1fae7d654695f7c4e0f4bb8a42a4c33137652effc360b998708c6ffcac1380e6

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VESSEL_PARTICULARS_PACKING_LISTpdf.exe
Size 3.9MB
Sample260807-m5rt2atclb
SHA256 1fae7d654695f7c4e0f4bb8a42a4c33137652effc360b998708c6ffcac1380e6
MD5 bf62f6760a9b86f66822fa59140aef8b
SHA1 a71dc7dff873a5341ee93a254fa43e61f85298de
SHA512 f47af18705dfd6beec15109c227ca614dd314ce7a5dc4c19b10fc5388d07cd5990e5ea09128235cd88b595eef91a7c0e63e091bf8fc9947479f3d5d8167d9d31
SSDEEP 49152:eYqEK9Q8jm5Uzq0LYxjvOPg+BgAiyg8xK90g/u8KwQ61PwST3:lwQD0LYxjvWa3mz8NB3
TLSH
T1A1168C17F68903F9C09AC1749B579162F626BC2A2B3562DF364CB2141F7AEE04B7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	VESSEL_PARTICULARS_PACKING_LISTpdf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	VESSEL_PARTICULARS_PACKING_LISTpdf.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\Affiliation Database	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Session Storage\000003.log	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Web Applications\Temp\scoped_dir4004_218571265\Icons\32.png	chrome.exe
File opened for modification	C:\Program Files\scoped_dir3600_109414217\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Extension Rules\LOG	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\Site Characteristics Database\LOCK	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\DawnGraphiteCache\data_0	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\GraphiteDawnCache\data_2	chrome.exe
File opened for modification	C:\Program Files\scoped_dir3600_109414217\Default\Login Data For Account	chrome.exe
File opened for modification	C:\Program Files\scoped_dir3600_109414217\Default\SharedStorage-journal	chrome.exe
File created	C:\Program Files\scoped_dir3600_109414217\Local State~RFe5880b4.TMP	chrome.exe
File created	C:\Program Files\scoped_dir3600_109414217\Default\shared_proto_db\metadata\LOG	chrome.exe
File created	C:\Program Files\scoped_dir3600_109414217\Default\Service Worker\Database\000001.dbtmp	chrome.exe
File created	C:\Program Files\scoped_dir3600_109414217\Default\DawnGraphiteCache\data_0	chrome.exe
File opened for modification	C:\Program Files\scoped_dir3600_109414217\Default\Network Action Predictor	chrome.exe
File opened for modification	C:\Program Files\scoped_dir3600_109414217\Default\DIPS-wal	chrome.exe
File created	C:\Program Files\scoped_dir3600_109414217\Default\GCM Store\Encryption\000001.dbtmp	chrome.exe
File created	C:\Program Files\scoped_dir3600_109414217\Default\GCM Store\000003.log	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\ShaderCache\data_3	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\Favicons	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Code Cache\wasm\index-dir\temp-index	chrome.exe
File opened for modification	C:\Program Files\scoped_dir3600_109414217\Default\Sync Data\LevelDB\CURRENT	chrome.exe
File opened for modification	C:\Program Files\scoped_dir3600_109414217\Default\Service Worker\ScriptCache\index-dir\the-real-index	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Web Applications\Temp\scoped_dir4004_412572218\Icons\64.png	chrome.exe
File created	C:\Program Files\scoped_dir3600_109414217\Default\Web Applications\Temp\scoped_dir3496_1481408731\Icons\32.png	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\Account Web Data	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\DawnWebGPUCache\data_3	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\Network\Reporting and NEL-journal	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\Session Storage\MANIFEST-000001	chrome.exe
File created	C:\Program Files\scoped_dir3600_109414217\Default\Session Storage\000001.dbtmp	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\Service Worker\ScriptCache\4cb013792b196a35_0	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT	chrome.exe
File created	C:\Program Files\scoped_dir3600_109414217\Default\Web Applications\Temp\scoped_dir3496_1481408731\Icons\64.png	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\Network\Cookies	chrome.exe
File created	C:\Program Files\scoped_dir3600_109414217\ShaderCache\data_3	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Web Applications\Temp\scoped_dir4004_1372962708\Icons\96.png	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Extension Rules\LOG	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Code Cache\js\index-dir\temp-index	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\GPUCache\data_1	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\DawnWebGPUCache\index	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Cache\Cache_Data\f_000002	chrome.exe
File created	C:\Program Files\scoped_dir3600_109414217\Default\Extension State\000001.dbtmp	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Web Applications\Temp\scoped_dir4004_798488608\Icons\64.png	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Web Applications\Temp\scoped_dir4004_218571265\Icons\256.png	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\segmentation_platform\ukm_db	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\Login Data	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\GrShaderCache\data_2	chrome.exe
