hxxps://surl[.]li/oosalx

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://surl.li/oosalx
Sample260804-lkrsvsgh46

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
79	664	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
2956	amsrani.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
295	api.gofile.io
297	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
664	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303097919309828"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1236	chrome.exe
1236	chrome.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1236	chrome.exe
1236	chrome.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1312	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe
1312	taskmgr.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 4264	1236	chrome.exe	85
PID 1236 wrote to memory of 4364	1236	chrome.exe	86
PID 1236 wrote to memory of 4364	1236	chrome.exe	86
PID 1236 wrote to memory of 664	1236	chrome.exe	87
PID 1236 wrote to memory of 2372	1236	chrome.exe	88
PID 1236 wrote to memory of 2372	1236	chrome.exe	88
PID 1236 wrote to memory of 3336	1236	chrome.exe	90
PID 1236 wrote to memory of 3336	1236	chrome.exe	90
PID 1236 wrote to memory of 1696	1236	chrome.exe	91
PID 1236 wrote to memory of 1696	1236	chrome.exe	91
PID 1236 wrote to memory of 3420	1236	chrome.exe	94
PID 1236 wrote to memory of 3420	1236	chrome.exe	94
PID 1236 wrote to memory of 820	1236	chrome.exe	106
PID 1236 wrote to memory of 820	1236	chrome.exe	106
PID 1236 wrote to memory of 4164	1236	chrome.exe	107
PID 1236 wrote to memory of 2956	1236	chrome.exe	108
PID 1236 wrote to memory of 2444	1236	chrome.exe	110
PID 1236 wrote to memory of 3580	1236	chrome.exe	113
PID 1236 wrote to memory of 2620	1236	chrome.exe	114
PID 1236 wrote to memory of 4156	1236	chrome.exe	115
PID 1236 wrote to memory of 4712	1236	chrome.exe	126
PID 1236 wrote to memory of 4712	1236	chrome.exe	126
PID 1236 wrote to memory of 4628	1236	chrome.exe	128
PID 1236 wrote to memory of 4628	1236	chrome.exe	128
PID 1236 wrote to memory of 5472	1236	chrome.exe	129
PID 1236 wrote to memory of 5472	1236	chrome.exe	129
PID 1236 wrote to memory of 5540	1236	chrome.exe	130
PID 1236 wrote to memory of 5540	1236	chrome.exe	130
PID 1236 wrote to memory of 5884	1236	chrome.exe	131
PID 1236 wrote to memory of 5884	1236	chrome.exe	131
PID 1236 wrote to memory of 3892	1236	chrome.exe	135
PID 1236 wrote to memory of 3892	1236	chrome.exe	135
PID 1236 wrote to memory of 3944	1236	chrome.exe	136
PID 1236 wrote to memory of 3944	1236	chrome.exe	136
PID 1236 wrote to memory of 1412	1236	chrome.exe	137
PID 1236 wrote to memory of 1412	1236	chrome.exe	137
PID 1236 wrote to memory of 5952	1236	chrome.exe	138
PID 1236 wrote to memory of 5952	1236	chrome.exe	138
PID 1236 wrote to memory of 6076	1236	chrome.exe	139
PID 1236 wrote to memory of 6076	1236	chrome.exe	139
PID 1236 wrote to memory of 5320	1236	chrome.exe	140
PID 1236 wrote to memory of 5320	1236	chrome.exe	140
PID 1236 wrote to memory of 2736	1236	chrome.exe	141
PID 1236 wrote to memory of 2736	1236	chrome.exe	141
PID 1236 wrote to memory of 1424	1236	chrome.exe	142
PID 1236 wrote to memory of 4120	1236	chrome.exe	143
PID 1236 wrote to memory of 4120	1236	chrome.exe	143
PID 1236 wrote to memory of 5420	1236	chrome.exe	144
PID 1236 wrote to memory of 5420	1236	chrome.exe	144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://surl.li/oosalx
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8f5eec728,0x7ff8f5eec734,0x7ff8f5eec740
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,5583531571453489531,10766175306316394123,262144 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,4745869277719096404,4993223001983911477,524288 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,16671634758596645214,2522322047250314792,524288 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,18414718916330099616,7988974525069725245,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,14921821928737235191,8577815751419800212,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4580,i,15837805659842858997,8270620474172357317,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5096,i,15809416584661736356,6052824448757397930,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,3705042298148936571,14003998829647815015,524288 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:4164
- C:\Users\Admin\Downloads\amsrani.exe
  "C:\Users\Admin\Downloads\amsrani.exe"
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,10908857254963291977,15224521927600892481,524288 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,9507841801488743403,9466058520994750122,524288 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,11239032627629523487,2826683831113772106,524288 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6260,i,8730617515449269075,8448467564938699290,524288 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5232,i,8850990558013853704,2996944404979007556,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4892,i,10421232168750540001,12835391187326790178,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6280,i,12679099216875117850,6205924350201644510,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4984,i,13469788827325828489,8849614106217943106,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4740,i,14298356898996282992,14748819881422601274,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6644,i,15384011850107365803,15387136301834177240,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6800,i,12711898246053737220,6703528313686087657,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6932,i,1321086826330975918,4532789769371131186,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4756,i,17281964667591698131,13615662383487646161,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6632,i,5568730701622866225,6094757362234495746,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6820,i,16418637470084138190,16279779831351674212,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6912,i,8404203207794777442,1011100239878997216,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7044,i,6312410478304875648,18242837186134377983,262144 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6524,i,8494740340475078525,5708573495696000827,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6512,i,8957614810473255450,8323649834685183579,2097152 --field-trial-handle=1988,i,10274295759229734479,10776583098657936556,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:5420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3584

