hxxps://bstlar[.]com/4SW/testuser

Analysis

user interaction
yes
max time kernel
144s
max time network
173s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/08/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bstlar.com/4SW/testuser
Sample260802-vvn96axeld

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
219	980	chrome.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
81	discord.com
83	discord.com
124	discord.com

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2144	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
980	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301647438485974"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1741132852-2793423776-1557670484-1000\{7786BBCC-A3C4-4AF8-B902-E53290E1DF9C}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
3352	chrome.exe
3352	chrome.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe
Token: SeShutdownPrivilege	2560	chrome.exe
Token: SeCreatePagefilePrivilege	2560	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe
2560	chrome.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 1652	2560	chrome.exe	84
PID 2560 wrote to memory of 1428	2560	chrome.exe	85
PID 2560 wrote to memory of 1428	2560	chrome.exe	85
PID 2560 wrote to memory of 980	2560	chrome.exe	86
PID 2560 wrote to memory of 4780	2560	chrome.exe	87
PID 2560 wrote to memory of 4780	2560	chrome.exe	87
PID 2560 wrote to memory of 3600	2560	chrome.exe	89
PID 2560 wrote to memory of 3604	2560	chrome.exe	90
PID 2560 wrote to memory of 3600	2560	chrome.exe	89
PID 2560 wrote to memory of 3604	2560	chrome.exe	90
PID 2560 wrote to memory of 2228	2560	chrome.exe	91
PID 2560 wrote to memory of 2228	2560	chrome.exe	91
PID 2560 wrote to memory of 1124	2560	chrome.exe	92
PID 2560 wrote to memory of 1124	2560	chrome.exe	92
PID 2560 wrote to memory of 820	2560	chrome.exe	93
PID 2560 wrote to memory of 820	2560	chrome.exe	93
PID 2560 wrote to memory of 240	2560	chrome.exe	94
PID 2560 wrote to memory of 240	2560	chrome.exe	94
PID 2560 wrote to memory of 968	2560	chrome.exe	95
PID 2560 wrote to memory of 1384	2560	chrome.exe	98
PID 2560 wrote to memory of 1384	2560	chrome.exe	98
PID 2560 wrote to memory of 1764	2560	chrome.exe	99
PID 2560 wrote to memory of 1764	2560	chrome.exe	99
PID 2560 wrote to memory of 1984	2560	chrome.exe	101
PID 2560 wrote to memory of 1984	2560	chrome.exe	101
PID 2560 wrote to memory of 4756	2560	chrome.exe	102
PID 2560 wrote to memory of 4756	2560	chrome.exe	102
PID 2560 wrote to memory of 4400	2560	chrome.exe	103
PID 2560 wrote to memory of 4400	2560	chrome.exe	103
PID 2560 wrote to memory of 3276	2560	chrome.exe	104
PID 2560 wrote to memory of 3276	2560	chrome.exe	104
PID 2560 wrote to memory of 2004	2560	chrome.exe	105
PID 2560 wrote to memory of 1492	2560	chrome.exe	106
PID 2560 wrote to memory of 2004	2560	chrome.exe	105
PID 2560 wrote to memory of 2672	2560	chrome.exe	107
PID 2560 wrote to memory of 2672	2560	chrome.exe	107
PID 2560 wrote to memory of 2136	2560	chrome.exe	109
PID 2560 wrote to memory of 2608	2560	chrome.exe	110
PID 2560 wrote to memory of 4796	2560	chrome.exe	111
PID 2560 wrote to memory of 1028	2560	chrome.exe	112
PID 2560 wrote to memory of 1028	2560	chrome.exe	112
PID 2560 wrote to memory of 3352	2560	chrome.exe	118
PID 2560 wrote to memory of 3436	2560	chrome.exe	119
PID 2560 wrote to memory of 3436	2560	chrome.exe	119
PID 2560 wrote to memory of 3308	2560	chrome.exe	120
PID 2560 wrote to memory of 3308	2560	chrome.exe	120