File opened for modification	C:\Program Files\scoped_dir3600_109414217\ShaderCache\data_3	chrome.exe
File opened for modification	C:\Program Files\scoped_dir3600_109414217\Default\Extension Rules\CURRENT	chrome.exe
File opened for modification	C:\Program Files\scoped_dir3600_109414217\Default\WebStorage\QuotaManager-journal	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png	chrome.exe
File created	C:\Program Files\scoped_dir3600_109414217\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\SharedStorage-journal	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\GrShaderCache\data_1	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\shared_proto_db\metadata\CURRENT	chrome.exe
File created	C:\Program Files\scoped_dir3600_109414217\Default\Site Characteristics Database\MANIFEST-000001	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\Default\Web Applications\Temp\scoped_dir4004_2030321743\Icons\64.png	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\History	chrome.exe
File opened for modification	C:\Program Files\scoped_dir3600_109414217\Default\Site Characteristics Database\LOG.old	chrome.exe
File opened for modification	C:\Program Files\scoped_dir3600_109414217\Default\Sync Data\LevelDB\MANIFEST-000001	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\parcel_tracking_db\LOCK	chrome.exe
File opened for modification	C:\Program Files\scoped_dir2816_46911\Default\WebStorage\QuotaManager-journal	chrome.exe
File created	C:\Program Files\scoped_dir2816_46911\GrShaderCache\data_3	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2076	chrome.exe
4732	chrome.exe
4572	chrome.exe
5784	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305742114775537"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{DFF20505-B08F-455B-AD70-4FBD055088E0}\LocalServer32	VESSEL_PARTICULARS_PACKING_LISTpdf.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{DFF20505-B08F-455B-AD70-4FBD055088E0}	VESSEL_PARTICULARS_PACKING_LISTpdf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{DFF20505-B08F-455B-AD70-4FBD055088E0}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VESSEL_PARTICULARS_PACKING_LISTpdf.exe"	VESSEL_PARTICULARS_PACKING_LISTpdf.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID	VESSEL_PARTICULARS_PACKING_LISTpdf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{DFF20505-B08F-455B-AD70-4FBD055088E0}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VESSEL_PARTICULARS_PACKING_LISTpdf.exe"	VESSEL_PARTICULARS_PACKING_LISTpdf.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{DFF20505-B08F-455B-AD70-4FBD055088E0}\LocalServer32	VESSEL_PARTICULARS_PACKING_LISTpdf.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4004	chrome.exe
4004	chrome.exe
3496	chrome.exe
3496	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	4004	chrome.exe
Token: SeCreatePagefilePrivilege	4004	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4004	chrome.exe
3496	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1556	2816	VESSEL_PARTICULARS_PACKING_LISTpdf.exe	87
PID 2816 wrote to memory of 4004	2816	VESSEL_PARTICULARS_PACKING_LISTpdf.exe	88
PID 4004 wrote to memory of 5016	4004	chrome.exe	89
PID 4004 wrote to memory of 1892	4004	chrome.exe	90
PID 4004 wrote to memory of 1892	4004	chrome.exe	90
PID 4004 wrote to memory of 4732	4004	chrome.exe	91
PID 4004 wrote to memory of 2468	4004	chrome.exe	92
PID 4004 wrote to memory of 2468	4004	chrome.exe	92
PID 4004 wrote to memory of 4700	4004	chrome.exe	93
PID 4004 wrote to memory of 1596	4004	chrome.exe	94
PID 4004 wrote to memory of 4700	4004	chrome.exe	93
PID 4004 wrote to memory of 1596	4004	chrome.exe	94
PID 4004 wrote to memory of 3748	4004	chrome.exe	95
PID 4004 wrote to memory of 3748	4004	chrome.exe	95
PID 4004 wrote to memory of 3648	4004	chrome.exe	96
PID 4004 wrote to memory of 3648	4004	chrome.exe	96
PID 4004 wrote to memory of 4612	4004	chrome.exe	97
PID 4004 wrote to memory of 4612	4004	chrome.exe	97
PID 4004 wrote to memory of 2036	4004	chrome.exe	99
PID 4004 wrote to memory of 2036	4004	chrome.exe	99
PID 4004 wrote to memory of 4248	4004	chrome.exe	100
PID 4004 wrote to memory of 4248	4004	chrome.exe	100
PID 3600 wrote to memory of 1576	3600	VESSEL_PARTICULARS_PACKING_LISTpdf.exe	102
PID 3600 wrote to memory of 3496	3600	VESSEL_PARTICULARS_PACKING_LISTpdf.exe	103
PID 3496 wrote to memory of 1728	3496	chrome.exe	104
PID 3496 wrote to memory of 4572	3496	chrome.exe	105
PID 3496 wrote to memory of 892	3496	chrome.exe	106
PID 3496 wrote to memory of 892	3496	chrome.exe	106
PID 3496 wrote to memory of 1692	3496	chrome.exe	107
PID 3496 wrote to memory of 1692	3496	chrome.exe	107
PID 3496 wrote to memory of 4444	3496	chrome.exe	108
PID 3496 wrote to memory of 4444	3496	chrome.exe	108
PID 3496 wrote to memory of 2992	3496	chrome.exe	109
PID 3496 wrote to memory of 2992	3496	chrome.exe	109
PID 3496 wrote to memory of 4304	3496	chrome.exe	110
PID 3496 wrote to memory of 3060	3496	chrome.exe	111
PID 3496 wrote to memory of 4304	3496	chrome.exe	110
PID 3496 wrote to memory of 3060	3496	chrome.exe	111
PID 3496 wrote to memory of 2240	3496	chrome.exe	112
PID 3496 wrote to memory of 2240	3496	chrome.exe	112
PID 3496 wrote to memory of 1840	3496	chrome.exe	113
