e8a378b0f1256b0eda320641f07cf65785212455073b9f9dfa4bd1af3e56b270

Resubmissions

08/08/2026, 21:26

260808-1aeswafe287

08/08/2026, 21:06

260808-zx1hesfd823

Analysis

user interaction
yes
max time kernel
229s
max time network
243s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VIRUS_FILE.scr
Size 900.6MB
Sample260808-1aeswafe28
SHA256 e8a378b0f1256b0eda320641f07cf65785212455073b9f9dfa4bd1af3e56b270
MD5 44ca202ab37902f9862aad0c8ef02f19
SHA1 3053b6d2b1d58249e3dc2c77499270eef28f6404
SHA512 5abf55010d5eb8d7f1a3f0ada021eb877f2d44f06b7d6bd8d216d11b1826db4817a74e1fb6e8563538a2cc3bd4cda669690f4f25a0bd29a06db6a8fccf8b0ebf
SSDEEP 6291456:6Astm9VBCb82quTerVfZ9yIRT64jDYkjzKScUUxr9DLUoFb:LhEbozZ9x6sYk/JNUTDLN
TLSH
T140A933BF10A18064E6AEF4B9CE31B90DA52D7B1740C157A30F29D96D31ABD48250DFFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VIRUS_FILE.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VIRUS_FILE.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VIRUS_FILE.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VIRUS_FILE.scr

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4272	chrome.exe
4740	chrome.exe
5508	chrome.exe
784	chrome.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaveTimeOut = "900"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VIRUS_~1.SCR"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\ScreenSaveActive = "1"	rundll32.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306983131268432"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
1984	VIRUS_FILE.scr
1984	VIRUS_FILE.scr
1984	VIRUS_FILE.scr
1984	VIRUS_FILE.scr
2184	chrome.exe
2184	chrome.exe
1984	VIRUS_FILE.scr
1984	VIRUS_FILE.scr
1984	VIRUS_FILE.scr
1984	VIRUS_FILE.scr
6128	VIRUS_FILE.scr
6128	VIRUS_FILE.scr
6128	VIRUS_FILE.scr
6128	VIRUS_FILE.scr
3544	chrome.exe
3544	chrome.exe
6128	VIRUS_FILE.scr
6128	VIRUS_FILE.scr
6128	VIRUS_FILE.scr
6128	VIRUS_FILE.scr
5204	VIRUS_FILE.scr
5204	VIRUS_FILE.scr
5204	VIRUS_FILE.scr
5204	VIRUS_FILE.scr
5304	chrome.exe
5304	chrome.exe
6128	VIRUS_FILE.scr
6128	VIRUS_FILE.scr
6128	VIRUS_FILE.scr
6128	VIRUS_FILE.scr
5204	VIRUS_FILE.scr
5204	VIRUS_FILE.scr
5204	VIRUS_FILE.scr
5204	VIRUS_FILE.scr
788	VIRUS_FILE.scr
788	VIRUS_FILE.scr
788	VIRUS_FILE.scr
788	VIRUS_FILE.scr
1632	chrome.exe
1632	chrome.exe
5204	VIRUS_FILE.scr
5204	VIRUS_FILE.scr
5204	VIRUS_FILE.scr
5204	VIRUS_FILE.scr
1984	VIRUS_FILE.scr
1984	VIRUS_FILE.scr
1984	VIRUS_FILE.scr
1984	VIRUS_FILE.scr
788	VIRUS_FILE.scr
788	VIRUS_FILE.scr
788	VIRUS_FILE.scr
788	VIRUS_FILE.scr
788	VIRUS_FILE.scr
788	VIRUS_FILE.scr
788	VIRUS_FILE.scr
788	VIRUS_FILE.scr