PID 2560 wrote to memory of 3864	2560	chrome.exe	121
PID 2560 wrote to memory of 3864	2560	chrome.exe	121
PID 2560 wrote to memory of 1040	2560	chrome.exe	122
PID 2560 wrote to memory of 1040	2560	chrome.exe	122
PID 2560 wrote to memory of 4168	2560	chrome.exe	123
PID 2560 wrote to memory of 4168	2560	chrome.exe	123
PID 2560 wrote to memory of 2688	2560	chrome.exe	124
PID 2560 wrote to memory of 2688	2560	chrome.exe	124
PID 2560 wrote to memory of 3512	2560	chrome.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bstlar.com/4SW/testuser
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffcab49c728,0x7ffcab49c734,0x7ffcab49c740
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,16312737671438277367,13724601270903296255,262144 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,10731865013604084287,6657878314520492959,524288 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,10894713746802108339,3117191621233645425,524288 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,10817923064351822502,371570060138280677,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,5072771867428293841,13787837960818763716,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,2220811581387543159,10552856297318694066,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,17290922337580350348,1663388128676404530,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4892,i,2243833234130028033,17142853977322970498,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5020,i,9628794093243101183,14068420617348472790,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,15242607140361315666,776344330342049261,524288 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6096,i,5739454229070758286,15443974912750566833,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3392,i,7694469976006607661,2504747845822200882,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6072,i,9486320715385543024,13551787287037050312,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3400,i,5708787952746145287,15348156128412230649,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6212,i,9898199491674211512,7214783704473933260,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4908,i,5445822930917836699,6007624281766327135,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6276,i,2395929908020456541,6169564276693425119,524288 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,8353358324433660873,11178334083236453957,524288 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5508,i,7208697468066990221,16158133069679537551,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,18346163435319413945,11035578649315576279,524288 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,13823392736779324497,12175896151608063577,524288 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6528,i,16878285982547209108,9153149899368378116,524288 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6692,i,1700421004533733812,7203926329191125843,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6928,i,12664196045279147021,14926576315299950223,262144 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6908,i,14937137716295093953,15121294269792149682,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7008,i,3157924630863031745,1421333052936326444,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6956,i,17588975439064458756,17473300753260980777,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7148,i,16388582788799272173,8257943275031504854,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6904,i,6347413977567014047,7588610152150894190,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6992,i,12985329161416036475,15371195775516017196,2097152 