485aefd132be20970e2a7b30bce183b8506ffccd20bdf64b06b1b4fe8a7
MD5 6b68a85927f383206bb373a27cb8c325
SHA1 190dc1632c70295a32ddce7577df4936193b7899
SHA512 bd065bf741e5382c4dc91a2cead88e0a9bae6dd36f04b35e27623610708abe09c3dd833e3b1e2467bac3882401dccc3ac1528bbda9aa88959e3b3a3d46d5b2ce
SSDEEP 3072:itGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:ikm7Rkm1tYpBeh2BAoi
TLSH
T173C3123B5D64E9365DB5BB1EB08E0A1F1EF149A7C820DE92C8D85B0437F97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1834ea3e2271e5a4999b570996f89049911af0db2f838a9db0b03188cb3c2c9e
MD5 ddb15c2064620ec4e1f99466cef1b354
SHA1 35c834a2b0a8f9e81b5b7800456b4b5327dac6a2
SHA512 1ee9392b49b91f39f4b2ac67c0643aff144c404fbc5816effc03f146e37c9df0e6b5268c8f74e33665eba3f317b0844daa3c087e32808a51ddff253c2cdd871a
SSDEEP 3072:LtGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:Lkm7Rkm1tYpBeh2BAoi
TLSH
T115C3123B5DA4E9365DB5BB1EB08E0A1F1EF149A7C820DE92C8D85B0437F97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6f298a7aada834d537600a1f394d2f5fb13c245a1b989de1955d4d12015cb81c
MD5 c3c8f3f42a0f5c6b9d5bba7e8a9b1b60
SHA1 25d73d6952ab53f5ec0b1b2560f46f25ceb7ae60
SHA512 4e5bad9df837c5476eb31875d7e47c410021854a8fdb83c67594d4dad058cd245c738af25cf1a3579eac74e2e3bd900afa46b21181494c5d84c7bdaf3fb5a006
SSDEEP 3072:iSzGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:iSKm7Rkm1tYpBeh2BAoi
TLSH
T125C3123B5D64A83B5DB5BB0EB04E0E1F1EF149A6D820EE92C8D85E0423F97CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 291b16f68432b0d2ff00f3e2f5c2286097d07f7a48be80705cfea5d3e6a790ba
MD5 7f76714bf8c7024c81c194b0b833bcac
SHA1 59e6ad78e90a73460f55d232d54692037cd6f6ea
SHA512 e820a5ad9f4f15529020c30e658de06d333b9dc7a71873dbdc08bca189626b6ac09a231125a1129baaad2f446c5ba9855d05db95d876b42d0c6bb8b2e0180878
SSDEEP 3072:3LGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:3Sm7Rkm1tYpBeh2BAoi
TLSH
T1E7C3123B5E60E9375D75BB4EB08E0B1E2EF149A6C920DA82C8D85B0437FA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 28842dd9457a7daf5d13ec8d86e3f837f4e7cebff3bcea4d213c089c9d2be10a
MD5 3fdcc4d437bd0d729a0904882f64e1e6
SHA1 8457af3a0acb0fe594832395f223bd6b1643cacf
SHA512 fea56cc8498a337b454f0ad21b544700efa8524bd06b386b111009cec0ec75235b54fa88eb023b8024fefd7c85da28666b98fe77b7b2457e502ea557553440a2
SSDEEP 3072:iljGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:ilam7Rkm1tYpBeh2BAoi
TLSH
T174C3123B5D74A83B5DB4BB0EB04E0E1F1EF149A6D820EE92C8D85E0423F97CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 81115911be5392882f8d0b6b5d488e9b267903b888c0de465d9ab6a6fe549eb0
MD5 967ba8f3a8056d920d86cac7ced3456f
SHA1 40debd51ce66c7a98af548d179ab444d7f15c05a
SHA512 88edbc352b120fd8d2275158e31508a0d4db1bf5319999c2d920d4c89d5d6ea4a4e8e323a4b4d985d8b28558e78016724b63df80237658322aef6006db041178
SSDEEP 3072:i7zGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:i7Km7Rkm1tYpBeh2BAoi
TLSH
T17FC3123B5D64A83B5DB5BB0EB04E0E1F1EF149A6D820EE92C8D85E0423F97CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 11258921427487d5c5aec474fbaaea375c13e1ed1f09c9c7be2c78bc50b5a2b8
MD5 158bf087d696b45a7cbb8f8943d50fe4
SHA1 b8997da16bf8552f8b9d5c1a66c0a451e8d5412b
SHA512 94396390736b84b68d17a14908a0523d1a0c2971b18c1c2bebd3b992f72f13ece2c07585a6be7e07b72a64bd1722bb462a5448bda9d26e2d961540ebf174b2b2
SSDEEP 3072:ipzGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:ipKm7Rkm1tYpBeh2BAoi
TLSH
T1EBC3123B5D64A83B5DB5BB0EB04E0E1F1EF149A6D820EE92C8D85E0423F97CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b3d22ff57a94e90d77325478c4c482d5629f46ee09b31c2b566d1bcdc01fca92
MD5 cdbc27eb7c7b7a0ce4b10b1c1ea89f3e
SHA1 9571f8b1631cbcc242c5d3814dc785083ce8e36f
SHA512 78119835f3a7db9380d82a7826d0036fea7ec4e33f8e6dd1b0da2bec539a146f69b965e9bc6a85887db542e8dbd888e11e88469ee79b58732297cb12d3892659
SSDEEP 3:MsEllllkEthXllkl2zEglthQt:/M/xT02zj
TLSH
T1D9440445FFC45F15C5001070F435C3501770D45D0511574334550413DDC75441C50001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 84b81c6e51cc1aadb7b88ad321de3d36fb3908eef83d3f9dee902d9e59707bd0
MD5 6b3a5ca61252fde695a629a4ae5d29aa
SHA1 89d65852c23554444cfc21abd2bae1e7f6133aaa
SHA512 311525348e97e8a924e1e1a211d539b4ffa9cce1750d5d115025e025797eeea82996528b685633fa123d2c557b13f867be429fef559f193d8382c4a315bf17d4
SSDEEP 96:yYFF5679VNcPjZM67pcO6mvcy6IcgG6Dv4:yYi9VNcPdcOvcscGA
TLSH
T10102D14127FA6A55F3F79B757A7233208F7AF9028B1D590FA1C443090964A106AACB7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 942588bb1cacd750535cadc2c162d87492f1b0a6d4ee9f207490cf4930cd4026
MD5 487eb91e6d411d0dc40c87db2624b327
SHA1 aa4fb80ab1fc2e11f01df73517324c9eac8dcda1
SHA512 52af43f14441cbf1d525135c46964c1acde79a6f97e1cd5a6b267bc40ae1d327764da3f06e567fd75fe033b271ee8aacd8adbdad41dbf404a8766aa09b55c8d9
SSDEEP 96:FcFF5679VucPjZM67ZcSLHFVV67NcO6mMcy67cgG6Dv4:Fci9VucP1cdNcOMc3cGA
TLSH
T19F22E04127FE6A55F3F7DB757EB233218F7AF8029B195D0F618442090964E006AACB7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ocean-N8Q1I4N3.exe