PID 3496 wrote to memory of 1840	3496	chrome.exe	113
PID 3496 wrote to memory of 2972	3496	chrome.exe	114
PID 3496 wrote to memory of 2972	3496	chrome.exe	114
PID 4004 wrote to memory of 5380	4004	chrome.exe	115
PID 4004 wrote to memory of 5424	4004	chrome.exe	116
PID 4004 wrote to memory of 5424	4004	chrome.exe	116
PID 4004 wrote to memory of 5432	4004	chrome.exe	117
PID 4004 wrote to memory of 5432	4004	chrome.exe	117
PID 4004 wrote to memory of 5912	4004	chrome.exe	120
PID 4004 wrote to memory of 5920	4004	chrome.exe	121
PID 4004 wrote to memory of 5912	4004	chrome.exe	120
PID 4004 wrote to memory of 5920	4004	chrome.exe	121
PID 4004 wrote to memory of 5928	4004	chrome.exe	122
PID 4004 wrote to memory of 5928	4004	chrome.exe	122
PID 4004 wrote to memory of 816	4004	chrome.exe	124
PID 4004 wrote to memory of 524	4004	chrome.exe	123
PID 4004 wrote to memory of 816	4004	chrome.exe	124
PID 4004 wrote to memory of 5188	4004	chrome.exe	133
PID 4004 wrote to memory of 524	4004	chrome.exe	123
PID 4004 wrote to memory of 5188	4004	chrome.exe	133
PID 4004 wrote to memory of 6032	4004	chrome.exe	127
PID 4004 wrote to memory of 6024	4004	chrome.exe	126
PID 4004 wrote to memory of 6032	4004	chrome.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VESSEL_PARTICULARS_PACKING_LISTpdf.exe
"C:\Users\Admin\AppData\Local\Temp\VESSEL_PARTICULARS_PACKING_LISTpdf.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7877.0 --initial-client-data=0x220,0x248,0x24c,0x244,0x250,0x7ff63b479af4,0x7ff63b479b00,0x7ff63b479b10
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-features=LoadLowEngagementPEHFeaturesToPrefs
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files\scoped_dir2816_46911" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\scoped_dir2816_46911\Crashpad" "--metrics-dir=C:\Program Files\scoped_dir2816_46911" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa98b8c728,0x7ffa98b8c734,0x7ffa98b8c740
    3⤵
    PID:5016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    PID:1892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2140 /prefetch:3
    3⤵
    - Drops file in Program Files directory
    - System Time Discovery
    PID:4732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2308 /prefetch:8
    3⤵
    PID:2468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:4700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3700 /prefetch:1
    3⤵
    PID:3748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3800 /prefetch:2
    3⤵
    PID:3648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:2
    3⤵
    PID:4612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:2036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:8
    3⤵
    PID:4248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4856 /prefetch:8
    3⤵
    PID:5380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:5424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:5432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3972 /prefetch:1
    3⤵
    PID:5912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    PID:5920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:1
    3⤵
    PID:5928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6244 /prefetch:1
    3⤵
    PID:524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6108 /prefetch:8
    3⤵
    PID:816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:1
    3⤵
    PID:5188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:1
    3⤵
    PID:6024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6260 /prefetch:1
    3⤵
    PID:6032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:8
    3⤵
    PID:6044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=1900,i,11284331932372138158,16652103849779451394,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6384 /prefetch:2
    3⤵
    PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --user-data-dir="C:\Program Files\scoped_dir2816_46911" --enable-features=LoadLowEngagementPEHFeaturesToPrefs
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  PID:5596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files\scoped_dir2816_46911" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\scoped_dir2816_46911\Crashpad" "--metrics-dir=C:\Program Files\scoped_dir2816_46911" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa98b8c728,0x7ffa98b8c734,0x7ffa98b8c740
    3⤵
    PID:5812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --force-high-res-timeticks=disabled --field-trial-handle=2028,i,14293935376787976455,14057582831340873043,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260806-170050.191000-production --mojo-platform-channel-handle=2080 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,14293935376787976455,14057582831340873043,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260806-170050.191000-production --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:5268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir2816_46911" --force-high-res-timeticks=disabled --field-trial-handle=2028,i,14293935376787976455,14057582831340873043,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260806-170050.191000-production --mojo-platform-channel-handle=2544 /prefetch:8
    3⤵
    PID:5372