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5941006c-f7f3-4bd4-812d-6bfa7054bdc7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5941006c-f7f3-4bd4-812d-6bfa7054bdc7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4f01e6054f7b1b2ae67b4c43f0e471e28e555fe82ef91545c5d8d2dbb46220cb
MD5 da0a9bcc073d07c6ac721927ff17c614
SHA1 f62a09764c8645d8887c9b6133431d0825673c08
SHA512 ee8a3213fda4e4ce40ff535e8543a967a21f964d8a39bdda979ed1176baa1c69c735b70900788f36ec5e352846aabb877533c6c823b8de445f44d354d24e6afd
TLSH
T1D8E02BBAC961EC2B28FE0718A0514746E754135F2640595F763D950C8FF0B3A5649C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 516KB
SHA256 98e2e1426c345187ad5de865c5e80bd96fffa27d6c0dbe40ff904c3f1ffaef4c
MD5 1f56c95e59c986fa6c4567a4ba45f0a8
SHA1 b803744d4e59f29c365e95ba380a3b5b2d9c54bb
SHA512 6e1a0ab9b27b01f746cf0b610a48863e4f9e79d9cd354c0ef286ccd6ec439b829af9a11514a88a50c09b9f016132a3e6371924bcf313fe590412425ae0e4e8d8
SSDEEP 12288:iIzahZfe/wQWPBogrQ+6rmuzDJlR0P+8UMd5cqi5I+:iKUZfAw1aGw5/JMdyqx+
TLSH
T198B42368EBFB35401CABD4C9AABC477601EA4D95FF0E10C34B84897064591FE9F6F909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 85KB
SHA256 a7c7f348cb569c3c0611a9770e59996a12addd59ee953f14cd43ab7a5385a544
MD5 05fa5ceef821aa829166af5090e7b64b
SHA1 1f75169794b01c5b207a8fa4f536929bb87064ba
SHA512 ee70f0e7d833c31e5d61761a1a0c966a62f05a002381cf7931343015a2174c6bc149e7db6c25e2f7351e0b1d5749843ca11c8a3fe974545bb1fbdefb2dc7a053
SSDEEP 1536:Je+8malJPEO8aLaRiQVtAYy4hnM0xUvoejFys+E9C/pn1vNXc7qkQNI1u:JFalJQvV9XBGocyq+pUqkQcu
TLSH
T1148312354FD07600199E6F1020BFEE5EAC5EDCCBA98689D05BC3A6B175E5B2C50C51CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 88KB
SHA256 1c1bdfeb6d0d832421175f93be476c436f5415819caf7dd51b88f6310f344646
MD5 2a6ecd1348786e873cf52fe916c30acf
SHA1 2a9f31b01d1d66cd62d8f1c4140175744dce14fe
SHA512 243bcdd6960dfaa366e47ea58df969df3449e16d47292a3a5b70f70ccffa95c9ec3ba75f3aaa7974de65ef0f75b1463483e04875e649aeb08dfef3ed037ac688
SSDEEP 1536:mrYS3V50WT7YOw2/gQenFOvUmBXoa9OKA/hU2MNTVAYgN:m/3VOc8CyIvnBXa5U2Mtby
TLSH
T1C393028EA96C38A1B742090A1629FE03DEFE90B75778DDC6917F63CC509388DCA97452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 17KB
SHA256 f1fea033bab7d86c4c471a3151ef5b1d4d5107f59416aa9504a01b6951c85f54
MD5 8185a32ba02001b8d529cf9d94217b55
SHA1 149def0fda603b8061de5d69e23ea8a012535fb5
SHA512 cc8a14c659493b4535807a7527ee668af11eebc392e2dbfc4f3412a17fe4b515f29ed953198aa2e99deaf7112e8398d24fdde4ce5f05d4ef65ba56186cedebac
SSDEEP 384:fY2YyEw3oaSuDl86ohNoYpkZ+YIjVVVVZq5gr83WNq6cNnAgQuFgNAaKuOj0Um95:fY2YyEiTWphNob+tV/qw8GsnjhoAFulz
TLSH
T1C272E12197A3E0245F0A19128FB919EEBA38E11AC039EC2BF3D05C750E5BFF555A35C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000049
Size 93KB
SHA256 c4f1f8d202acdd8e0c0df66748aa34a8f8633364344261fc96a781cb2e3ad545
MD5 58662d597a0d3353ce02ea33fbf2c00f
SHA1 f75081b6f99b141db35b173b4dcea434449b1676
SHA512 42893884a45f5eef025dad6543b31bc77fb184e32b3d21cd70ed29d39e6415a7d4444a4b7b380590d673eec646677e444c746c34628121f35db361a5a121e33e