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6900,i,2771940533055022689,13515280158358581937,524288 --field-trial-handle=1964,i,17000520969257551410,6386177445937550625,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:3512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2308

C:\Users\Admin\Downloads\IceFree.exe
"C:\Users\Admin\Downloads\IceFree.exe"
1⤵
PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con cols=65 lines=30
  2⤵
  - Executes a command shell one-liner
  PID:2144
- - C:\Windows\system32\mode.com
    mode con cols=65 lines=30
    3⤵
    PID:3860
- C:\Windows\System32\mp.exe
  C:\Windows\System32\mp.exe C:\Windows\System32\drv.sys
  2⤵
  PID:4396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del C:\Windows\System32\mp.exe
  2⤵
  PID:2308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del C:\Windows\System32\drv.sys
  2⤵
  PID:2368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 06c6b64da76f539677b547b7dfa0dd414dd96067945b7ebf229c89caadb65ab6
MD5 536f21d881b01d14cc49ce2b6985197c
SHA1 764a6a333651473f84500edde6290d2e02d3f2e7
SHA512 bb7c5dabf1fa6fa3d91c531b682ca7eb290b0ef7d38c0bc5bb89c0b8ffb3ca98e0cd298af8f65d8f8b7727aeeb00b60fd53678f6955658f3432c6aaa04ce9eed
TLSH
T144E02B69C831EC3758FD072950044B87D75413172680895B7A3CA10CCFB173A419681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9078110b4bc55f40110379e56ade756ee8226013de87ae274c1ab79cac9277eb
MD5 b750b0cf87f768ceaffbf80320b49420
SHA1 0361093d5944ddcb83737612511c2ee5bab19056
SHA512 d9e99fddc4b64ed52cf43865c5e1a85f0a1b4c64c77031763ae6a8add38cb7c34b7dee1736e1bb04149079e02d820b01c0549f662d2d26d90734c174d6ce6e62
TLSH
T17A614BC358608AAFCB52597B00E20762B1B17CCD814B8DE67D5203BC32D1F7A73A208C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9e90fd0dad620d312a3c8ac456d8512b5f995046f6d15c38b076c3a0578aff5a
MD5 6f8948110d2ba995073a09c942ced47b
SHA1 189a6e175444f677021ddc15e4f280aa6bf30e82
SHA512 dd2d854309591795c43f2eeafe4fa03abee486b8347d3f1b0a318dad6a77617638127be8371bd88f36a7e7d3f572995d38401491fca99d5ece005a7590ccf243
TLSH
T1AC8162C364A245AECB61997784D50B71B171AE8C80478EFA7D72437831CAFBA33211EC
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b2a74d09d07de4330bb0bc7a1bf62eda3b2b4b071299bcd0dd04a7b11b53c4ef
MD5 2c6e9faeebae338d6fcff5196b4bc103
SHA1 20bf682dfe17f5735d30001cf628a0e842b375d2
SHA512 f5c981728fca26ff2f8863e29c8d8112438cf7a56890e4f0c4c3932f3632d9997d611d6e4578093a0660c3b775e442973445a0f1077b738e76b9545da466aa2c
SSDEEP 192:DMyoLo2HShV7CaIiy3x28BIRxWXjDKN/I/uAoCfgbK:DMyoLo2HShV7CaIiy3x28BIRxWXjDKNi
TLSH
T11EF17EB3C3E5C62D991166F4AB246E1FCE1D0A18531C3C3AC9D9BE4B93E2971E111B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 0161f8ffc7094a67009c53969af3641ed019832621201b9ab496bd38ef461775
MD5 4c2abe5564c0adc7bf56744aa1e27335
SHA1 bacd30c879cc29b40279747f5814e29be167d3fb
SHA512 acbd8c88c279fe5ac94c7321f6e6fc162e92c7d458e5d9b9e24a2447c34c383664edd5b371204e05a2e37371e6c59efd3dec86b464375d558721643e80af64fc
SSDEEP 192:DMyoLo2HShV7aWaIx3x28BIRxWXj3N/I/uAoCftyfcYfQb:DMyoLo2HShV7aWaIx3x28BIRxWXj3N/6
TLSH
T190F17DB3C3E9C62D991166F4AB256E1FCE1D0918531C3C3AC9D9BE4B93E2971E101A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 79561cc901ce2780b26ba50391410dce95a9071e029a0218199fd8ac0aff8c34