C:\Users\Admin\AppData\Local\Temp\VESSEL_PARTICULARS_PACKING_LISTpdf.exe
"C:\Users\Admin\AppData\Local\Temp\VESSEL_PARTICULARS_PACKING_LISTpdf.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7877.0 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff63b479af4,0x7ff63b479b00,0x7ff63b479b10
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-features=LoadLowEngagementPEHFeaturesToPrefs
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files\scoped_dir3600_109414217" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\scoped_dir3600_109414217\Crashpad" "--metrics-dir=C:\Program Files\scoped_dir3600_109414217" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa98b8c728,0x7ffa98b8c734,0x7ffa98b8c740
    3⤵
    PID:1728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1876 /prefetch:2
    3⤵
    PID:892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2452 /prefetch:8
    3⤵
    PID:1692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:2992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3616 /prefetch:2
    3⤵
    PID:3060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4224 /prefetch:2
    3⤵
    PID:2240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:1
    3⤵
    PID:1840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4876 /prefetch:8
    3⤵
    PID:2972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    PID:2036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:5692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:5620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:5188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:8
    3⤵
    PID:6136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6260 /prefetch:8
    3⤵
    PID:5348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:1
    3⤵
    PID:5192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6224 /prefetch:1
    3⤵
    PID:5428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --force-high-res-timeticks=disabled --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    PID:5732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:5988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=1868,i,10268037229147393932,14928279854525529599,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6252 /prefetch:2
    3⤵
    PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --enable-features=LoadLowEngagementPEHFeaturesToPrefs
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files\scoped_dir3600_109414217" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\scoped_dir3600_109414217\Crashpad" "--metrics-dir=C:\Program Files\scoped_dir3600_109414217" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa98b8c728,0x7ffa98b8c734,0x7ffa98b8c740
    3⤵
    PID:1392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2012,i,8730837682987376506,11610840895009878410,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260806-170050.191000-production --mojo-platform-channel-handle=2040 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2012,i,8730837682987376506,11610840895009878410,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260806-170050.191000-production --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:2200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir3600_109414217" --force-high-res-timeticks=disabled --field-trial-handle=2012,i,8730837682987376506,11610840895009878410,262144 --enable-features=LoadLowEngagementPEHFeaturesToPrefs --disable-features=PaintHolding --variations-seed-version=20260806-170050.191000-production --mojo-platform-channel-handle=2516 /prefetch:8
    3⤵
    PID:3296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5840