SSDEEP 1536:b/yI0AUIBsBNEympTf4fkEKz6OWS9RlQcRH/dMxoySXU9:b0ABM7GTfjafquc1/G3Aa
TLSH
T1589312C7F4286D3B32A58587A1B889E1D0C9506C6136CC064F8D8BF4F6721DB73A282F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004a
Size 62KB
SHA256 0bf14107c0fb38526f8d1380431600e080558418348da34329a742bfa421c76b
MD5 38ff538e3c0358b9c9a4390c6eae93c7
SHA1 7dbc10e3f04415b838d74da088612ec0ef484d55
SHA512 abd0c5e6122a232c79c5bd8286a31b511e237712ac48cf02ae20d2bfbcb296c2fa710ecd2a08ab2460b09547eaecf3dae6ab788c77b53539335ddcb2257023e5
SSDEEP 1536:y81VZ0conlqFFrOqr9IIP/tbrKj6yJZYma6:H90DlqFF60RHtbrKjV
TLSH
T1BB530276FE6241C4C0259FDCCD55A19AF06D70FC8DD5022A065B440EDB9E2FAA2F9E4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004b
Size 51KB
SHA256 0f62b76843ff6af5f8a70eab23f901b76a1a81adee1eee2b13fbc04b58029ca1
MD5 9adb05093668c9070ca00b3a2c4ef702
SHA1 a4b78780ab20eb2eedf3f6c3a32f4c76ea175191
SHA512 6fc5650c5454c3c2505f32010052cbd97d82200f1251cec6bf3053b23d67000697e3dd7c18249a2100b8d40c3a2a83bae689c087ad521d31efe8557e43197d0d
SSDEEP 1536:PWgY5Fl/VKCanoGJZfk8v30uWxuzYyMXu4:+gYDj4JZ8K30qzLMXu4
TLSH
T1AC33020654BFB82B2FADAA559CE1BCA26ED03DE5472C4CC005D6ADC548BFCE0E9318D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004c
Size 57KB
SHA256 c71ebbf15d41b31dc61d06010476e7be47d747efd4e24cc4e954fc9c296f5c3e
MD5 212f383835dc7431d8d0cac2fcaa8744
SHA1 e37c37f2cc4ecd707f7cbcf50d276ae38fdf47cb
SHA512 b638b5a7ff8b5b675bf0081b1e42a82a9c100acce3742598107c8eb222c3380c3ad1c610055b4ea1b15dd0cfedfd99ea3b744ce7549dc8b27f9a7b6091506ecc
SSDEEP 1536:02voVjqLAGjobdiPJW5J5jeNCHAyuK0Jts+2i4zdAUGZc:tvoVjqVjIiPs7kCduKd+ns+jC
TLSH
T11A430151CF264871F833FAD0AF4811698129B1D1BB59B3772174EA0BCE509D1FEA0E93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 624B
SHA256 cd0a22759d174b8d456f6949b828578557fff64112933fa9557d17ebfc31fc12
MD5 a4eb2f00e751bf749cf0cf5c6a0819c6
SHA1 7530a7eb6379cc9641532dbb4a7e6d4eb955aba4
SHA512 faa734039aabcae338fb8deeb44feb6fd0827aaef67ba87aa45dca52c416418490ab6cf57a4e9c68ffd14841711d5b67a650ba52be183589cb0452dee901dad9
TLSH
T195F02017C2D4809CCFB906BA29E06E8EECA41C5AC7358F83448CF01BA50F2C1B6392C1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 176656e20b993d5a09d396f32bdb84ee34aaf246b4fa344115c365529b33081a
MD5 36abf64f95e3d21f3c237793527a17e9
SHA1 5709109e27855a86618d7e98797c70b64134a00c
SHA512 08587a91254a4136d8e56ea33e710cdf7835037e32e39b4b267d33e5a1369b7a546f2b272609c0f7d022ede8940228b7b43f8767e88c38c4f4712eb1242eeb23
SSDEEP 384:Dg31okUVTe/OdETjHzhBdDwomEVJFPRIabh0LHrFA4gYWVEBNOr1yj0VueEZjwUG:kr4UN4kSxo4W
TLSH
T1CD92BFF3C7D8862DC91166F5AB243E2BCE1D0918532C3D57C9E9AE5B93F1472E240A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 d6cf082c18162a0d63df63e160ac4efa06d85ba90f0ac7d820711890d7c5e81f
MD5 b20295119767f3aa438aeede9f10524e
SHA1 f0bfea429f511c84eb19a0f19d1a9d5306eb5eee
SHA512 1a0ef033fa511cbdcd39cd1716d707ae39b1373a3546aad0d9f3915810c5dc9fe0af84fc601813378ba8e591843159418527753bffcf3f786bcc5e2ccc2dd9a1
SSDEEP 192:DgrL1MJkoJVTejIaEaOOUh0LHrKQE54gYWVeXBUwOlzs1yj0VueEK:Dg31okUVTejIaEalUh0LHrKQA4gYWVEV