Path C:\Users\Admin\Downloads\Ocean-N8Q1I4N3.exe
Size 42.7MB
SHA256 257ee6fab2e1cc0c053f328fa923bd53964d1eb0866af9a931267fcb9eb5c98e
MD5 a2f958996a8212294d5434ab3a7b7fe9
SHA1 545ede9fc0b44e96d26a8aa88f9c3d69a5bcc78b
SHA512 b64333f66bf4f21cb9b224f574e8c62357b1d9863ecdc7ee43ad766e8014267ce3efd143b293fec8e367df37270e3d1b3c659e922d504c664e7693e6e359ad0f
SSDEEP 786432:+1nIA9uWOfzjfyPj7fhMeXHqOqt8atPFwvP0R901QBp5SiwVqLw9n3SkA3/U:wN9udXy7fiAHi2kP+1QBpUiwVqsgkY/
TLSH
T15AA73385E0B01878C111D1BACA1C74A8EF16BF4BE871C77D6FAE760C5EF182495E4AE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ocean-N8Q1I4N3.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Ocean-N8Q1I4N3.exe:Zone.Identifier
Size 131B
SHA256 a5906b3787da89dfb31b6a30294f30b7b0ec1ae53e1adac93173a9d63654df6b
MD5 02c38308b65dfaf3dbe981170041cae5
SHA1 67197c44e579e5756e453628f8a5ac145bbe743b
SHA512 455b094144c2c0814d244f664da153cd6b8edbc77eafa4fcf3e13800712c1ec2ccc620e9a954ef2ede1cc20be4021e5fce5a43990d764e384ea7378ddae0fe6e
TLSH
T195C09BF795C08538452562C019DDD78CB14F5164CD56C114D45048F7FD9006D849169B
MD5 SHA1 SHA512 TLSH