C:\Users\Admin\AppData\Local\Temp\VESSEL_PARTICULARS_PACKING_LISTpdf.exe
C:\Users\Admin\AppData\Local\Temp\VESSEL_PARTICULARS_PACKING_LISTpdf.exe --delete-shortcut
1⤵
PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7877.0 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff63b479af4,0x7ff63b479b00,0x7ff63b479b10
  2⤵
  PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Program Files\scoped_dir2816_46911\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\scoped_dir2816_46911\Crashpad\settings.dat
Size 40B
SHA256 ae3d8af685abfb2dc736ac80be8c186fb9e2ba1dda2e74ef636b7d8bba572919
MD5 394ce52538350e3cf0a874cd93f537a0
SHA1 69fc6af0a1de6dd80a7799c157e3621971552e8b
SHA512 80a0ba73ec1ea0355273ee1414e578bc1807d1f584fa3e8c5e306227f14a0794583909d4f8a86cdcb759a6b3e296b0dc25d9ef8aab66ae2063f91762dfa9d349
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Program Files\scoped_dir2816_46911\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 c79849a2a5af35bdf4768df88b1ebddcf3b540cea8d26bdee0a47c71a5177a29
MD5 226a111a4196bbeb6dbc071844b02970
SHA1 38c3fac6b6d72e0d421cacc8a0ffa241794e651e
SHA512 93c72b2241a8bdcd5d8541b3f68569028bc5e6aaa997683c481443909042f784b0c5ae63e3da1c035ec47921799f00e664d848d7760db1fed38461f293542b5c
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Program Files\scoped_dir2816_46911\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Program Files\scoped_dir2816_46911\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Program Files\scoped_dir2816_46911\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Program Files\scoped_dir2816_46911\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Program Files\scoped_dir2816_46911\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Program Files\scoped_dir2816_46911\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Program Files\scoped_dir2816_46911\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Program Files\scoped_dir2816_46911\Default\Favicons
Size 20KB
SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
MD5 198e1617955c70ad9263e5ae041f3c36
SHA1 623233da85a56e3b75fbd55f5159d83f764db270
SHA512 ca7a586adc01389778c75ac85b1968f8604f39138362db57684b0ff7099be46653f8f98706b0f9aec9059d437a604b82021bc7be8c18dff6a7e60df89c40d2f0
SSDEEP 24:LLiwExh0GY/l1rWR1PmCx9fZjsBYuI+Qo66UwcEv+75fBmI:NeBmw6P1U1kmBmI
TLSH
T1F592AA075E387407EBA11E7D266A183A9E3FE26D9FA29CA4347410618CF8582D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Program Files\scoped_dir2816_46911\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Program Files\scoped_dir2816_46911\Default\Site Characteristics Database\LOG
Size 275B
SHA256 452a7cf4303d73c122c0cf131c92fca8e410fbf8b7bcf7fca90b56fbff7c0f8d
MD5 14390e4b1b1722d52de2daeca1b207b2
SHA1 13d41c0bf0c3a3a1c5ae873627aacccdaef17b1e
SHA512 be114d6ba33ac3891aaec15a4b2b766646746b019582f15aa2b74474710919a3bb30a1506622d2e6945a09fb3e735bd9f911d2f66d4d400311e1bd1584e3a03d
TLSH
T1AAD0C231A6C19EFA238716CD670077114B8EF408EAA8113A2F6DE354638AE148116A80
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Program Files\scoped_dir2816_46911\Default\Sync Data\LevelDB\LOG
Size 251B
SHA256 9d4d47c2714c768d526c44e8e5fb1c18d97df190ca64d7454fc83a3c45caa8e9
MD5 20def5c57c1724dc65cf14b19dd14416
SHA1 ee3f70fd7ec7669743d2980acfd5706a4a8022b5
SHA512 de9d9002523b070401b6f9b011192cfb7ed409e5286105711f3c412888e7f633da9857a6f010a24946bb6fac65826ef7a149a4d8676cbd2facad6160921fa3fd
TLSH
T18CD02B72E4C1D9F8275346C487803B134BACFC069788312D1F5E52056382E204234580
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Program Files\scoped_dir2816_46911\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Program Files\scoped_dir2816_46911\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Program Files\scoped_dir2816_46911\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Program Files\scoped_dir2816_46911\Default\Web Applications\Temp\scoped_dir4004_705408741\Icons\128.png
Size 5KB
SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
MD5 9cafc16ce8040254ec411cc5a8f954f2
SHA1 0d9841be48e134edf43c7ef970d24ddf852d155e
SHA512 aa1e0ac8d0647ee6c0b481e671b20fc68ff253dc72748b2aaf22f15bd8decd2b9723b16f8cd4c19d9a250abaa8d517101bad6ebfed7fd3a90ceefce02c1b3b75
SSDEEP 96:ALdfTPsPOWpgaNHQxO20qtLppvSFLtGaoFuPhQd1YDzpsE60tkuuAaw:m16NHQgoLjvSVtY2h6CDzpsErVu0
TLSH
T119C17E55555D711FD09D157110AF4A0F31A7E2AAC3785720C97E1BD0F88DE4603A3EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Program Files\scoped_dir2816_46911\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Program Files\scoped_dir2816_46911\Local State
Size 115KB
SHA256 65e8ff027b2ad4d64034cb01db32da8ede5ae38a7bdf34f80a5fd9131df0cc49
MD5 034b93a4c4d5dee4bd38aba50d686de1
SHA1 414505f042e0e835250e39647ad153343755c34a
SHA512 f55fa1ead131e375d88f3e0df37dcc2cc1d2bde3b9481dfd4fdb74ae4b1d79fe05866e75d9dae3ccebd4d8f9a34d7bcf0988ff839fb9ea04168ee2106bdb0662
SSDEEP 3072:pXGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMT:pWm7Rkm1tYpBeh2BAoT
TLSH
T12FC312275E75E9375878BB0EB48E0B1F1EF14AA2D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files\scoped_dir2816_46911\Local State
Size 234KB
SHA256 8fdcc3485ff6a4305963f4d0d267450f056ad74be7ba41666bba1fc3ce7c2bf7
MD5 4effb05f7aeb0c16128fe32f7f8ecc40
SHA1 cbdd6acee3634ada607fecd7104b86d50b4bdbb8
SHA512 5f2231f939f1e941d274d76848d4f0cea2acd7f5bc466f1223504dc0e012758a20548a424aae59e97d531a35cf119c59bf72c1c6b7dc5ee6875d06374f0db915
SSDEEP 6144:mk4hTt/+4wSHbx8S2b2E4em7Rkm1tYpBeh2BAoe:m/a4wul8S2b2E+9oBGcAoe
TLSH
T136342323DE75FE3F28A5A70AB04D1A1E0DF21E649952AD724DD43E1C13E5EAE1672C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files\scoped_dir2816_46911\Local State
Size 234KB
SHA256 d1d370f80eec575c62c44898c55d552d58883740ef23546a5e5af23e8d942439
MD5 a98774bc2b3bdfcf430d26eb67771108
SHA1 4680b1a35fff08041a3f28c00a34adaf16afe607
SHA512 af0104e91cbd4cec2b018c86597bb579125e7a07c3bfa65377b84a5e5bec78f20aa296cc5277d8e168f8b81df07dc0b9b538c80872979b4ae615872086e1c884
SSDEEP 6144:mc4hTt/+4wSHbx8S2b2E4Pm7Rkm1tYpBeh2BAoe:mHa4wul8S2b2E59oBGcAoe
TLSH
T1C0342323DE75FE3F28A5A70AB04D1A1E0DF21E649951AD724DD43E1C13E5EAE1672C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Program Files\scoped_dir2816_46911\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Program Files\scoped_dir2816_46911\ShaderCache\index
Size 256KB
SHA256 64bbda65d54c10f4cb79581bc5659dafe3ff53d23ddb0c07b1d1ddb9bf94f4ca
MD5 2393e4bc02e2120225f7015f084bef31
SHA1 2d74b42a8f13b7582c4ee5fd828d85a8526b4b2d
SHA512 d7239982b10e908d122338aef2bbfb14e487c005173ad6304588f5eeaa4a5fc63c726b9674935af2f19e1257164ac60dd67b40c5bfcc2c4c84ca21802ab371c1
SSDEEP 3:LsOllllklkXlDc//:LsUlPw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Program Files\scoped_dir2816_46911\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

