969018ad2b0aae86834a7e1895ed21de10a02535ecf94e21f5dc6799ce909303

Analysis

user interaction
yes
max time kernel
900s
max time network
903s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsHostManager (3).exe
Size 2.4MB
Sample260802-rx4abaveke
SHA256 969018ad2b0aae86834a7e1895ed21de10a02535ecf94e21f5dc6799ce909303
MD5 2538f6a2c4a9efdb730c8c13adf0cf5b
SHA1 66c18413ba10d738ed9b894bde76e59cba179865
SHA512 d266208cd7b888cf169113be74370c42729dda1809ab3197df685f7ffb3b0d79dba5645ae949b20a3362cb53d7d869bc5e863d049db5d352d4e301443c184a08
SSDEEP 49152:o9EeNSPwEW3cFSI4Tfm3hvbHsjAJcAMkPYUiPzmE6/i:o9Nzm31PMoYHmz
TLSH
T1A7C5BE4AB3B8019CD5BBC17CC627670BEBB174451710ABDF16A086AA2F23FD5567E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\WindowsHostManager.exe"	WindowsHostManager (3).exe

Executes dropped EXE 2 IoCs

pid	Process
1408	WindowsHostManager.exe
4360	WindowsHostManager.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHostManager = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsHostManager.exe\""	WindowsHostManager (3).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHostManager = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsHostManager.exe\""	WindowsHostManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHostManager = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsHostManager.exe\""	WindowsHostManager.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4824	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301550471127022"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2688	schtasks.exe
5476	schtasks.exe
5484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
4360	WindowsHostManager.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
4296	chrome.exe
4296	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	WindowsHostManager.exe
Token: SeDebugPrivilege	4360	WindowsHostManager.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4360	WindowsHostManager.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2688	2776	WindowsHostManager (3).exe	87
PID 2776 wrote to memory of 1408	2776	WindowsHostManager (3).exe	89
PID 1408 wrote to memory of 5476	1408	WindowsHostManager.exe	90
PID 4360 wrote to memory of 5484	4360	WindowsHostManager.exe	94
PID 5024 wrote to memory of 5112	5024	chrome.exe	110
PID 5024 wrote to memory of 4312	5024	chrome.exe	111
PID 5024 wrote to memory of 4312	5024	chrome.exe	111
PID 5024 wrote to memory of 4824	5024	chrome.exe	112
PID 5024 wrote to memory of 2656	5024	chrome.exe	113
PID 5024 wrote to memory of 2656	5024	chrome.exe	113
PID 5024 wrote to memory of 996	5024	chrome.exe	114
PID 5024 wrote to memory of 3736	5024	chrome.exe	115
PID 5024 wrote to memory of 996	5024	chrome.exe	114
PID 5024 wrote to memory of 3736	5024	chrome.exe	115
PID 5024 wrote to memory of 3456	5024	chrome.exe	117
PID 5024 wrote to memory of 3456	5024	chrome.exe	117
PID 5024 wrote to memory of 5852	5024	chrome.exe	118
PID 5024 wrote to memory of 5852	5024	chrome.exe	118
PID 5024 wrote to memory of 4300	5024	chrome.exe	120
PID 5024 wrote to memory of 3388	5024	chrome.exe	123
PID 5024 wrote to memory of 3380	5024	chrome.exe	124
PID 5024 wrote to memory of 4464	5024	chrome.exe	125
PID 5024 wrote to memory of 6072	5024	chrome.exe	126
PID 5024 wrote to memory of 6072	5024	chrome.exe	126
PID 5024 wrote to memory of 4296	5024	chrome.exe	127
PID 5024 wrote to memory of 6016	5024	chrome.exe	128
PID 5024 wrote to memory of 6016	5024	chrome.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WindowsHostManager (3).exe
"C:\Users\Admin\AppData\Local\Temp\WindowsHostManager (3).exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /Create /TN "Microsoft\Windows\HostManager\Service" /XML "C:\Users\Admin\AppData\Local\Temp\sht.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2688
- C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe
  "C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /Create /TN "Microsoft\Windows\HostManager\Service" /XML "C:\Users\Admin\AppData\Local\Temp\sht.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5476