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
5304	chrome.exe
5304	chrome.exe
5304	chrome.exe
1632	chrome.exe
1632	chrome.exe
1632	chrome.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2184	chrome.exe
Token: SeCreatePagefilePrivilege	2184	chrome.exe
Token: SeShutdownPrivilege	2184	chrome.exe
Token: SeCreatePagefilePrivilege	2184	chrome.exe
Token: SeShutdownPrivilege	2184	chrome.exe
Token: SeCreatePagefilePrivilege	2184	chrome.exe
Token: SeShutdownPrivilege	2184	chrome.exe
Token: SeCreatePagefilePrivilege	2184	chrome.exe
Token: SeShutdownPrivilege	2184	chrome.exe
Token: SeCreatePagefilePrivilege	2184	chrome.exe
Token: SeShutdownPrivilege	2184	chrome.exe
Token: SeCreatePagefilePrivilege	2184	chrome.exe
Token: SeShutdownPrivilege	2184	chrome.exe
Token: SeCreatePagefilePrivilege	2184	chrome.exe
Token: SeBackupPrivilege	3936	svchost.exe
Token: SeRestorePrivilege	3936	svchost.exe
Token: SeSecurityPrivilege	3936	svchost.exe
Token: SeTakeOwnershipPrivilege	3936	svchost.exe
Token: 35	3936	svchost.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	3544	chrome.exe
Token: SeCreatePagefilePrivilege	3544	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	5304	chrome.exe
Token: SeCreatePagefilePrivilege	5304	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe
Token: SeShutdownPrivilege	1632	chrome.exe
Token: SeCreatePagefilePrivilege	1632	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
2184	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe
3544	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2184	1984	VIRUS_FILE.scr	87
PID 2184 wrote to memory of 1336	2184	chrome.exe	88
PID 2184 wrote to memory of 2484	2184	chrome.exe	89
PID 2184 wrote to memory of 2484	2184	chrome.exe	89
PID 2184 wrote to memory of 4272	2184	chrome.exe	90
PID 2184 wrote to memory of 4088	2184	chrome.exe	91
PID 2184 wrote to memory of 4088	2184	chrome.exe	91
PID 2184 wrote to memory of 2176	2184	chrome.exe	93
PID 2184 wrote to memory of 2600	2184	chrome.exe	94
PID 2184 wrote to memory of 2176	2184	chrome.exe	93
PID 2184 wrote to memory of 2600	2184	chrome.exe	94
PID 2184 wrote to memory of 220	2184	chrome.exe	95
PID 2184 wrote to memory of 220	2184	chrome.exe	95
PID 2184 wrote to memory of 640	2184	chrome.exe	97
PID 2184 wrote to memory of 640	2184	chrome.exe	97
PID 2184 wrote to memory of 700	2184	chrome.exe	99
PID 4008 wrote to memory of 6128	4008	rundll32.exe	115
PID 6128 wrote to memory of 3544	6128	VIRUS_FILE.scr	117
PID 3544 wrote to memory of 4856	3544	chrome.exe	118
PID 3544 wrote to memory of 3212	3544	chrome.exe	119
PID 3544 wrote to memory of 3212	3544	chrome.exe	119
PID 3544 wrote to memory of 4740	3544	chrome.exe	120
PID 3544 wrote to memory of 3900	3544	chrome.exe	121
PID 3544 wrote to memory of 3900	3544	chrome.exe	121
PID 3544 wrote to memory of 1224	3544	chrome.exe	123
PID 3544 wrote to memory of 1684	3544	chrome.exe	124
PID 3544 wrote to memory of 1224	3544	chrome.exe	123
PID 3544 wrote to memory of 1684	3544	chrome.exe	124
PID 3544 wrote to memory of 4800	3544	chrome.exe	125
PID 3544 wrote to memory of 4800	3544	chrome.exe	125
PID 3544 wrote to memory of 3252	3544	chrome.exe	127
PID 3544 wrote to memory of 3252	3544	chrome.exe	127
PID 3544 wrote to memory of 1652	3544	chrome.exe	128
PID 4008 wrote to memory of 5204	4008	rundll32.exe	130
PID 5204 wrote to memory of 5304	5204	VIRUS_FILE.scr	132
PID 5304 wrote to memory of 5320	5304	chrome.exe	133
PID 5304 wrote to memory of 5508	5304	chrome.exe	134
PID 5304 wrote to memory of 5536	5304	chrome.exe	135
PID 5304 wrote to memory of 5536	5304	chrome.exe	135
PID 5304 wrote to memory of 5580	5304	chrome.exe	136
PID 5304 wrote to memory of 5580	5304	chrome.exe	136
PID 5304 wrote to memory of 5616	5304	chrome.exe	137
PID 5304 wrote to memory of 5616	5304	chrome.exe	137
PID 5304 wrote to memory of 5624	5304	chrome.exe	138
PID 5304 wrote to memory of 5624	5304	chrome.exe	138
PID 5304 wrote to memory of 5756	5304	chrome.exe	140
PID 5304 wrote to memory of 5756	5304	chrome.exe	140
PID 5304 wrote to memory of 5784	5304	chrome.exe	142
PID 5304 wrote to memory of 5784	5304	chrome.exe	142
PID 5304 wrote to memory of 3524	5304	chrome.exe	143
PID 788 wrote to memory of 1632	788	VIRUS_FILE.scr	145
PID 1632 wrote to memory of 2092	1632	chrome.exe	146
PID 1632 wrote to memory of 784	1632	chrome.exe	148
PID 1632 wrote to memory of 4872	1632	chrome.exe	149
PID 1632 wrote to memory of 4872	1632	chrome.exe	149
PID 1632 wrote to memory of 4780	1632	chrome.exe	150
PID 1632 wrote to memory of 4780	1632	chrome.exe	150
PID 1632 wrote to memory of 1732	1632	chrome.exe	151
PID 1632 wrote to memory of 1732	1632	chrome.exe	151
PID 1632 wrote to memory of 3460	1632	chrome.exe	152
PID 1632 wrote to memory of 3460	1632	chrome.exe	152
PID 1632 wrote to memory of 3900	1632	chrome.exe	153
PID 1632 wrote to memory of 3900	1632	chrome.exe	153
PID 1632 wrote to memory of 1392	1632	chrome.exe	157

C:\Users\Admin\AppData\Local\Temp\VIRUS_FILE.scr
"C:\Users\Admin\AppData\Local\Temp\VIRUS_FILE.scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" valuidge.cyou/api/set_agent?id=835B0B2EBD24956701AEC7B30ADF174C&token=19edfae77fa464317284726b20497eded3333549&description=0d5b0d6e95037f7d0d4d809554f3b6d0&agent=Chrome
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x88,0x104,0x7ff80fb3c728,0x7ff80fb3c734,0x7ff80fb3c740
    3⤵
    PID:1336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,15674419331635142322,17675646471984682400,262144 --field-trial-handle=2012,i,17876811649741424549,6033632774024818508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:2484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,16551642241446030292,4578980532034858114,524288 --field-trial-handle=2012,i,17876811649741424549,6033632774024818508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2292 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,15077010573443834325,12839085112263409527,524288 --field-trial-handle=2012,i,17876811649741424549,6033632774024818508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:8
    3⤵
    PID:4088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,11026545990380488611,16678454336827545267,2097152 --field-trial-handle=2012,i,17876811649741424549,6033632774024818508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3132 /prefetch:1
    3⤵
    PID:2176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,14902821863419380316,16681732381153425522,2097152 --field-trial-handle=2012,i,17876811649741424549,6033632774024818508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:2600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4272,i,14712041396241487899,10330985783986308295,2097152 --field-trial-handle=2012,i,17876811649741424549,6033632774024818508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4260 /prefetch:2
    3⤵
    PID:220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4312,i,5888404193277431598,3651303016557497141,524288 --field-trial-handle=2012,i,17876811649741424549,6033632774024818508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3092 /prefetch:8
    3⤵
    PID:640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,4201627858045626033,1878362436584937039,524288 --field-trial-handle=2012,i,17876811649741424549,6033632774024818508,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5260 /prefetch:8
    3⤵
    PID:700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4824