ukm_db

Path C:\Program Files\scoped_dir2816_46911\segmentation_platform\ukm_db
Size 48KB
SHA256 7434597d22726641acf6c1817319992b54ec582f0a7474d28dab085fe2f3747e
MD5 a9ae40fb5b25887e90a305a17a7d352f
SHA1 81c9a3d4ea776de2605c894f759d773e2eee77ed
SHA512 dab18020ef0e0506b4f0f2fffe09c502aec24955ae1c5a3072f21dfa1df1f98be0a25bbe1953fa2c0ac3f6cab3b111ceb0f5e81b6cd9a7bf217713e45acd3389
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0JQ:TkkhCU2QB2zbBxx
TLSH
T18D23490E5A6821E9D4D9193EFED34C517DBE0F588A2B78D205E00C768CE21EE553E4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\scoped_dir3600_109414217\Crashpad\settings.dat
Size 40B
SHA256 b9d2a1371d5ef56b04e0379f082d4b68d3a305a72b6bdcde5c53f9414795f209
MD5 658b62e9a8f80bcaf71f4f3be241013c
SHA1 7d50904b6cf750259e0908677a060fa65f9d27c7
SHA512 76c506d74acb6ad1af2818c41603db92027a52c4be59a0042d6c6f2914e63c3988dd8383e033a09797467e2a21f6b94f93c9edd95b6dcfaf5b28e2083c9b02fe
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Program Files\scoped_dir3600_109414217\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 c729d78216bdfffd10f394cda395f0b40106cb19f409dd62f72a805702a81afe
MD5 332c10c6357111d72be728fc7eee50ad
SHA1 6ff20443ba06f3718f13ebc1f8a2410a26ddbdae
SHA512 2ed18cc403bd5f28ffc4068b14a6bdd83d5be491bf1f0a26f8ca53ca7a844e02d929d66e0c8f4891ea558a18f0e2a9531232c9458d989fc012ca9c63ed9809bf
SSDEEP 12:U/9/I5zpjpqp9iki6bk2epqp9ioS0pqp9iAZY/u7SOLpqp9iAHC:GA/ukSSlYG7kC
TLSH
T1F54490F77C10A25BCB24A2F95110223C9D3B82081DDD8EDED06C0AB74488F6658648E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Program Files\scoped_dir3600_109414217\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Program Files\scoped_dir3600_109414217\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\128.png
Size 4KB
SHA256 41b21cd721317759a1391ec66ec4606b1f1b0a66fc6542ec3e69f9a6ba9a60d3
MD5 a6e517fba00c44d26f516d2bc473042f
SHA1 bcedbf549056bfacff8820cac38713a1eacd95b9
SHA512 8c58b58a05b60420ff187c2dc8b71e019fc36cd6bcec050257b5532f131ba50ecd00fe2ca734805753a39f6911125d2d8684286207b1d1d039e862904279a145
SSDEEP 96:4niq7dWteEb8MsIhE+bf+rgEPQCGJxc4bOdpI0xeblJpzSkLqdsQ4pXnW3P:e97kteEnJEu+rxoi4b3RJpfhQ45nGP
TLSH
T14AA1AFFA12E3DA94303E91711B20659B4D7909385624364DDBB2AC7140C7A0D9B7CF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Program Files\scoped_dir3600_109414217\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\_locales\en_US\messages.json
Size 1KB
SHA256 102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1
MD5 578215fbb8c12cb7e6cd73fbd16ec994
SHA1 9471d71fa6d82ce1863b74e24237ad4fd9477187
SHA512 e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212
TLSH
T161210707DA04AB37827A6136BC656685F33007EE2201E86F7DBCD50C5F229A791A7798
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Program Files\scoped_dir3600_109414217\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\_metadata\computed_hashes.json
Size 6KB
SHA256 70ca56a0c7b5cc6ce7c1a37ee0c28422e9c51955f937b269cf6f75c7728c5eed
MD5 a57e17da2fd59bbe0986edd938f9208d
SHA1 068bf139ded8ed334c3669b1fe2e809503a3fcbf
SHA512 f19788be46ba219ada7d708d8e86c4242d814730d0b2473d03917d6a6df3f6bb4c9c2471369f20aa445590474f18a9703177fd6a867f458cdae55acd1d2c4328
SSDEEP 96:PbLBlwtH4ILWw/XHGshsXIre1eMGggQpfD9b627P4hdWdN/Pf2:TLBALtXGshsXIre1WggSb6c4XEf2
TLSH
T15ED153451DBAA197DF117A4A3D471812982A6FC18C0C2DD6BE6DE338F18D90F12A363F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Program Files\scoped_dir3600_109414217\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\_metadata\verified_contents.json
Size 11KB
SHA256 a21a4531a86d6985fe7cf0f7cd30b92d6ee39decec9e5e4867ba80cbae5221eb
MD5 8e4ee82ea9472677888da9d066b8818d
SHA1 3bedd01eb4c76d1dfedddd8a8c35346176400fdb
SHA512 372bd7972eab74b03430d2698bd18b67123fbb370b476553d90393879070c4604451fb385eef5cf71a13f025656897f90cffc8387e14dcd3b4868fe6bf1c9a41
SSDEEP 192:RBG1a5Ma9+PqITEPc6R+ZdmOp+lbONd/jUmkD2mLLpPwcgT9QrWBEDn1U:e5xn3Bol8U1D+
TLSH
T175327668CC8D708CFC56F7768B6A79769B48C9C9A14D6E1E13D34C603CB7A4988A30DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\scoped_dir3600_109414217\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\manifest.json
Size 2KB
SHA256 bbdc79c9ab2f2514cbc298b3b7fb7506f9e746b597b132c59ad004619c7b9a87
MD5 88668a1cd61c9f5afac6c089f45d6244
SHA1 f064a4ddb0e8110f87a7fc90c9a914e98f6d4ace
SHA512 03db2f0c91ff68a9c3f9e75c728b76599cf786c6f414607601c53987d6c1f9ab42fc234c058d09cb31f00095ed6d054b201a06cc638413e2e45bf66f86f7d65b
TLSH
T10F516DFBBC10AC634BB08594991A710EF729735E45CFC4DBB2BC60734BE4CAA1D60598
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Program Files\scoped_dir3600_109414217\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Program Files\scoped_dir3600_109414217\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 960B
SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
MD5 8fc407c5a96f560cfbb46503741dd11f
SHA1 31eb59362b3c99abd75bdf605bdf46d793ef99b9
SHA512 7ed6d7c679ab5928427095beef9ae476e8bc57a5c81cb633bce1b646a896557b5b49112d489b2112ac2749e1adaf6b1a7544be36c570696fff80725352eac68a
TLSH
T1BC11CC5290BD5338C4D16953E04223E10E566CFCE4EE91366B8FC80D893EA5D9CCC621
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Program Files\scoped_dir3600_109414217\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
MD5 b75ce0c6ffcbdcc1066a2e6c8c3aa5fc
SHA1 2ca49f0080b985a68692eee2582298a9353c7916
SHA512 a3ac3a8cb7de26b7e4fa126497dcc228462b04da9a99a0b4647c1d8f877131f6597af80c3d7e834b50938a6c1349ccb14e9e0dd0b06673fa789d78e3e499bf7d
TLSH
T15C2196C3239DF6E5E54D50A745CF1B12F7BF375829B4A058A08E42C502B77C192CA534
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Program Files\scoped_dir3600_109414217\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
MD5 518326c327ce412aff2d0f63700b372e
SHA1 24b69d3fb978c36bd349b516cbb5720addcac515
SHA512 fa4c22a9c51cb75ef04984ac10ee068fc9d262b7cc2f969f537784bd71240359cb3c34d9789b043f43e7109e7028b17da50074cba2b8759ea31e5ef2898b0707
TLSH
T16E21E79532856E7C8FA21F4BE0642A1DF2761D0423258DA603B12CF10CE040829AD2A1
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Program Files\scoped_dir3600_109414217\Default\Web Applications\Temp\scoped_dir3496_46945695\Icons\128.png
Size 2KB
SHA256 3a45652c64d2a35cad427fc4541ab36ac42f11425f2d996edc38a6498d98bae8
MD5 306472d164006935bf98edcf0cd28837
SHA1 f2ad2740a46607728c5444ccf2a93a774bb300ea
SHA512 51547f18c6518d60ebb1aeca780bc1b9fa85f444a5abe60ba6b0f34d64f4006ae01c24128284e02e7b9e1d96c7111f3c8c597a1e74f2a29fe4ad6c139f0123de
TLSH
T1FF41C7998B466878F215E305C0493E7E79B2BD1A1C13E05A21B040430DA9BD55FEB61C
MD5 SHA1 SHA512 TLSH