C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe
C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /TN "Microsoft\Windows\HostManager\Service" /XML "C:\Users\Admin\AppData\Local\Temp\sht.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff6dc0c728,0x7fff6dc0c734,0x7fff6dc0c740
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,7619068328587711821,15306437648754123214,262144 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,16182650045522247939,16512515776552091966,524288 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,17241735836277723239,15344488200268044639,524288 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,6428752175456120870,4688688359091036129,2097152 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,850193543272330216,7091150432522450441,2097152 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,8136043384667819049,10131040007586169194,2097152 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,11392418031421352939,9029854203231771041,2097152 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,14218827090801290354,16865919698654508087,524288 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,461563518214222392,2303997242333788246,524288 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,1529980972209895577,17643099241519600205,524288 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,13139765180795614810,9116961407772441682,524288 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4484,i,16219515649078239637,14867754191694713974,2097152 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5652,i,40047140406599898,17307345488464429499,262144 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4664,i,1154314875556425510,10180664488381264348,524288 --field-trial-handle=1924,i,11417445333471775351,11751745938354628059,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:6016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bb6ec226a6232ce6d0873c29d4bf25985e7fac071ff6fc40daf593d68e7c4ae6
MD5 15234e8174f2fa4c55cccb5b6a7eeaaf
SHA1 4142209939eb3adbdc689d56ee7fe3764815c7ef
SHA512 8f6553cd34bb8af4be129c9ba45ea44a59a087f8155276de5e591e10259b9a9d10b58b98411354af0d8e58bae55e2b0cc20c1c924d46878f23bd93c9e1c42a6d
TLSH
T1D2E022AAC962EC7B0DFD0B1DA050074AFA5413573E40989B3E3C98188FB523F8686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 58f02b673e860365b79529b9b67ca094a95e44586042940cf402260ef9e909a7
MD5 7a40b0fa2d3b5770b7a82e0eaf1fa7cd
SHA1 ceb1ae1bce9c03cd26dd56eac7dfd99bd640c869
SHA512 575f0551cd13ef5016833335e272bc4a818b84c26c98537b75a1a99596041f2272eab0b1f5218d95ebf0051b255dba28ee97cb2cebf9e27f0e1d25dcad91918c
TLSH
T1B9D02203F4CC0424C30010B6C0122CE372EFC9E929300F7383C0C4488CD19A02C0CAB1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a76b6101b3f47d8ec2c6548e2b3a29a6c60263986248c14ea07b713c3e629192
MD5 549bc93121cd557b689f8abaece24a32
SHA1 9c530fd1f5ac53b1b595b882541017cbe42043cb
SHA512 bac6d6b5a3667879d13ec7db6636cc5136f3bfc6f231faf2a88d981e18a2826bbdb3fc7b72835d921ecc90d2dfaa49bac50739b04a290bf2701bca23a31ecb35
TLSH
T1BD717CB393E4CA7D891166F4DA256E2FDE6D0925122C3C628DD4AE5B53F2973D20038E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7a82289de78abc6bd2094c4ba0a72cde45fc14d495febb17e9bbc00690a47137
MD5 7fca1c5515117ba0a344e2b321c8c807
SHA1 db0bf1903815d6454622ed870215afdfbe71f5b8
SHA512 6e8ca4d9f46638fc83685b0e34e9d489504904edcf6da7884aa4adcb57be4beae8b6a3a8dd3e87667ab7757b1fa6c957634f8b3db7cd03103d79ca769833d885
SSDEEP 48:YALlqmq7hQqiqyafo7XLsT4sKKgmzsJosHIys58FsfqsN/fsVKswX+sw6jsGjhhw:DVSO7JaamZ+3I/FXYEhDjhq
TLSH
T1CA916CB3D3E88A6DC91156F5DA256E2BDD2D0A25122D3C52C8D4EE4B53F2973D20138E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 fe010468fd9426b8abc64e86fd223ab7ae24a09aff163687a389849792726822
MD5 2438577aa1f44997c7fe31eeb05e615f
SHA1 1764c4073e2fba55f68cee19aabe99070e8a0054
SHA512 e0ca1bb07319b3ff8cc82eaafee36b3ede2ae16e5d9dd2d29c01ca7bc64bd2fad66d215d1f100f094635d5652d3ad46b44c2dd90b5c1091de9a98d913a3de39a
TLSH
T1FB716BB3D3E8CA6D881166E4DB256E2FDD2E0A25122D3C52CDD4AE4B53F2973D20134E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6c9928872f1773d50034531c23067c6e46c7f7d4998fa90ca80072096c0e9d6e
MD5 e70aec7baff88fb935e23c1c0a348c92
SHA1 df55ee7ffa1a41fc71d97f8c0f578c06d3ce8ea0
SHA512 c627973f056669e252097e6f861292cd2d159aee8cb70270f2462a384e8835a014ad2f63161da8716b68deb1656c7ac6d22e26202091c910900ff4a9cd0189cb
TLSH
T1BF717CB3D3E8CA6D891156E4DA216E2FDD2E0A25121D3C62C9D4EE4B53F2973D20134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 409345949ff0ce065a27dc5b0126d80c182f739026dccc2229119c660558c7c2
MD5 b73316c5db0129b9dcab186c1fcc6eab
SHA1 2d970af8239d3a889bdf68955f6816f0a29f4a22
SHA512 3b8631491e24ecc44c56ab8cc90dfcb028e87c960bd8da5023eae94a86572c685683d75a8a06e8c49c52f924810a3f263b599644ba3f9af12456c4b7aadea1d6
TLSH
T1E4019EDBE7B9B857107D04F71D05BC492976A43646406CF6CB5791ADF0815F31B12463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 77eda79fbafcba84a2d9cb1347f19b9b6377a52709323980e98ad1c602829d2f
MD5 a04b5516e145b7d16c72e5ec7d2251f8
SHA1 d8af7502750334234f7b29339c5a63e7b9b2796d
SHA512 39a57d0fb09272cdccd243a89291b6552773c8209a8f5c4fc7076e9e6a25d71122deb859833d8c40309a0d6f9e16039e7e5ca692206f9b0798d30b8dd5acf5d8
SSDEEP 192:ZRKXG5VgvEm5v71hpAPRp2g92Hsb+WNnK50+MUPnBkwvbmetVyIsnAUgtaJ:ZRKX7ZBhUXDQwI07Kn8
TLSH