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1920

C:\Users\Admin\AppData\Local\Temp\VIRUS_FILE.scr
"C:\Users\Admin\AppData\Local\Temp\VIRUS_FILE.scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" valuidge.cyou/api/set_agent?id=835B0B2EBD24956701AEC7B30ADF174C&token=19edfae77fa464317284726b20497eded3333549&description=0d5b0d6e95037f7d0d4d809554f3b6d0&agent=Chrome
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0x78,0x124,0x7ff80fb3c728,0x7ff80fb3c734,0x7ff80fb3c740
    3⤵
    PID:2092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,6218896585781219613,3667668893612190440,524288 --field-trial-handle=2044,i,387144967201572599,9209021631120739038,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    - System Time Discovery
    PID:784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,15713219753290622524,2992706887406550307,262144 --field-trial-handle=2044,i,387144967201572599,9209021631120739038,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
    3⤵
    PID:4872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,6283487202915881855,7691982806278688850,524288 --field-trial-handle=2044,i,387144967201572599,9209021631120739038,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
    3⤵
    PID:4780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,988572996556610649,9677051191501326781,2097152 --field-trial-handle=2044,i,387144967201572599,9209021631120739038,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:1732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,10797546644926748507,4439445410328593446,2097152 --field-trial-handle=2044,i,387144967201572599,9209021631120739038,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:3460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,18426541247143602370,582900845006610994,2097152 --field-trial-handle=2044,i,387144967201572599,9209021631120739038,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
    3⤵
    PID:3900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,13254024856564987982,1605949763628757079,524288 --field-trial-handle=2044,i,387144967201572599,9209021631120739038,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
    3⤵
    PID:1392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,16835027707040758176,16175533796669308677,524288 --field-trial-handle=2044,i,387144967201572599,9209021631120739038,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    PID:5504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Windows\system32\rundll32.exe
"rundll32.exe" desk.cpl,InstallScreenSaver C:\Users\Admin\AppData\Local\Temp\VIRUS_FILE.scr
1⤵
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Users\Admin\AppData\Local\Temp\VIRUS_FILE.scr
  C:\Users\Admin\AppData\Local\Temp\VIRUS_FILE.scr /p 132024
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" valuidge.cyou/api/set_agent?id=835B0B2EBD24956701AEC7B30ADF174C&token=19edfae77fa464317284726b20497eded3333549&description=0d5b0d6e95037f7d0d4d809554f3b6d0&agent=Chrome
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff80fb3c728,0x7ff80fb3c734,0x7ff80fb3c740
      4⤵
      PID:4856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,16315430140872665760,7997361165621087926,262144 --field-trial-handle=1964,i,10835037909326754174,1811734148155785128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:2
      4⤵
      PID:3212
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1584,i,13602717897469422925,7305500485575241358,524288 --field-trial-handle=1964,i,10835037909326754174,1811734148155785128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:3
      4⤵
      System Time Discovery
      PID:4740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,14678607451955428784,823097937350039161,524288 --field-trial-handle=1964,i,10835037909326754174,1811734148155785128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2388 /prefetch:8
      4⤵
      PID:3900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,9039798785670723759,12621966995829026675,2097152 --field-trial-handle=1964,i,10835037909326754174,1811734148155785128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3156 /prefetch:1
      4⤵
      PID:1224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,11234752854888622829,16538311821729345839,2097152 --field-trial-handle=1964,i,10835037909326754174,1811734148155785128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
      4⤵
      PID:1684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,16840443283099646099,7523992729591877977,2097152 --field-trial-handle=1964,i,10835037909326754174,1811734148155785128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4232 /prefetch:2
      4⤵
      PID:4800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,1580905273267161205,7121157142385846723,524288 --field-trial-handle=1964,i,10835037909326754174,1811734148155785128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4632 /prefetch:8
      4⤵
      PID:3252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,249826743180284690,15906915359707365359,524288 --field-trial-handle=1964,i,10835037909326754174,1811734148155785128,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:8
      4⤵
      PID:1652
- C:\Users\Admin\AppData\Local\Temp\VIRUS_FILE.scr
  C:\Users\Admin\AppData\Local\Temp\VIRUS_FILE.scr /s
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" valuidge.cyou/api/set_agent?id=835B0B2EBD24956701AEC7B30ADF174C&token=19edfae77fa464317284726b20497eded3333549&description=0d5b0d6e95037f7d0d4d809554f3b6d0&agent=Chrome