MD5 c1d568640f169cc92743d09c376d06d5
SHA1 a02aae525e7ea97ffd2d084c323ba41a94333df7
SHA512 7627b3a33c0226cb1b30f1ff0e64614fded3904b4164085e76758e75bffcc16a9a27565e035df73bb1cc33ac5c9b509c1c96f4ebbb683d54dba13ff42194332a
SSDEEP 192:EReb/GcpmU/v7PpAPRp2YnX9YHsb+WNnkP1e126khEeG29bahWVyIsnAUge:EReb+cNXjUXFWwgi2Thc2lase
TLSH
T1F642A56AB914693B6DCBC219FA677757D7F5102221E02DC0EAFC8A2C14EF6CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 29af153cdf958535c6f7ed8d6a0592968b1f140e33db67a73849aafe0f419ad6
MD5 2354f440940d101b45191d5f77ab76b8
SHA1 549e6fd0de8ec9587969c63d9092c1b2da50b3e5
SHA512 789300a1c8d50116c23cb57a2c8aac005551a6ae396c46ebe4b1c3921c611101b4da2f21e064d12d8ccf794c6329e39c05499afd3cbd7bb985cf160690ca60a5
SSDEEP 192:BaRebGogT6J/mUNv78OpOPRppYnYv9YHsb+WN257vje12akhEeG29bahJVyIsnAI:cRebvgT69tIOOXdWw+E2zhc2lapE
TLSH
T15C52B56AB914693BADCBC219FE567B57D7F5102221E02DC0FAFC8A2C15EB6CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4ef5ad1e531de86ab5c946eb461cb18732bc48e1a99d1fb875a54d23f382c180
MD5 79c226d7714be55af4935e3c391ff61c
SHA1 d6f64843f17b83a659932501bf39546ee205a27f
SHA512 c9273409bfc39969f1a0f18403e9486e7df38406ff13df5523a9d44511e6116d0e900be30f2416c805928638af46bae122c8453df1bb9d9e7d766b4da2bab17e
SSDEEP 192:BaRebGogT6J/mUvv78OpAPRp2YnYv9YHsb+WN25umIe121khEeG29bahVVyIsnAI:cRebvgT69nIOUX0WwOP2qhc2laNE
TLSH
T1FE52B56AB914693BADCAD219FE177B57D7F5102221E02DC0EAFC8A2C15EF6CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e01d55126ccc36df9b464376add3aa5d6378537dcd0101cc0964d317aee3d1d9
MD5 4f7261f4c5ae035194ec4f11d66e34ca
SHA1 9cb1c9df861a7f82c789ab63b8af232822cc6369
SHA512 281ade1ab87bc96e7cd60f18637968360f20a89d2fd3dc0a36d55ceec90c198cf6f14453548d51f193de838de88308a25cdc25f38c693ea251858c7ad1306ec3
SSDEEP 192:BaReb/GcpmUvv78OpAPRp2YnYv9YHsb+WN25umIe12TkhEeG29bahWVyIsnAUge:cReb+cNnIOUX0WwOP2Qhc2lase
TLSH
T10B52B66AB914693B6DDBC219FE567757D7F5102221E02DC0EAFC9A2C14EF6CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 172707eb01993b8627824b0bbdf48b66505104cbc1a99837e7e656a95269ecd1
MD5 c57feb006d88ceda6a2ce7a4ce0f3826
SHA1 3721fafcf699ef2884a9961396c69fa04b623628
SHA512 67ec5cd42cd2d369a3a86b07528f3820cd85b51137a8bbd5522ef0c924d9ec30dd3b9a4d25c2757821efc768656e87289f35ced453e8ae0370e605714b863848
SSDEEP 384:cRebvgT69wIOOXH5jspyWw763YKe9hc2lapE:HbvgT69POqWw76uA2c2
TLSH
T1E562C65BA9242977ADDBC229F912775BD3F5102221E02ED0FAFC8A2C15EF6DC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b47b3639913eda2fbb8447bfadeda36dbb90726f6bcd8381ae7fd952b4e18a48
MD5 17aa7c14ee49f62d5da0b18b3fa4dd74
SHA1 ea368647bd2b2093e8bc8182fa930a6807613b84
SHA512 76cbb9455a3c27ed8b87710abc38cb3050ae025930b1d5cf60afb513d2ce38d6986da8b9200d9aca9417753b6277a6c6e5e7efde72a7f305ee3055c104d560db
SSDEEP 384:cReFvgT69wIOOXH5jspyWw7I63YKe9hc2lapE:HFvgT69POqWw7I6uA2c2
TLSH
T1FD62C65BA9242977ADDBC229F912B75BD3F5202261D02DD0FAFC8A2C15EF6DC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4438812d966e1d11c2f4b4dcd5703934145668a842e5f18c309b93e6cd0ba09c
MD5 1386314059085d62a9101bbf1a039b65
SHA1 c0c9d9db0103f0aa592eb50b557e1c7af59924f0
SHA512 f7b9944b5b23df4170a875adebfb1950f8d576c4adda2b26467f584019e888c6a674a0a567adcf681cb9c5f7c120924ecf6d54fd0463d975b4fb31a520df19c2
SSDEEP 384:bxj3K7KxkXqKf/pUZNCgVLH2HfgslcP7pLuLcSjlAXOD3u+ErU3KMHGu/g2kRm:bR3K7KxkXqKf/pUZNCgVLH2HfgsmP7pS
TLSH
T1FF72F967784C9E370F94CACCD8177B4F9DB5015B65E9886483FA581903D8BDE11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 af930f6e5f8e429ccfe8be937a3e1dbd0452552ee5002dc458c55aedb3138abb