T1F142D62EA911697B6DDBD22AFD213B43D7F1102625E52EC4E7FC892C09E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 49f2baa38c799bd0e03e6ba3af468d6dc054f49a8769ceae3b2dadfd300503c3
MD5 93987a055d62f81976ecfa49ce6495d7
SHA1 11dda8599c3dcc5f55f9c68e9bce4f8792d0006e
SHA512 d6bb60db154494541b62673cb7c2f3b01d1cbd911527f3c1ef6d2dae3e0c593ba9fa3956e2f3d6709351fa1a5cdedc15b877f767444bc9b4879aaa1a80b67c3d
SSDEEP 192:ZRKXG5VgvEv5v71hpAPRp2g92Hsb+WNnK50+MUPnBkwvbmetVyIsnAUgtaJ:ZRKXeZBhUXDQwI07Kn8
TLSH
T15E42D62EA911697B6DDBD22AFD213B43D7F1102625E52EC4E7FC892C09E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 685e1b8fa192f78d2407be2a99507fd85bd705f7f3ab4d51a56ca89ac5bac5e0
MD5 67ec101d61c648f53d51e12ced5b5290
SHA1 9688816a42facefd7225373de2ebd9862f8c8dbf
SHA512 a1875d0374d882d569d4b94d9d3956177cc28e78aa07985aba1837a5df4324b975bf30f0f708fafe05a23c45e07cc8424bbc386b444130637a30bb60738939a5
SSDEEP 192:ZRKXG5VgvE35v71hpAPRp2g92Hsb+WNn1SptsrMUPnBkwvbmxtVyIsnAUgraJ:ZRKXOZBhUXDQwot/KWe
TLSH
T16142C72EA911697B6DDBD22AFD213B43D7F1102625E52E84E7FCC92C09E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c2e31d7560ca5776b2d278260762bac993ff338014da84e9efabd8823c86668f
MD5 4ac7e040634d79099bb6f15484447766
SHA1 ca03e71ab8344409f6177d512ed9c2f402bf56e6
SHA512 2f8304a628740559333c7ad355d0af3f777f3127da3f8c1f196e195ac06bf9b2a508b8caaf6970c70960a2689481810ea45e9d642f002bb6116fbd0b8b5f58ce
SSDEEP 192:ZRKXy5VgvE3ov71hpiPRp0g92Hsb+WNn1SptsJMUPnBkwvbmNtVyIsnAUgraJ:ZRKXC0BhiXpQwotNKce
TLSH
T17452E72EA91169BB6CD7D22AFD217B43D7F1102625E52E84E7FCC92C09E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2747c9ceccec2b8b142a470ebdf74c6ecffa33f066148d969799ef2d0d4e9ab1
MD5 7b451898e9784e5c81112f7686a40e21
SHA1 f314ab414b21664ab9475dfda17c90476bf879c0
SHA512 a78d0668e5bae9cb0f637abc055bc278ef8422870322bbc25e72a9f7875e599a2a9c9e35797a2aad93ea2e6579f97512398eea34276de80fe4f1c599762fa537
SSDEEP 192:ZRKXG5VgvE3ov71hpiPRp0g92Hsb+WNn1SptsJMUPnBkwvbmNtVyIsnAUgraJ:ZRKXO0BhiXpQwotNKce
TLSH
T18F52E72EA91169BB6CD7D22AFD213B43D7F1102625E52E84E7FCC92C09E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b0e9682833e00222e139f2a30c85771dd14f2e9d664d1650523405a80ff4c9d1
MD5 d979a2438bb492add96bd3e81c42bc82
SHA1 24c4a3ec34656a3a92a5788c215bcf26d547ad1a
SHA512 b1ed7e2312ef4b6e19309e93b141cc0eb768812660220782bd206ca0556eab74f9e51a6c4e155c9314c731af326a64e188381158f9489eb7204dcf563273d9da
TLSH
T1B9B01230C0115101C04607F03143149871145F10DA0B170143F47D62C8251718015090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4027.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a4027.TMP
Size 96B
SHA256 2c992519fd2c262a6fa10924906c911f2dde01970dd0d81fd3805b0880518154
MD5 bd6f2d73fa19e8d4c2f97cea21d6a40c
SHA1 a0de2a5887f8b572b0aaadab4d714300386b4707
SHA512 cdedee21bc66b58ac41974623cbafe849b9fbb4d7db50f50e3b3a1ce89392773018336f559b31de7575d0864f0d60972db0b7533f02acc40c72c0550e08c1cb3
TLSH
T1F3B02220C002E302C08203B02FA080FC30A0CF33CA030202C2E00F23CC2223000220A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 c37352171ddf8b5f0a27f352e6b494bf9ef54740cceabe9c10eb66b54253e9f8
MD5 0c03129c796d91269ed90466674828c9
SHA1 1d02891c0fc02125daeed9694b0ba7d1525237d9
SHA512 b403db519518e98e6cf79eea2a7b84403a534377fe507f3e0cf091135494728acace7203a767297746851d1cdb38e41ea0057f080f1f77670a667d23f3aa8863
SSDEEP 6144:a8i0Aw9NDv+qw5ZtA6m7Rkm1tYpBeh2BAoy:aeNO5ZtS9oBGcAoy
TLSH
T1A83412375F22DC779E98766A600F4B0F1EF0AC2AD914DEE788C47B0853A9ADD141A934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 bf6a91f041f700f9304613bc5216ac3e7723850448eea49ef90202905941b518
MD5 75b731a9246aa8e1c75139afb48b730b
SHA1 d322dd9fa0d66357124fbb213f8f192bb5fd1c3f
SHA512 8fcf556306d33df6ccad0241886a96ab8587bb8d629a7c7e438d6856569eb3345464b3a7b0bc5ccc4089e2a84bc68da3cab87287a18663f922733b0dcaf4ec9a
SSDEEP 6144:bV8i0Aw9NDv+qw5ZtA6m7Rkm1tYpBeh2BAoy:ZeNO5ZtS9oBGcAoy
TLSH
T1533412375E22DC778ED97A1E600F5B0F1EF0AD2AC914DED798C87B08639E69D181A530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6217203323e34d13fd62e2edd54d42629bd244ace318b3f5296cf6cd7d1e4eac
MD5 e2176c885eb2a3609410df6947b0896a
SHA1 4473401623d2a7aabc66ade94b35d41611aa789b
SHA512 df9bf9639fda0019e53e291bbf31002cb7ead5b9e20f1baabfc8d0254c9be55271fef9c62cd84dfadc8f3d2e2fad1e92f449d16a1c1bcd2e7f35cffd05084b66
SSDEEP 3072:/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:um7Rkm1tYpBeh2BAo3
TLSH
T117C312275E75E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D86A0437E97CC0A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 467a9d0c69c7612c335627c0ef7ba783b053c8253d1a7725f01a68527cd558d5
MD5 f98e249486624b4d57a68efe5b088742
SHA1 46c0df04ccbb168a1e8777182d178afa0a0148f2
SHA512 01039545720bd63fa944a4134a1147903275851a66db810e87f05955de6262ceda73a379f7d91e2f3f58c24392e00173a0facb371db4c2fd0500ed495f0caab0
SSDEEP 6144:r8i0Aw9NDv+qw5ZtA6m7Rkm1tYpBeh2BAoy:reNO5ZtS9oBGcAoy
TLSH
T1BE3412375F22DC779E98766A600F4B0F1EF0AC2AD914DEE788C47B0853A9ADD141A934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 c56f75c245ca43f4102f7a33606c1d564b9e5a71deaa04e4c9b4c06c916715c2
MD5 d80455f3cf80ca0865835d211d2ed9b3
SHA1 c165f4e02d8f59d4293ad5aa13d22d14fdc029a1
SHA512 349d3d2ef5e3b85f51bb9f53a6ae3abdfac255b833c50cb4434a3623db15dfbe6d050b1fc23289e77a4339054819d6795f6500ff69c2bb40375a0730e7c15a4e
SSDEEP 6144:LV8i0Aw9NDv+qw5ZtA6m7Rkm1tYpBeh2BAoy:peNO5ZtS9oBGcAoy
TLSH
T1EE3412375E22DC778ED87A1E600F5B0F1EF0AD2AC914DED698C87B08639E69D181A530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sht.xml