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5304
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff80fb3c728,0x7ff80fb3c734,0x7ff80fb3c740
      4⤵
      PID:5320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1584,i,6958896616409628462,3192180710887179727,524288 --field-trial-handle=2100,i,10611819740253751278,14748450454997042482,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:3
      4⤵
      System Time Discovery
      PID:5508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,16714414130708748868,13249474558110930222,262144 --field-trial-handle=2100,i,10611819740253751278,14748450454997042482,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
      4⤵
      PID:5536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,5428566096992924842,9557667150140576756,524288 --field-trial-handle=2100,i,10611819740253751278,14748450454997042482,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
      4⤵
      PID:5580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3056,i,9582979780817843435,15674939055423144062,2097152 --field-trial-handle=2100,i,10611819740253751278,14748450454997042482,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:1
      4⤵
      PID:5616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3080,i,8030414798078670567,7552850307241258530,2097152 --field-trial-handle=2100,i,10611819740253751278,14748450454997042482,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:1
      4⤵
      PID:5624
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4192,i,11398507888140660024,9681932397454290074,2097152 --field-trial-handle=2100,i,10611819740253751278,14748450454997042482,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
      4⤵
      PID:5756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4636,i,3726959607244802931,15501699720033481644,524288 --field-trial-handle=2100,i,10611819740253751278,14748450454997042482,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
      4⤵
      PID:5784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,15755198985400054888,332120327771959981,524288 --field-trial-handle=2100,i,10611819740253751278,14748450454997042482,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
      4⤵
      PID:3524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a9bc91a3244e7d72467b656c5486d15c0ed9f92add88f691c3853e2b856cbd81
MD5 b1e1deec2c4182d0013a230b355f4c7d
SHA1 126437183b8f548051a3f561eea1eb0ee68fc9cc
SHA512 e718639402727b342725497f1be1fb31c240520b2883d9791df2e05dd851d0e309e06e9942c2a24d6090668922ba1d9f9a1ebf9b87311e7d55ee2d605549ce06
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3f7a643c9f0b5b84c10489dbbed3bbc579452182759fd3644770cba90f4424a3
MD5 1917f3eb7c9b0780329930856ca73b19
SHA1 b07d46cd11869ea5685b6f38aba8b3e690605976
SHA512 3beaa0218902edeaec3178dd3942a22700d89d0119212cccc1b62e0673881dd8e73ad583c689fff924420fb66721cc5ccd3e3c58f880109fa9fc586a8b32d812
TLSH
T16AE02BE5DE22AC3F1DFC2718A4654705EB51235B2680994F3B3D910C4FB473A82C685C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 0be75b85adea32a4568b460591c7c8a7f5fa895ff1c0d50ebeeb2360a76c07ca
MD5 6093bd41c8731fcd79dd7b9e67439dbe
SHA1 814171a923d9193a759c5f08b7a9ff60dafce08b
SHA512 098ccb30cc8e147e03f564d355d24116f6edd8c63db8a4df1f3570bd08ac8df8f8a161c97ef7e0ca9cc3c4d21ba7fd3660679e7f56059588fee0af649b282a72
SSDEEP 12:dM1QjHN0ySvdgniLF+gA2zZYoikIgznl:dPs8iL5A4ZYooMn
TLSH
T18013867F96A71E12C164013ED4CB6B702331FD98F45EA71B7274783A3A05B496D87E90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 16ba89b7f1814d8fe34bd3812050f679a0f8173e2946c9bfc787be21918243b9
MD5 62a913b888e3c2d834ccbeb8777e7f34
SHA1 ef1732ccf0fdbffd44b3044e4b1dec4a7a343af0
SHA512 af546091052fbf58e8ce542a4fa1f956f43cd95f660eb37eeb264661254e45866fff8f47313a80250ec9f9f14bc24ff5e0e5f87afda7bfc8e388a90159ec1ab8
SSDEEP 6:/FCKQjikN0f+AFNXl14YtH4kz9+QknfLt37jp+gyaK3t:dRQjHN0f+AFN/LniLF+gyaM
TLSH
T12C132B3DD5570E11C798123CE94B2B3077B0B880F00E4343727474313C0DB09264BD48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 c55b5111abab0b01dd8ec4919f00f26d34ae23c6673de28caafb8ec4ecf5c1fb
MD5 d486966543b25f0c9651ed6127ed833b
SHA1 99e733cdcf11a88579b029ea00dc945ab562e62c
SHA512 af750acdf08e340ff971a1dfc75b1ad5332cc698681f98d1a7e6be41af167de1787fe8eb638a1735e13d8788817954a181b397967ece449ac3bcc14a67f3472e
SSDEEP 96:a2h9r+8DXugOZjW2g8hbl7VOLHKWolU/N/d:PXJbKZmi7Sclm/d
TLSH
T15444C5FB1C04EAD6EB059AF52D93D13C8A7381142EB9EE76F1754CA259907D17828B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 1a4a47e753173d1a53c0b16a18119dbb8b525d9cb7203a3083190bfeda48db08
MD5 90e35dd71b454f38b7e92d45a15c03e6
SHA1 9d958decb27e1a0630f60c61d3fae29eaa2e7998
SHA512 5a332603a6814022a966d357de5c6dfe8b3254555c5d84f0341891f99ae680a52c402362e11421ae8a2545737f622be5cfa054fa255e6f9c473e806af239c64a
SSDEEP 96:O0zoeV5dIvx1GUrbmLDFvDX0Vxwj4AyqldF/w7XHTexguXatV1r:O0zoeV5doGUrK3Zc60hqn1w7zLuKx
TLSH
T148259EE2BE1D1A7AD889503B0EC2B856CFE14368C00D0413AAF14514FE4ED8BD4C12DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 5a87a16f5ee7b65f05b5ce7c2fce6dee6e27d94423e25c60bbf74c6c4fd1a1db
MD5 3e6303ad1f65b9a102abd177c482b7e5
SHA1 a947671f373b3c0e04ac0d3a3e1575a24046cd80
SHA512 df580c36c9d41de170a664f5d65aff544d97f6b18ac93558afb6c04901766d004d5691e600efe93ca0adea0dae40e06b1a158ff3cd5b20bb425e98df2bd33f85
SSDEEP 768:sUfDPLSgcRUv+r44nUfDPLSgcRUv+U44WfDPLSgcRUv+E44LUfDPLSgcRUv+3q4b:Y4d4n4+q6KGKWK
TLSH
T1E9163BB74F24B886E685EBB0BBCDED1C7C742395ECD25882E122927D4AE0FC51B8115D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 c8911d2106da3562c65c4fa79321e2582322d4ce550eefe7ef7040ae33e1a533