MD5 afb95b23c6099b0e50f742f323223261
SHA1 b0a24df7e3118f8ee5234b4c701b76b606555623
SHA512 d8dfe7ead0ac8b903ba597b0e8a06a86fb7ec2c632a57561a078bfa06a212cdd6ef67449c46ba1ca3167e6cf31d89ca9a0a0ec101490062ed72528893599e714
TLSH
T1FBD0A75BE12A0495FB664A920662155E42542C8864C6818CD413781D18B4E87D221F76
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 f0408b03be2c4d5873a6b0dbacd7245306d9624647e6d96312ac3edef7b3d815
MD5 a6c932bce6dd1fb2a2220811f33b6f76
SHA1 6848e404291783fa5f10085c867169888ae2fe57
SHA512 a84b49ec9a290a6e2bbf5609eeba5cc5932ec6bfb25cceae0f517bcf7465f05714643835bdaee6042034b9d08b48bb5c76ee3e472044d29517572a3e62692c7f
TLSH
T1F9D0A75BA11E0595EAB64F910652155E42142C8864CA818CA413591958B4E97D111F66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5867dd.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5867dd.TMP
Size 138B
SHA256 e6b1a814913c1b3e94ecb2c4af2e14df4c79e9e28637e5ab88afce718c755452
MD5 98fe849d5246d3f668e438a838f3ee3e
SHA1 57fbf83b6b739d69a316ced006a5ab35f53582d4
SHA512 bf8edcbdf6120d97a9a530143321d9f6d8053b5a3f88d94b1a233857af4d18d823800d829dea4b4dec15ca8f63e550817cb018210e1e15d97b9041f124dae40c
TLSH
T141C02BD3A10F00719F2402910233154D43042CCCACCAC08DB41338142470E53A201FF9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a12967a1c1d19aec93136cc9cc17ca3393508e7669a05874ece2811ff3faecc5
MD5 9ef701320dc185b21fabe2c2a72667ea
SHA1 c6a5caf0160c265689d2f71d710807a43601f259
SHA512 216b3b36b0c4acb394162dc81ca045c956375530591d7aef05e556509550849155bd0eccf98234b66c283acf240e148ac715fd628c5cbf8aa9a92e6ed182b996
TLSH
T17EB01260C0015141C42702F85A532ACCB1149F309A0E170193E06E32E8391518025090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588a59.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588a59.TMP
Size 96B
SHA256 3054eefc925501c006b210f3371d42140f5b7c54359b8951f9ac8ff14f426b72
MD5 a20e32d1dd6d997e55fc876006f55794
SHA1 1a882adbc4e3546b285fc96a340b199f2e085c4f
SHA512 7503e2faab170a9939361f3e46e7fa31caba61cde6df3aee822727f27d0f4db6a46b0ce40d3e162de4624b06f89915d365c49a9cc0a0a5ceae6eace74c31505e
TLSH
T1F9B02200C0023332C00303B02ECC80C830A0FF2AC2032302E2E00B32ECE03220823020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 62eb620f4412ee651114afbeccbc2fa4e5b5f9561368572aac7bac87306fed8e
MD5 bb4a0fb2d2813e3df6188b0972f9231b
SHA1 64dc63eafa3de1c7c2b5fc05c678da1a908e176a
SHA512 a37b3e964eb069c64d848fea3d0cb81118cd662e15ccc94136a962c0835ab042ab83531bf4dafa50bffe40a2c4843fc598330933932fdb4fcf98d4ef9c3386ca
SSDEEP 3072:knSGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:knlm7Rkm1tYpBeh2BAoa
TLSH
T10AC3123B5DB4A8375DB9BB5EB08E0A1F1DF149A6CD20DE51C8D85F0827EABCC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bac151abd96a3e45018b73f59110282f85d32d29a569365102e1b8726bf7c81e
MD5 6bd10efbebf6ad85c38b09af5bdd053f
SHA1 d7ec693268544dfaf2a4a574f14fa90fff05f9ba
SHA512 e439934b965de2ae5a88c48eafc9580367e3a0cef23b56db2b6f093a933c15254324439aa2087d41da24ec5367e74039b997fb9016d46724f34a9e4aee8e0b6d
SSDEEP 3072:kwZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:kwYm7Rkm1tYpBeh2BAoa
TLSH
T10AC3123B5D64AC375DB9BB4AB08E0E1F1DF149A7D924EE51C8D86E0423EABCC0945A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b193b9b7292479f1dabb6780e32a0c5418d88d7b36e889d798889e0e0a74d641
MD5 3669590b937d23360cb9c131783a3a53
SHA1 7773117cff4847d25c81de9d5ee50b519256c865