TLSH
T1D3F10FF3C7E446ADCA1116F1BB242E2BDE5D091A83783C46C9E8AE1F53F1572E24095E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f203478f3fb0d514facdd88e6b968ea3c795a439bf488d93c0c8af6a67ec16a1
MD5 c5c7d2bb683cd710fc2468f97ec9fe67
SHA1 ff662951a975a8ddd5395721d1b3fffb01b396eb
SHA512 93181d9525b7cf1e67c9a9d93edfba449aad236402815ad8e17090d30e99a157d6cb7239c5afdf4271be11a83a8917e8be8ace80abf0835bcd221e5c85dd174a
SSDEEP 192:6RgcBzSHuZv72vXPRpD+QQ79THsb+WNxw4ktErWi52PksnWg1saUvVyIsnAUgE:6RgmzSO5CXX2Fwm2d2csKa0E
TLSH
T18352C52FA920297B5DEAD229F9217767E7F6203125E42E94E6FCC92C14E75CC321700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7f16c066896c486131cc398e95c74fd1d130f2f6d549f434cb82c8ace233b599
MD5 3bbe45cc7f0ccdc4fc50c94e42cb7df0
SHA1 19696c77975d3eab1a9de35dead4943e0d3eccd0
SHA512 ead32b915a7da3393574eafb24e961c5e5e6c83670891f638e1291c5a7b2b0f0a4119abb94202fa4ab600636e307887db7488e2a1f6f3117863149b81b038757
SSDEEP 192:3PRgcBzSHj3Lv72vXPRpD/AK2lRz9THsb+WNsCalpeOFeRGErWTASzo2uksnWg1/:fRgmzSD3zCXXaFwB9ZF2HsKa0E
TLSH
T1A862B66BA970297B5DEAC219F921B72AE3F2203165D42E54F7FC892C10E76CC3117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6dd10355a511c1b58ee7834faf1684a917e0e57934fa6f1e5fcf381cde6f3c12
MD5 8518c305b8bb417ffd04a4a4bc478e8e
SHA1 c2d7cfa52116132e08ff7b36ceec7cb69b53c362
SHA512 7e1d324e3b8d44d2ffa93d0b91e21dc205e993dd9433c1e82127595145d662ff222c6695e56a1b1bf387154ca6b360dffca081a393995f105497f9f3fc24dd85
SSDEEP 192:3PRgcBzSHjwLv72vXPRpD/AKClBwlRz9THsb+WNsCilBopeOFeRGErWTASzo2ukQ:fRgmzSDwzCXXjFwm9ZF2HsKa0E
TLSH
T1AA62B66BA570297B5DEAC229F921B72AE3F2203165D42E94FBFC892C10E76CC3117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1633ef2084ee74f9e264da33d7b7ecae47038562d5944c5e83dbcdb6888aa083
MD5 55907f2f4a8e32043d147a0500ec5b65
SHA1 ec6488352800852ef4d02b6a2df51d85f1122b62
SHA512 e134f9177e019420ea68268e8c91d13f9bad0519d56a6393c956466cf2049659389adf9fb0de54d1fc27ffcba146b97d6750037be3ac663fdf6779c10c57ccbe
SSDEEP 192:6RISHjZv72vAPRp2Y79THsb+WNn4ktEreyksnWg1saU3VyIsnAUge:6RISD5C6XhFwt2e7sKaSe
TLSH
T1E142B52FA920753B5DEAC229FA217767D7F6103525D42E84E6FC892C15E75CC212701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 974b91023b91f0927e9c06000a773fc44ac199ba8776f77528a1009f3928dff4
MD5 0621921accbeb41950ff6b4a51551b35
SHA1 6580a94f21ce95b678ce30cc2ab41e6bb2e55c65
SHA512 9b8bc36c7e0ebcd281bb12ca6b9b9e0a0ff2fa17474a90e6726ca627c24346594cac031ddd0d2e004d5cf5bf1af9d89ccbae1e579a54bc536da7852c1aa3bacc
TLSH
T16DB012018147BB31CD0256703106104C62018E32C5101643D7D0F5EECC9B0E10159210
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 e0a047342f12f9d0bab5f8cfaed5f9b9e1d2c5b128ea53da4e4704beecd452cf
MD5 2de1eb7e7b8ae045423bb96efa19b5b6
SHA1 a2e4d6b27f0b7be9ec9949a9b3230ae41d7f9abd
SHA512 500429281fc3ca2cabe7233c2b42f14b1c5505c449d4d575bd34e4503f388873fe8bec84d5f6f6abc13ee2bd58adbd00b2872880f92b8b7d076c7c491141996c
TLSH
T1F9B002E531853913CF9A0BB1A0CF85557166ACA813F3916365FA41E68A2339052BD551
MD5 SHA1 SHA512 TLSH