MD5 ee993455e7b9f93d3e2596d70ea5ebbd
SHA1 c042f799b959d515da51ec5d0736089bd4879918
SHA512 19367d4c5275c077e8db5723acaf9940f3c785a1545e4eda93ca39298c1fb9f9d972a108c9c47759a10cfe084a7fb6c004b08b72ce3d69def6d377fb7d619ebd
SSDEEP 768:sUfDPLSgcRUv+r44nUfDPLSgcRUv+U44WfDPLSgcRUv+E44nUfDPLSgcRUv+uq4b:Y4d4n4bq6KGKWK
TLSH
T149163BB74F24B882E685EBB0BBCDED1C7C703395ECD25882E12292794AE0FC41B8515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 16KB
SHA256 27da5990d83f22450c570ccb1bb580604cfc2ea3577a4aeebdcf2b4a54ea0c43
MD5 b2c4687c099283a2ab7ae732b4b1a36c
SHA1 be9984cb1b673f038452e001af15120f70e8d0a2
SHA512 0e5d8869e4ef53eac5b2313073cd47407e2f500e9b245ec2bd2d0546deb2dfbcd9d095f629f5b6da06610ef983ba55b91d381189e70822b7e14877d23b265d42
SSDEEP 3:OlH/lf+1TDfh81N1BjE1Xa8tgqyhdWvqK1caaulxfh81J2dj7oWHlwXa7/6tPFkg:KEKfOLGPdWrwItFwE/+Pf
TLSH
T1DD72178B82792808D4E1E3BECA999AC063031FC4975E6E40B249B6A4E1306406BFA9C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 7a00fd13cfdaa3e6ba053616e552ef99194b02acf91a77f240068d165d4d1e5f
MD5 8d58713bb55aaea9007eb330d4db6ac6
SHA1 a0239a39d13e716cfc9acc779aa4a4d0f61c1dc8
SHA512 308a31fc82b9285e50365aba9ef58dfbfc4bedee8576361d996745ea680cb0158fa7c30c70f96430e4b08fda1ad09e00bc6ec3ae0d10d51b800fad0e2cb71ccf
TLSH
T1BCE0864934CEC7ED945895ABD676635D8ED57408BAD9B84317059450339690473E0A70
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 1KB
SHA256 a4db843738bdfad2a5883cc386a3050041533bcdae600669f3e4cad30beb4de9
MD5 3440c478f25e65ba10b0def32db98ea7
SHA1 50e7e83cd01310500d78c306947e5fdaa9e6c424
SHA512 eef4bfc602bf92908f0d7417412f14b14df7ac62dc6f39517d37a51e18d40e00cf2f5b674830ca8b0dbcf9a20a790f80e0a7896ad5ed98d336519acfadc0679f
TLSH
T115314179ABC0696BE72928B97C5943071F3580440280CCF70BEA24AA1DE1F391F2609F
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG
Size 327B
SHA256 24b1c98b3092e49101c35e61bef0a3afcb58f8c27b8fd2ea466687b5c664930f
MD5 5c3513c2c1d2423081f26ca90ed47568
SHA1 15b646c7028b23b0fadb5d672fecf15bf086b0d0
SHA512 5c6a49cc4b9048619eba9ed0c18c8e991c067c0644a7c31a60f500ad46336cc708f62fce5deb463187528fb53b1fd6732d721ecdf557eaa908551fe2ed6fb23b
TLSH
T1B9E086453C9DCBBE5694A4179D61930CEBD0751E9EEE95832F0168E12285804B1D6A70
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 305B
SHA256 ef40eaea4f87f2d45cb87039eaaef9681489bbf4fd90619d900995b35a7322f9
MD5 97ed00f7f821dbae30ee7e5785ca344c
SHA1 6559159aa1a1e84a6899b01f97faa8dee5ab6311
SHA512 fde64ce5ba63116ac01b9b179bff99250864b5ef8ac6e5f77e30b1f88d42fdce6d8b88233b2c0ecc8459f99bc2831bc8131fc11a72563938a749576537eb9e0d
TLSH
T148E07DC534DCC3FE4180900746A0930CFAC0B449DEEE94034705D0C57688504B1C0F71
MD5 SHA1 SHA512 TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History-journal
Size 40KB
SHA256 c54c0118529a6cfeedd2e37506d1e5750cc3a9f7344c28fa42dbfcde17ed9a71
MD5 21add80e2948666a3dadd6bebd48d923
SHA1 433e5e258b76c884bc9f0902ffc0c7ab3cd1f9e8
SHA512 88ebac938fcddd992d3f2d0ffa74bee88f69f53bc3c6036d71621916657e9c2ecb206e0e50cc21d408616dd6d439cff7f414c318a7b5e531a8b897d71f7becef
SSDEEP 3:GllvlNlldNllmllElNllmllhfllmllyfllmll/lNllmllIFllmllVfllmllWFllN:2GE+hm/2IogfX52
TLSH
T15F13040BA8510071C86F4CB88EE17C14377E24DB48C157302099017798431DA1DB7D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log
Size 106B
SHA256 3a0abb41f1f0fe1382e1a68d716c9fe77e222a518a2d468ad4c98dd82b8f3b15
MD5 c441b448b2ed3281ec2d040b40aaf8a3
SHA1 0cdb52276b299da33a381dc57c23a987a4670eab
SHA512 3eeb4f51e1f68b6ffda74ea9e6b027744e1b10bb30fae8f97790fd82874252a177e57bb8c9a291b4664b0116d00336576cef016d6fad344d375bbbaa0f0f9f53
TLSH
T1FEB001F3FA121121D5039DFCA0206796A736A529024A55D1460901356AA9794361F99D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG
Size 404B
SHA256 ab3997be4e32b00c063102832e21480fc1ffd3bc46754b086fd88272a764877c
MD5 07ce25a33127ec80918dac99f17c8763
SHA1 a2142b553256cc45b3817fef1cefd76311ab33ce
SHA512 cb06abb7f417cfff5bbffdf3dd33d4c853066134fb712bb97e5a208ec50352607faa0841b62f77e150c0bb2c135b12907d1f49c56e1b2e11f39b6a80dbec4cf6
TLSH
T1C8E02B4A38CB86AD6448A07BD770D34FDFE0740DA6AEA923870DCD401275104B7C0E71
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 a227b7ec66a53b210b4e4fa65eeb25c785d386ffea7e6a53cd75ee6e6b60a474
MD5 a3bb83b7369b77b12c4760fed0c80186
SHA1 9b57e80068b7b138a504053f1b332468799b7bc8
SHA512 bc058e737925f01eff22599fe800b3d1415b52456712a752882d68d73b894af96abec28c66396d49366c85648de841ff8f421878325ab2ea8e2f1e72b3ddedef
TLSH
T1E7E0D8A025DD829F5605915F92247F0CDFE03408EAEFAA021B029480718A008B3E0AA5
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 550dc1c8b58a646e7ed0ba44084ecf698fba7187f888e7c907ced3c541e12077
MD5 3701e39939b0ac7aa160d67a9fc41004
SHA1 777e4ede56879eb3da334dc6366648d3bc17198a
SHA512 850f399039760dc6a8af21cb9d52396dbf5d611f746d06a724ce606e906e066e40a8c0c7563c056de7f8e501b286cfc9352191ea2b4d7ee9c29fe82203c74a05
SSDEEP 96:F1mKDMkRwcnDh1Je3RLXbXFXKXT8FXSXTCXFXKXTJxhXsXi0XbXNXKXTpcuZXIGq:F13o3mDhWJL1aj+CjC1ajR8lL9aj54Gq
TLSH
T10BA16B6EB90A184EE4AD4936CD78571B5FA9CF0C27FE3767A9DF8B0405B0A5701086E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 daafd447a5472339f8e8299570430e1c365d4f21b477e83aa5c8830c15e50ea3
MD5 bb2663606f497c39fd46c4206f72734d
SHA1 208bd3af5861b1aea5c0418e8c97de864211de3e
SHA512 23a7c6dcdc3e4787b1210436b2b04cf6284fb88d345c9057d8842676e078b682fe1a9d7f6ed5d6902a3e0074527aec96dc9107854c68bf564848b96eafcf39e9
TLSH
T1F8E0869039C9D2FDA85592A75675930C9EF8740DEBEDB8031F91E54422DA90872F2EB0
MD5 SHA1 SHA512 TLSH