Submit Download

192.png

Path C:\Program Files\scoped_dir3600_109414217\Default\Web Applications\Temp\scoped_dir3496_46945695\Icons\192.png
Size 1KB
SHA256 56b7a8100c9fd352d2c25b6a9c9a05b47950cf5f84d07ab014a0b7cd2850e5a5
MD5 51429005fa10fb2c81fe734e74695d0e
SHA1 9dad5c509e3ad1ab8b1d0ff911600a83b62e3aff
SHA512 999fbbfb741ad6499e617e1e637e014099a49e9a5374314e59f6f145cd19f9dcf3e131b4fd6c622f9293033dab91392b0665ca0d567af2c34d20ce255495a04f
TLSH
T1172178BF93B5D1F3DCC2CB03D640509CD80F762B7D6843C5DCA018A986B9D45AAB88A6
MD5 SHA1 SHA512 TLSH

Submit Download

256.png

Path C:\Program Files\scoped_dir3600_109414217\Default\Web Applications\Temp\scoped_dir3496_46945695\Icons\256.png
Size 4KB
SHA256 55d89ccdc27b413cc831f5496b0caf3ec390bc19270ec3294a5d2d38dec42c24
MD5 b3d7fffa6ed9b6dd37f5d2cdb077f22e
SHA1 cb2e013c3d6b7c35eb09170ce884da4fb480e1e6
SHA512 473db4b410a9fd56fa1289ec8314f908ee221977b2d32b5abfe1ad628e60addbc23e3b06f7fdd104d6a2e3076f992c65696ffe1ecc75d553e094a57869df04a8
SSDEEP 96:miJQW62M8GG901ZveUmX2KJ2tra+NO6+K6teIp5f:zJ/901ReUmNJ2tm+NO6ibf
TLSH
T16BA13A8E47A0DC8B8551A3BA1AFAA4E07A30983063F2133576F640EB742D523A309B75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96.png

Path C:\Program Files\scoped_dir3600_109414217\Default\Web Applications\Temp\scoped_dir3496_46945695\Icons\96.png
Size 1KB
SHA256 84a6d2571ed487aec05288f204c16ef239a740d2dfb105bf781c6708b938cf00
MD5 f674dfc82d3ab385e234cc05c89081b3
SHA1 dbdeda809b10a5df7da5b2a2dd12acdb7dc7d427
SHA512 56ad6146a5bd339fdcbd4d66cdfa8144c1eccc7db57a4f790e536fc97291ebd6b13dc5bc6b12c114e72054f87f3372e1cd0c4d6f11eec998e7d3fab008613046
TLSH
T1FE31DA5B19CA9ED15BCC933BE32401336A28845C4F1115890CD6B0AA59D5DB5F63C2BB
MD5 SHA1 SHA512 TLSH

Submit Download

192.png

Path C:\Program Files\scoped_dir3600_109414217\Default\Web Applications\Temp\scoped_dir3496_872794961\Icons\192.png
Size 2KB
SHA256 e401220b69a76a298b2e081a5424af69791a4caa3936af85d8862c05f4ced4a8
MD5 e063d7ac57fed2391e778c3a5817bfed
SHA1 3fddfdcf2917af9ce0e86eddb03725d4a3cdd7cc
SHA512 0de76ca2917cb2162d73a3d61d83dab2795ef1e9ca0f057091cef9eb79c0064dcd13c4749521163e6f77dfe43e0afa68326a32b7c19d8524da509dfbf4f1cb7b
TLSH
T11651060A0759BDB22A31C07991B8D9E7DE0C1003A5BBDD7E19954FF0A913CE43B23681
MD5 SHA1 SHA512 TLSH

Submit Download

256.png

Path C:\Program Files\scoped_dir3600_109414217\Default\Web Applications\Temp\scoped_dir3496_872794961\Icons\256.png
Size 12KB
SHA256 6e8f581f4cee7f8f8af4a9e1059f0d3088b792de7045067d74254e2a6f1f9a6b
MD5 493ff5acf7b11c3f1147a8d9e25e7751
SHA1 6009b5d4c6cf66b4dea48b5c558fb9dfee261c4b
SHA512 684256b0a9d8169eb1c177068c0c04518dc1c1a6c2554c32beedcaf0bb4429902319ecb32d8c97671ba361de6e10e9275e8ef778f61934f38538f35b60a963bb
SSDEEP 192:Hlx0S8vKsNbVmc/vC0+e9JaSyw2X4RTv+ovsCF3vKY8XejYHvhX2kol0f993M:T0vdNbQ72iNXX6rsCFyYAZkh8LM
TLSH
T19A42BFA1B310ED73E30AEF2045FE64B0516C82217FE4A507D331D85ABF0FC9998A95A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96.png