Submit Download

fb02c8e2-693c-4570-9fa2-9373c77910a8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fb02c8e2-693c-4570-9fa2-9373c77910a8.tmp
Size 11KB
SHA256 41ed35e92d8112d20f926aa1bdffd78d1b12275de105680fe3c0782b38e647f9
MD5 9ae44c47b178c24413aef551b4a70fd0
SHA1 459fe29af811fd2621d073330b79c250ce492eda
SHA512 5e809de234aa87e715f8342b3433aa0fedb643dd8c31df888dbab893f8f16a9f1c78ae44745847f2cb75fca170a29086cf571ab884e0b23b54c7630b578345e5
SSDEEP 192:6RICHjZv72vAPRp2Y79THsb+WNn4ktQf2uksnWg1saU3VyIsnAUge:6RICD5C6XhFwtW2HsKaSe
TLSH
T1EE42B52FAA20753B5DEAC22AFA217767D7F6103525E42E84E6FC892C14E75CC212701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 279338204359a0bc0d80aa420d3529b7f1822a5b73bda7ac5fbd9908fc77d772
MD5 7cdea4e0cf222738708dd5c6a253ab86
SHA1 0d724aaea394f35317f23f37ed19c05565fecd19
SHA512 54492783cc19e68e7f7d80fb18345fa64641d16a8b12da4d9149bc539d2a86d3de6c290abdeba30dea19803ebe9545789a3f9a846acc66b9405ca93eb22ea9ea
SSDEEP 3072:DCGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:D1m7Rkm1tYpBeh2BAom
TLSH
T1FCC3123B5E74E8365DB9BB1EB08E0A1F1EF14AA6C824DE52C8D45B0433EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f72332c83213897b3d101b6550cfde89807e86bf38d3b4955700019f6cc583f5
MD5 4693d31dfd2dd2e1128f21ab152487db
SHA1 6bb15e186651996ffe1c51ccb0b857fc6dda08a0
SHA512 529890731e53689f032becc416616b72dea337653f4e8bbeb13e15603997eda6ebc9720f2e3892ff5510743a657831ea0396219546cc6622d9cca561c74e976a
SSDEEP 3072:kGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Hm7Rkm1tYpBeh2BAom
TLSH
T187C3123B5E70E9775979BB4EB08E0B1F1EF14AA2D930DA42C8D86A0437F97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c830ebd7581db890dbcc2563c50d659510a598b42a16e85aab811fe51fa25ae1
MD5 2bda01e81bf38f5c9f5c0cd8eca80e43
SHA1 f57a4416619ddadc3775325b0c1185f147fe114f
SHA512 380d13fc491af802fe34e4eea99418880653a5e73df52cb7119dba8e9ee7d5be32596e7d78e98ba67e6a421cb168dfcaa0c2db53454f6cfba051e250d0f8efe3
SSDEEP 3072:YCGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Y1m7Rkm1tYpBeh2BAom
TLSH
T17FC3123B5E74E8365DB9B71EB08E0B1F1EF14AA6C824DE52C8D45A0433EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 147210be4275e8cc8b60f9f13192735e37fb995b0d0083b1151fe4d36d6ddb78
MD5 4d44891593320981d75b011f3b9362ff
SHA1 73fd413d3f682aeb96dd6dc9fc4029f434648ce2