Submit Download

67a473248953641b_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Size 121KB
SHA256 d0c08f31de1f646818f0925112077cd3052b50d4fd18ca75d1d3ec5af9281df8
MD5 842897decb46b70d70b3d543e82db7c1
SHA1 79b8d93aa9c3b6dba587a199ccf489b7527fc859
SHA512 9517543c7f24815d3a2d7e24c09b5a4af11c47509ce2817b89a47c16fbec88a14c92ae38540c23c522bb6259b920fe3709ae50d3689d8c5420b24d00c841daab
SSDEEP 3072:r3zCum5nHBRKbYK2ANj6a/4rxMwDLE2sz:rwB34GASx/DLETz
TLSH
T1B3C3E9CCB7A574664363A5B6002F000FB23AB8AAE44C85A8F188D9E97D7446D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67a473248953641b_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_1
Size 303KB
SHA256 bd74b6e9475be3f9b474767206fb41d457d596311dd674213ab2bde9462b1a93
MD5 0f448ce34ff78d20906558563b370808
SHA1 e420ab56774ea9ab11efc949838dcca3faef1f30
SHA512 5408ea2fa5ecd9944ca2124a0f624fa807a0ed6184d00d0006156d54dcd2cf310bb1eb1539bffced7ae4b105ca1e7281f891e4a468515da00eabaf1cde911aea
SSDEEP 6144:l8LrkR+b3WNv4Txz3ZF8LQBiWla05uQNCwZ5PFYBInmR4fVvmHipfy7YVLF9qrPL:XYvIvHVBH
TLSH
T1D164084697601667CD7303FB0A238667773982483FC7D31B25E257B96C223F3E98A949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 e752984b5cdcc54df57281780c4edad4e86c2f522544878a0ee9dd9c3422cd35
MD5 967ccd3fe6694da4478d91282b0666ca
SHA1 5c78168c954bc5df1972fc974c2f599859ec66e8
SHA512 15d8684f73e57ecedb6481fd5d7c2bbd9fb009907f5ae59872f7b3f28039a1bd7a78f5f156cfa9042714a803e5becbf0295e7f9286051545f0c2941bf90e7006
TLSH
T172B00256C2027A12C04253F03DD69ADAB161DF65C7033316A3E11EAEDC29A619527A60
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 465B
SHA256 4dc9d646c99b11bcf11b4f99a1dd60ab5ccae1dd6e6616002f6ba0f2c199d0ca
MD5 ec53da3ea352590cc82183cba22f9bb2
SHA1 08f86b6913348a954fa61ea926b6b69e8ee7fce6
SHA512 22867595d774c2ecc81a114333ec685f330f576f7d02998dbb4ab9fdb89d5945288cf526d5dab9e7c32c3a073be39cc4420d12dcfb48be05ea06614e0aa46f6d
TLSH
T127F092E909C1B06BFDE9A2705E4753251F24C5B90FB11E53E1ECBDC4106FA257405645
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 44564de892d5c68c07461fc08925f4819ef1718d0d1c78de94459b7f90543b4a
MD5 612c7e89a07a39f8573512faa2aa8386
SHA1 a4a81f0e4a373f02116fbbfa086be89026f337c3
SHA512 f36ccf49d4b3683de48cd8b616a6616cd0755df7a66c27b6e31a90d0fbfcb321df98e5f1545518cace3995b7b66c6ad7bfc215effe50226a9d6faee640957130
TLSH
T14DE0869835C9C2BF5455D16F5678A70C8EE43408FBEFA9032703D4803389504B3F1AB0
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13430698310949287