Path C:\Users\Admin\AppData\Local\Temp\sht.xml
Size 689B
SHA256 da70c7214550f4ac3e40ede73a0c672859abc836d277fb160405075c4f959d53
MD5 b94e79bdf5689dbfebdb749372181a87
SHA1 100e6a5205debee17a3332c23ec92c361f93c100
SHA512 30e809b38fae357d31bdbff78e26a567b363ae65e6cb0b55f30a4a74d11498a29f6e459ce1e20d387979f9eda96253729428be3e5f484704f7ae59b9ed2ca66a
TLSH
T16E01FEA1DA84F51B03764E39C393568376ABAB6649B1013CD8C48C3CB88E48F720227F
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsHostManager.exe

Path C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe
Size 2.4MB
SHA256 969018ad2b0aae86834a7e1895ed21de10a02535ecf94e21f5dc6799ce909303
MD5 2538f6a2c4a9efdb730c8c13adf0cf5b
SHA1 66c18413ba10d738ed9b894bde76e59cba179865
SHA512 d266208cd7b888cf169113be74370c42729dda1809ab3197df685f7ffb3b0d79dba5645ae949b20a3362cb53d7d869bc5e863d049db5d352d4e301443c184a08
SSDEEP 49152:o9EeNSPwEW3cFSI4Tfm3hvbHsjAJcAMkPYUiPzmE6/i:o9Nzm31PMoYHmz
TLSH
T1A7C5BE4AB3B8019CD5BBC17CC627670BEBB174451710ABDF16A086AA2F23FD5567E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whm_ws.log