SHA512 6ecbae7eb4d7530ffe9858f442de2d92a9edf79df31e3fc07303bf1933141694f6d1f2d4aa51d9c23b6378fb0e6dd483cafdc0b65efa214123ebf3fbdeb82fe0
SSDEEP 3072:2IGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:2jm7Rkm1tYpBeh2BAoa
TLSH
T1E7C3123B5D75E9375978AB4EB08E0B1E1EF149A6D930DE92C8D86B0437FA7CC0908934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f0b085ac3d294a7df3ff5164548395ed0fb30566da7b8f620c59a3398d31e1c9
MD5 701ea2c06fbeadd8830d179a6e1ae5fd
SHA1 c795e92a39c6fb9f9a7f088533eb9078d7cf0843
SHA512 4ec159c3dfaca1652ae362c32f8d3fdc44a82e46c3e7c2238908e62c97c0a908d7be891b96c44b21e56d89f29abb7566fd7740f365049474296e7f34eeab132b
SSDEEP 3072:/HSGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:/Hlm7Rkm1tYpBeh2BAoa
TLSH
T1EFC3123B5DB4A8375DB9BB4EB08E0A1F1DF149A6CD20DE51C8D85F0827EABCC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 10280d82ab3f4199d2c1ddde5ed968d3a777cff15d19a57149d380338d136f31
MD5 dd5098449b01cab1b3cce7028d581c2e
SHA1 129f002290f89f4789bf0774f91fd5ffcee41136
SHA512 023a24f349d4f957cf09caf7322779cc0a75e2b9f66a368d91fca07d2b20c5c699342eaad9b8a264e15c080e0e0b44c7e1eba2ae4af8fd93a9b16c52625b46b3
SSDEEP 3072:/0SGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:/0lm7Rkm1tYpBeh2BAoa
TLSH
T15FC3123B5DB4A8375DB9BB5EB08E0A1F1DF149A6CD20DE51C8D85F0827EABCC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8947279ee140013e1895aa970cddd36136704445afc5473ffea03d0bef5ad632
MD5 44356f19b795f81962dc58d3dc6aa9fa
SHA1 af0fb8085b01f8a441f4de2603fc6aa29f43790c
SHA512 ce7faff8fcbfe276d9108a72114eeaf00f297b4d277e393a06841c2d3c15905b2f2672638998685adc6cdb81a80d432daeb210c9e95d2f8239ba762252ce6d64
SSDEEP 3072:k0ZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:k0Ym7Rkm1tYpBeh2BAoa
TLSH
T134C3123B5D64AC3B5DB9BB4AB04F0E1F1DF149A7D924EE51C8D86E0423EABCC0945A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 932755.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 932755.crdownload
Size 1.4MB
SHA256 2b405d7aeb22c1b9e47f1643c42765ffd8ac1a587a0555594ff4f7bc94cd3bdd
MD5 2932a33c9011de24dfba71cda11f5110
SHA1 0c503431e75732337ea2163990367eeabd7a5ac2
SHA512 dc2a2763abc3116d39fb2009eb7db0f9bdcf36c566806febc5e5d3b17d34f51e4df412c4c7af78409454a9aa7ab38614a7664a7b1082d7708efacb6f3200f73d
SSDEEP 24576:MGngyo3KASa5yaDL8iLn5O4UUUZyFlXgWgYDv:RGp8EL5LnAjUUZyFgWgYr
TLSH
T17B65AF1EB9570669DAA2E8BC8275A207F321B54D2F6049F373D404E83B5BADC1779E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drv.sys

Path C:\Windows\System32\drv.sys
Size 36KB
SHA256 9a7c1b95f0760dc1a771a60c3515d29d4e080284427aea833a9620536a0da2cd
MD5 fb17db4adb9cc864db110da78e844e08
SHA1 429529158a6f0b3feea39be15e034a4a2201cbe0
SHA512 85eb33c794d335145b3dab33668fcc939c2032eefe6d6c742b712a8528d62b5375d510ab5549fb4be681f35e0ecca9856936a44b2c0a58d06650869a61d0962c
SSDEEP 768:zWuz+pWS8beZzwI8HVojepOf9lxwIKNdRDuY6K:VmoeP8HSjnlxwIQRDc
TLSH
T1A8F23B42B780A0E8E856C178CD56D777F37670517321AADF1760CA3D2B62EDA2B38790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mp.exe

Path C:\Windows\System32\mp.exe
Size 289KB
SHA256 ac6a3cac90ce9f90aa98ee1dd940b020b6aeec4b45e78be637e3cacbdbbd43fd
MD5 ae24788d342d7208cebddff95db5e87d
SHA1 1e1f10b9a44c0df34bae7324429d08e0e918476c
SHA512 f261922c0fab9fd52ea0d56fd2abd07bf44517456843785d7ad072f2aa17eef45560999ec4914f13eb0ca11e01c5e7de8e4c0cac72e4d6fc5df0ef1efdcdfd39
SSDEEP 6144:vxqrY364QuBiTEEikmafoD7gmDYmWlPp6dJU:wc64bWmCmDYDFJ
TLSH
T16454393C9D472969E6D1A9BDD23A4103FB21F84E177008E776F840E9595EEC8A73DA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download