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13430698310949287
Size 1KB
SHA256 9d0eea50eb9219f231b95dbd386b3a46023fa0d99bb381a44aaff9c92a701f78
MD5 a87dc7cda41f97aff0b7c52a6de588c4
SHA1 b9946022aab26d66b3eec0cb9e1d4f59325ea48c
SHA512 f3ff738cb22bf5d80b155f601d37345f8631ef8636c8eef147153ae26510927a6cda9a5694b417384bc886cfa6344032d9ae397507bbec32bf19a46416eee112
TLSH
T15131C024ACE0703BE97B52358CE2C163E6317D063641CC1BB8B3B7390DB23166DA1A1D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 f4d2654dad545c3ef8ae5156422530f339c5c8778477dd0b1799e0e289a1bba0
MD5 8d9674f3a72456c12768d215805ee128
SHA1 512807ed813fcf256b1bd78c72c2157a6344b01b
SHA512 8c1e0d584a1d5aa82f9c7b5f37c53c3ffbe83f1b9ddd3ef331500ecbe24a8200180b68df9220d904b34cab4eeb0ee34941e99bfd85d2bfbaaadb028579a96380
TLSH
T114E048603DCA87AE644550DBA650E74CCFE57409EAEEA4121B09B584639A50476D2E60
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 c2b737e47750e1a06eca645dbe99af828b5eff1ddf9a03bc7dd22d0f5f9ea664
MD5 f4cb29c8370bb5c7503e7523c79086b0
SHA1 1c8b999016e54371179981ed17457f84edd82bd7
SHA512 ff2a5907e39bec73eadb5a9a55c91da1da514572ec0844fdeac7f808ee5a4bfb84954dc2e7a96c1f794a80c35b142879fe6c8da7ee70b964eca93c3edbbc3790
TLSH
T161E086703EDAC7BD5444D4979670A34DCEF4780DAFDAB5475B046480768550876F0EB0
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 5e3aedbd3fc5c276f549f895c037313f3a08b8c4164f6af7dd7fcab9f2d4a496
MD5 19769e574dc6e44710814e9284418ec0
SHA1 ad33e5aa9b79693932d953f51660d53cb0c2201d
SHA512 3693f9bf6d47ab4c9ba133251005930290dab0a39b665b59ce86f8cec476ff1b5cc8d4f0c65f34221c27489120d786bb3b35712c17b3ce355423f6b67d3caf1a
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OkGWVumB3na:1nbZeMrv/hGtkG4na
TLSH
T13CD3884B3A747002DDE59A722CE051BB5E3C716D4F51A5D438B620688EF2963A23E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 bdb78fcd92efc95d8c4d266384b68f10d6132e94277c3feb6f15f3518b21b129
MD5 04e204d9e85c329b780794d0c65ac549
SHA1 b47b7e63a6cf96a5cb3fd3dbc166e44d444bf03b
SHA512 ef2191ea297d402e6f98acc559b6203b8102718a1bf901351b2b90b0543c4e1a29f43e90c98897c61f2a8871dfd778ed4d74442d4bd7b64388d79e5367888c0d
SSDEEP 384:TeuvBnhJsueMEGvIW1DcP2OkGSVumB3na:lnbZeMrv/hGtkGUna
TLSH
T17FD3884B3A747102DDE59A722CE050BB5E3C716D4F51A1D438B620688EF2963A23E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
Size 4KB
SHA256 44d7851ec8b98c28a54059062cccacd1c0a3e439ce86cd55693c84805a0942cc
MD5 412f61dc9d1b29c06a4207adc3285d6a
SHA1 33f47b36b024e2d6e3583246244f792ac868a9f5
SHA512 f101d4cfcb68a678749c1a36fd0bd128c2aef9853605a3ec21cf3449ea50d3697c1e8848ca100948da53699622b1ff76ded631c3988bff81a42e094039b2f432
SSDEEP 48:6eNJz5CN5MYOdq+4LWSNm6zgaMXBVwWOquu3Br3TL/eOEErjQ10wY0wi0wN0wBg3:6eRCNSYYCWs3qvoGZ
TLSH
T16D91EBA336D01143F4FCDA7CF8977A0D9B4961819865E2FC517010480A66E27A1EA4FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 ff23e60e3d1753d86702370fc8fc39558e14a268ab083d1c19508b86abe39d59
MD5 66bdb57d9480b8c4a20e14684348c261
SHA1 8664f155a64f1258c93482f1bfbe2b1658c532f0
SHA512 e06a56dc7f2180f31bbb6e5d2bf6b4923d9324aa80bb926a64714494d378c649f3db23575809aedf45f789cd45f79e2fc430baad699176fa8768e59ff8e50c3d
SSDEEP 6:qeXqVkqozUTJul6rWc/XKuqHKu42h/TWc/mLEJOgLEJLzIEHqVkyCW:7XqVkqoVlQRXXwX4irRmLULI3qVkyCW
TLSH
T13E42688EBC84845BD810027CE2CE96C63D260A2C3F43362E19E586542CBE217C0887D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 26KB
SHA256 14b5fbe4961e4ab9a32df91de2dc719100db3d0f15754d2ade8abeb49ed8517b
MD5 32f2838dff6da6c6093200ce737481f5
SHA1 0fcb2aa1bf1a693f877592185d1f8b800db4a848
SHA512 4d5df54a72d517ba23d4edd977d33f392d65db18bd7278bd32e697ab94db70b95fcc4e0daa006853db4284222d24f0fc9be26830ab0307d656e85e618bfe2907
SSDEEP 384:WvbMsdGfn9xQ2IIIBb5MIMIBNar4sdGIQgxSsdGW4YYsdGJdGCVjOYDPPsdGJdGh:b9xQ69gQT
TLSH
T157C2A75ED3701B45DCAF97FFBC598C2E0772FC89889A1003B4925AFA2863D175A8135B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 320B
SHA256 d08dd2071d471ab931fefac656452345df119c809b795127131e678f882f05f3
MD5 f9feac5aae4d736fe78f3a5da8c6bd70
SHA1 601a59252b336311bf3580b5eb1f947eb6cd5798
SHA512 fe6dee01bbe07069d8723c17a39ac57018654b28975532404ab16d3724b60a4e331aa9259115333f97c6c03ec6e030fafd2fe06749c0c8a3942ad5c541b416b1
TLSH
T1AEE08658B9CDC2EEA454909F6660934CDFD53809FFEA94471F01D888728950472E1AF0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 cd5e30bfff874326024840fb311acd26319c92ddc60f2527869d8d48e728f8bc
MD5 f37ccc4557588ef02c56f52ac20ed8bf
SHA1 9688c7a994f0cf87671e193301849e5795128a6e
SHA512 1816d711970e576bde27a839864f5adbc034bb1a6c7bb110f2c0d9fa193dad805dc6929c17f95682e64cc14837df4cba3f67e5ba83bb1500ae84564a6ba31702
TLSH
T1002145A2F335C248C24A863B653E6B150734D4529FB8ED1F18B6346C3F72E040D472D5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 bc9cf15ef9bb692ac3f6044537dd08906c829a810d38fa8a905b263571fe754a
MD5 638deff349b5912e300c55ef14b948e7
SHA1 6d0782754dd7140e642067b718fabfa2f9db8121
SHA512 f7c41b4f94163d12c44817b17fada92a69f1acfa07f533337d0f1cb4ca9b95d0685a84eafecd574c245bae0cbd16a079c8c4ee1b7b49c5c55747a7873ef4db09
TLSH
T116E0869478CDC2EF9454909B5560934CDFD4384DFFEAAE071F01CC88629A50876E2AB0
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3cc6fbef96f5ba6827f7d4ea6d5fd0aea4fe2eb50788a69499427649b8d84047
MD5 2ac107fb2174836a146829023e2c640d
SHA1 d3822958de9c048f31331fabbd903a9d25873c38
SHA512 d45e52cac33e553da7400e9d42be780661bc14607586f3708e391600b1387237c73002c436ea574723c022ad070f2ea690bfec7fc73aa1cd33de3bcc0df9c55a
SSDEEP 3072:/wGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMp:/7m7Rkm1tYpBeh2BAop
TLSH
T1C5C312275E75E9375879BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3693cea9399c6ac0b5b361e33dfb4f2cdb14f645a4eedc2821adc6230097c3fd
MD5 4d65cc548c988c2890fd8caa957f90fa
SHA1 0295a10ee4e7039c94278347590a6fa9cfb0ef6f
SHA512 4db623490f5906c5041f791058ff052c9c0bb397ff5a3df042bd6f638091612c72b44832b1d487afa74a3bcf5e1e3e95a9082a309802b54d96ca06115632e1bd
SSDEEP 3072:/RGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMf:/Am7Rkm1tYpBeh2BAof
TLSH
T17AC312275E75E9375879BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a78509518c61fae5741b4359d45afaa39513db00d3468f6cd822c8c6c5c55b72
MD5 c73733fb874f182abcbc0e8eacae697a
SHA1 8f4ba2505d8cbc09daf02f85dff7d43cc3d56df3
SHA512 84d92357fc2d65c2392769ee6d2e1641d7b6cabc07b6772bb982e2cee5b728a6d9ce1b5aa0fd76a3965a0d2e92153ac605aa1b77dc8f2d53f3ba512193fb3c81
SSDEEP 3072:/0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMS:/3m7Rkm1tYpBeh2BAoS
TLSH
T14EC312275E75E9375878BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a0e10dcf58a2bd233ffaec9075be69c4e140b42038628d4238501097a01f3b87
MD5 2a0876bf4d75d3e530914ddff89284db
SHA1 3bc8a2ad9c36bd670ca67843e7e3c9b1b808699f
SHA512 a7d512861e0984c6814900e75499432a938c15fef66a8fa527f43a5e17df83a15307dab4a8e79527c01f24e2cf37f2b0c99eff8e39ca97d635fae2e52f874106
SSDEEP 3072:/mGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Rm7Rkm1tYpBeh2BAoM
TLSH
T16CC312275E75E9375878BB0EB08E0B1F1EF14AA6D830DA92C8D86A0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal
Size 12KB
SHA256 1357fdac4f6787e16c32825f6bdf6d3a13a052ddee6de1e306b7d3d755404636
MD5 76817ad0c1054243d966139c5e2e548c
SHA1 fa9c2a9e5b1dfe47306fc9d5aa8df33815003621
SHA512 a0df1e50b986c5d6382e83334fad45524347434abd458afe6ded6bbe3a2bb525295125e5f26ce1d1a8ebd821c514bcf8e59e5b95bf02b61e955a9856fc128e4d
SSDEEP 24:Tv+fQaqL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwS:QQaqY/IHRH34kWqB1kQnjhHmr6ITmUV
TLSH
T1AC42576EDA2CAAA2FEE00B3ED7D1D4127B36A60EC2E8D9F1096B505746C444405DB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 c536580f5a65cdc8f10424cfa28b32903acafbb7da5cabb61bc69c094c7434e1
MD5 4c3761f6781c73d1599ca81254b3d6fd
SHA1 e3093b2f2a2b119ee9221f38f1c662a0af28c5de
SHA512 4dbb34a72ba7a441a7e8308334f1f98f99e178dc7ccd1d7d4e18fb02ab349d5835167e701d4bdffd557c0881241f0c38542884a0e374ca573d295e3e0180ba3c
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0Ju:TkkhCU2QB2zbBxxWUh7U
TLSH
T1C423AF4E5D5462EAD1D6193EFED34C117CBE0B488B2B78D215E01C768CD20EAA43E47C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Custom.theme