Submit Download

mshdc.PNF

Path C:\Windows\INF\mshdc.PNF
Size 66KB
SHA256 1baec35e2c6d4264973e12ef316cf1f799b8d3679cbd9ca36f09b84d0f663ba5
MD5 97aa23591d76930a94e9310f5da3ce04
SHA1 f3bed8c13aae15e675c9b1032a3588c30c1fc4aa
SHA512 6b6f18055b5b6fa2927da747184218b10004a4f5619b3294cf005495728a61d47c5613ce6b4aedf1067951e6ddc022de9b566c300de068c199ad36c150c21c8e
SSDEEP 768:YkJr10vSzoupBpwLYP/A7SsrvOregjb/WXN0AhErnEpg/0kUnaZ:Y210vSzouGLYP/A7lTOrhWXN0Ai7VcKZ
TLSH
T157639C0437D94F0AF1F3AA71AEF586969925BCE16E21D70F9060730F0872F85ADA1736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

printqueue.PNF

Path C:\Windows\INF\printqueue.PNF
Size 7KB
SHA256 5180a84a33670467c5b127acf0a055655cd0aee9aa2c211d80d041433ad50203
MD5 33bf503f01cfdc7a40bd32bfde080927
SHA1 26e5d4da87285cbbe50fe4fa997c5b1754960e58
SHA512 8498dd09f19154c3fb277a693cd05f97d3ef0913802c8016b44f4747b5070e1e502801710e50a675c4efc551db2035e416617eb697ffee0a1a9c6db4f6956136
SSDEEP 96:o9mRg74yTu1YjwiBOlTi9Ts6OaH26wZt87qPU:o411Y0iBOOI6OSj
TLSH
T162E1B706F3F88E84F2B6AE746CB851E94962BC925D11DA1F2564730D1C72F80EBB0736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tracefmt.exe

Path C:\Windows\System32\tracefmt.exe
Size 672KB
SHA256 2319e56a7465c50e0ddb8add40d0328fb9ec4a9425021532d9786a65a54de1ee
MD5 2a3d8a335d96365e15bf14332af1f6bc
SHA1 dc02404bd74283275312ad9b980b2979ebe319fc
SHA512 ce52be8bf0186e3efec2dd47eea8dd0f968204e8f6b36b8e25f267b7d820420ee7563ad9db41498bc463f48b470ac37443284dc09bd73117ec8cd62064eb4217
SSDEEP 12288:oGQsrIT/flYCi8YAEPDSND/fqYQXGQxUYenF3:otsrIT/flYChYAEPDSND/fqYQXDUYeR
TLSH
T176E4FB41BA45BBE5E442E039E6730B825DE45E152324E23FA1ECE9366D77942AC30FF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3148-744-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-747-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-715-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-718-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-723-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-730-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-731-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-724-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-722-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-729-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-720-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-727-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-728-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-725-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-726-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-719-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-706-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-710-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-745-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3148-746-0x00007FF6CEBE0000-0x00007FF6CECD2000-memory.dmp

Download

memory/3556-753-0x0000000050C90000-0x0000000050CDB000-memory.dmp

Download

memory/3556-774-0x0000000052C60000-0x0000000052C6C000-memory.dmp

Download

memory/3556-754-0x0000000048500000-0x0000000048540000-memory.dmp

Download

memory/3556-751-0x00000000484B0000-0x00000000484D9000-memory.dmp

Download

memory/3556-752-0x0000000048500000-0x0000000048540000-memory.dmp

Download

memory/3556-749-0x00000000484B0000-0x00000000484D9000-memory.dmp

Download

memory/3556-750-0x00000000484E0000-0x00000000484F3000-memory.dmp

Download

memory/3556-760-0x000000005E3B0000-0x000000005E662000-memory.dmp

Download

memory/3556-767-0x00000000006B0000-0x00000000006B5000-memory.dmp

Download

memory/3556-768-0x00000000006B0000-0x00000000006B5000-memory.dmp

Download

memory/3556-769-0x000000005CE60000-0x000000005CF87000-memory.dmp

Download

memory/3556-707-0x000000004D740000-0x000000004D744000-memory.dmp

Download

memory/3556-776-0x0000000052C60000-0x0000000052C69000-memory.dmp

Download

memory/3556-778-0x0000000052DE0000-0x0000000052DE8000-memory.dmp

Download

memory/3556-781-0x0000000052DD0000-0x0000000052DDB000-memory.dmp

Download

memory/3556-780-0x0000000052C60000-0x0000000052C6A000-memory.dmp

Download

memory/3556-784-0x0000000052DD0000-0x0000000052DD4000-memory.dmp

Download

memory/3556-678-0x000000004D530000-0x000000004D533000-memory.dmp

Download

memory/3556-668-0x0000000140000000-0x0000000141000000-memory.dmp

Download

memory/3556-666-0x00007FF969880000-0x00007FF969882000-memory.dmp

Download

memory/3556-665-0x00007FF969870000-0x00007FF969872000-memory.dmp

Download