Path C:\Users\Admin\AppData\Roaming\whm_ws.log
Size 148B
SHA256 3526c49a38aeb3dd2ef1d0e6b42d11d588bd7336542e00de03159a217a68a67f
MD5 9f3eae002d52fc175978b8cf88f5e89a
SHA1 a0b4784a0d6576f3009c20e9000df3ac72bd579c
SHA512 8a6b07fd641b6451f347c64f0819f6cf0dd66ad7f4c00137c72cbe556ec3f5f0162d17b1d7a63a84b67ba402e6513ee58ed38e9683980ba078515da616bba573
TLSH
T197C08044C8C1132344015C0C401B1462015341F3FDD0D04D8023FC8DCD03039111C074
MD5 SHA1 SHA512 TLSH

Submit Download

whm_ws.log

Path C:\Users\Admin\AppData\Roaming\whm_ws.log
Size 306B
SHA256 187c22826e50caf07ac189532040846191e8a8eafba86346408d9678e0436cbf
MD5 cb6d198be1b6bccac110dd1b9353cbcc
SHA1 b7ea6a86dd94db48e9bac3d1bef20ab94b6c7404
SHA512 0e5a6b41f4187d41ce9b7f20ca5e01f051fde577bdc2ecb003c32e192bb9ba1109596235b2f5f8935fad40a38d3a2b5a84fcf2e49a636a0032d36206258c7bc2
TLSH
T15EE08684DCA123774503BD0C99565EF3536342F7BE70D54D90225C8EEE5302D521D1B8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1408-21-0x000001FA7D220000-0x000001FA7D322000-memory.dmp

Download

memory/1408-22-0x000001FA64AF0000-0x000001FA64B00000-memory.dmp

Download

memory/1408-11-0x000001FA64AF0000-0x000001FA64B00000-memory.dmp

Download

memory/1408-39-0x000001FA64B40000-0x000001FA64B56000-memory.dmp

Download

memory/2776-0-0x000001E9DF1A0000-0x000001E9DF410000-memory.dmp

Download

memory/4360-20-0x000001CBD0100000-0x000001CBD0116000-memory.dmp

Download

memory/4360-23-0x000001CBEA210000-0x000001CBEA312000-memory.dmp

Download