Path C:\Program Files\scoped_dir3600_109414217\Default\Web Applications\Temp\scoped_dir3496_872794961\Icons\96.png
Size 3KB
SHA256 00f563fcf365eb53a4037624ab3783dd6e19d2c6689c9892aa30ad2b16577848
MD5 43400a5061af952e87a0e06e1062b272
SHA1 5b937e80e93bb5f526a964e2a28aa9579e8dccb6
SHA512 8f3f25039af799f055ea81a2008530562b4b24e8afd65b65566b6dd0cdcc66f3735bf0428bb3c4eaf7079ce15499de3846bcdfc1db0707db50e9f3bc2c5e7d6d
TLSH
T14F819F6325E9E9CAAA5ED62071224074845F04EF59313775F07C18BB13CA56DFD70E26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files\scoped_dir3600_109414217\Local State
Size 234KB
SHA256 a1260781682ec3cf27ec47d99ae97bd34ece68cbc709ffe411a6f47a921bd798
MD5 21314c0573e00a67e247a5d2a87f7fd2
SHA1 970bafcd3acf692890b40d0dc1b5286e13ac89b7
SHA512 302ee256bd0fcd081ac8b4e5e5641740adc560e2ceb77c89607af427c4498e8e33e2b0e99689abe4dce86283be695009aee1684707c1c385ccca9795911c9f56
SSDEEP 6144:07RJLYP+azNgV+KmipvONhfoklm7Rkm1tYpBeh2BAoa:07RRc+aNTKSHM9oBGcAoa
TLSH
T11B3412639D582E3A30B0A73A904F6A2A0FF39E33D92596669CE53E4417FDFD50E49C10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files\scoped_dir3600_109414217\Local State
Size 234KB
SHA256 24a442c518ca2cc487911236d594d10a387d46df7ff02e290ff856300f53cb25
MD5 62a9cea4a66c4678caa6c179eff4458e
SHA1 22d6e9a9e4c8bfa72f7f9410f1b448029f2d270b
SHA512 1aeaf2bb8b36465ca8a265fcc06cf4b70a591600308333ebfef9cae688848a4474f1dea5806f9fcbad023b44288d0347a163cd013efff7c399cf16c8db21d7c6
SSDEEP 6144:0PRJLYP+azNgV+KmipvONhfokYm7Rkm1tYpBeh2BAoa:0PRRc+aNTKSH79oBGcAoa
TLSH
T1B73423239D582E3A30B0A73A904F6A2A0FF39E33D92596569CE53E4417FDFD50E49C10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a9bc91a3244e7d72467b656c5486d15c0ed9f92add88f691c3853e2b856cbd81
MD5 b1e1deec2c4182d0013a230b355f4c7d
SHA1 126437183b8f548051a3f561eea1eb0ee68fc9cc
SHA512 e718639402727b342725497f1be1fb31c240520b2883d9791df2e05dd851d0e309e06e9942c2a24d6090668922ba1d9f9a1ebf9b87311e7d55ee2d605549ce06
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3496_1277165948\CRX_INSTALL\128.png
Size 4KB
SHA256 ff702ca753a7e3b75f9d9850cc9343e28e8d60f8005a2c955c8ac2105532b2c9
MD5 d056cec3b05d6a863ddfa7ee4c1c9f0c
SHA1 dcd15b46dea9d234f13d7f04c739a2c516c973f1
SHA512 751274949b04c7cdc5e8f5f20fd062bfe130f1415eee524d9d83bcf1a448fbfb4b82dff8bbf7495250a852779c3d11ac87e33275508a4064f9d52417f4ca230f
SSDEEP 96:YpjISYK9mvKBG4+43tmidWQX3DJQoWQpzYKL:Yp7nG4j3tRWQX314QpzzL
TLSH
T1EDA16DDEF15935355323E89B282AC458C69F5302D282D6AF940DD4C572C3DBE68B2DC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3496_1277165948\CRX_INSTALL\_locales\en\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3496_1277165948\CRX_INSTALL\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3496_1277165948\CRX_INSTALL\_locales\en_US\messages.json
Size 1KB
SHA256 4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c
MD5 64eaeb92cb15bf128429c2354ef22977
SHA1 45ec549acaa1fda7c664d3906835ced6295ee752
SHA512 f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def
TLSH
T153213806EA14BB37825F6036BC657585A3300ADB2600FC3D7EDC941C1B059AA91BB3D4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3496_1277165948\CRX_INSTALL\manifest.json
Size 1KB
SHA256 157696227de4fbbb1b201e16ceb091d502dbb5dbaa4ff9eb66fafc1a786085d9
MD5 e40ad42b3c23ed2276b1099a0c89b3f4
SHA1 8b3316f2f53fadb1cbaa894e75316719b31db175
SHA512 701a53a3c704bae6b5a11a4ed13027007072f074b97a2f0893e8ee8156292b4f956de2aaa500106b7645a67981b91f099146bfdfba293447e233b55933513a0c
TLSH
T1804169F7BC00AD634BA49998AA1E714EFB29B24D55CFD4DB8298107302CCDAE1D601E5
MD5 SHA1 SHA512 TLSH

Submit Download

406e1f74-b71f-4f27-a612-6cb18901190e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4004_1394420944\406e1f74-b71f-4f27-a612-6cb18901190e.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download