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Size 1KB
SHA256 be71c63d52ae8eceff223250801cc55c1e40e066bc51a318f4117466b3a95037
MD5 121726771c31429173dd3c3f851b896e
SHA1 785d35e86c1d62b456b8f30cc6f57a035da72d06
SHA512 655633bc73aa8e6ddf1102ce2b77c86e376be73537d6ac6ed59077e2b352c5dfb10a02028998ace5dcf3d91ba534783414e0641dd516b51bcf9277fce8126ea9
TLSH
T10F41C730F308CE53EED271AF7584C44FB2BC746A8984F7451CC0A069F68711A83B88A9
MD5 SHA1 SHA512 TLSH

Submit Download

Custom.theme

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Size 1KB
SHA256 f2feb0acb39566b6c1cd4e31160818f9ef67c3ea52e38f192ac47542d4e2d29a
MD5 b16f5fc34e99220ca9393caeba1de38a
SHA1 41fb5456f8047d117503b6d431781a9d26b95fae
SHA512 30c1cb0f15520cc892911b93324890c28c80425a60f3514f7cfe4123bdfd017f22e92c45322f0c45be506e8a019996b8c1a92391d7e18db30d77618b5ba9c272
TLSH
T17E41C530F308CE53EEE271AF7584C44FB2BC746A8984F7411CC0A069F59711A83B89A9
MD5 SHA1 SHA512 TLSH

Submit Download

Custom.theme

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme
Size 1KB
SHA256 72b3f2e48bb43cbc656b3098f21062cd138a019ce48693b776d218f4ecac6f02
MD5 7ff017207b5e443615248e2c102ba840
SHA1 4c0192cbf051ca1c584730972e77498146c38e41
SHA512 29ca693cf93305be79540cca7eb864984d85d8a67a40d7cb9a97a7a06e74293e946b19130b351602ab53530b3c97091f8adc154f96a68dcf4d751e6760b8e7a7
TLSH
T1E341DA30F308CE039E9271AF75D4C44FB2BC75668948F7451CC0A065F59711A83BC8B9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/788-52-0x000000000D3C0000-0x000000000D420000-memory.dmp

Download

memory/1984-0-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/1984-1-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5204-845-0x000000000D240000-0x000000000D2A0000-memory.dmp

Download

memory/6128-750-0x000000000D880000-0x000000000D8E0000-memory.dmp

Download