SHA512 868107e95abaa6c11337fe492a14abeed2d0c0fe640a9a348fbaa16c6fb0a71ab3cf4e3a7df98a34be228d5775851b6bb95f44e1b28da909b2e77093137bad1b
SSDEEP 3072:JGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:om7Rkm1tYpBeh2BAom
TLSH
T119C3023B5D75A9375DB9BB0EB04E0B1F1EF24AA6C930DA51C8D86E0433EA6CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 243e5b296afaac62680fe7ffb3e3f3d5eed640cac442ac2538d2ed1edc500e03
MD5 a590cf0e1450ed96383119e56c7be1d3
SHA1 1ffbadad61f0b0da57847431bec521346c7b16c5
SHA512 abe830c65db9699ce53ad8e9302a8b58311db8928aaa8f9ef62bfb9ab9e4e6e32dee3d2905c10a431cc0a33083cf307bc02fdf03b2d5ac7694f7a2e2ce8f2ec7
SSDEEP 3072:YGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Tm7Rkm1tYpBeh2BAom
TLSH
T1EAC3023B5D75A9375DB9BB0EB04E0B1F1EF24AA6C930DA51C8D86A0433EA7CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 517747.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 517747.crdownload
Size 2.3MB
SHA256 93412f3ad1cad6678d76ff62e276bf5fba5058d3d0db8756042fef4026e1cf5d
MD5 a52c2abccea02a609a8a0370f3988f67
SHA1 ae4272b309d59747ac660364c80c0d46d9edbadd
SHA512 a515532fc1e2c422d227c2584b450abbc15fb28269a1f4f631e08b1135a31159a90c89c3d8a0c17da7f58edc672732cf239ce0b3650504affd3b809f0583fbcf
SSDEEP 24576:DvdhlGFD48ET/0k7NmhC3Gn2DLY0RaSdEVLtifnv6F6H:Dvdhm/ET/3NmY3Gn2NRaSdEVL8fniF
TLSH
T180B5F82572FA14A5D1AAC035A9079767CD30704E133D52FB539889C52FB03E8AAFDB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1312-201-0x0000021978F60000-0x0000021978F61000-memory.dmp

Download

memory/1312-210-0x0000021976570000-0x000002197673D000-memory.dmp

Download

memory/1312-192-0x0000021978F60000-0x0000021978F61000-memory.dmp

Download

memory/1312-199-0x0000021978F60000-0x0000021978F61000-memory.dmp

Download

memory/1312-200-0x0000021978F60000-0x0000021978F61000-memory.dmp

Download

memory/1312-194-0x0000021978F60000-0x0000021978F61000-memory.dmp

Download

memory/1312-202-0x0000021978F60000-0x0000021978F61000-memory.dmp

Download

memory/1312-193-0x0000021978F60000-0x0000021978F61000-memory.dmp

Download

memory/1312-203-0x0000021978F60000-0x0000021978F61000-memory.dmp

Download

memory/1312-204-0x0000021978F60000-0x0000021978F61000-memory.dmp

Download

memory/1312-198-0x0000021978F60000-0x0000021978F61000-memory.dmp

Download

memory/2956-149-0x00007FF7EC9A0000-0x00007FF7ECCDF000-memory.dmp

Download