293f5da3fffff16917838eac78b7843b231c2d65aef5478309bb76d4bf00af76

Analysis

user interaction
yes
max time kernel
163s
max time network
168s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Screenshot 2026-08-10 204024.png
Size 273B
Sample260811-se4nssstdz
SHA256 293f5da3fffff16917838eac78b7843b231c2d65aef5478309bb76d4bf00af76
MD5 106f52936c800e7ad1fae81638447fa9
SHA1 c7807d398ce8288b6542920063bd58604aaba6f2
SHA512 7261eeb4e98506cb3bbb453a0d106b72982db9ca11336911258b4661e71cab8ff9a97def6b2c16370b65f27e2be861d009b25bab1df2f1f3608eacf1520b7c15
TLSH
T107D0EBC3EB00597CE01C096120F74800D0F0A8F72B100819268AA088C4E5B92EAC2389
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
38	5892	chrome.exe

Executes dropped EXE 6 IoCs

pid	Process
3676	nfatool.exe
8	nfatool.exe
4100	nfatool.exe
1208	nfatool.exe
2956	nfatool.exe
5808	nfatool.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5892	chrome.exe
3528	chrome.exe

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309342198961983"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3912	mspaint.exe
3912	mspaint.exe
5392	chrome.exe
5392	chrome.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
4416	chrome.exe
4416	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe
Token: SeShutdownPrivilege	5392	chrome.exe
Token: SeCreatePagefilePrivilege	5392	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
3676	nfatool.exe
8	nfatool.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe
4416	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3912	mspaint.exe
3912	mspaint.exe
3912	mspaint.exe
3912	mspaint.exe
2556	taskmgr.exe
1992	ShellHost.exe
2240	SecHealthUI.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 3460	5392	chrome.exe	93
PID 5392 wrote to memory of 5404	5392	chrome.exe	94
PID 5392 wrote to memory of 5892	5392	chrome.exe	95
PID 5392 wrote to memory of 5404	5392	chrome.exe	94
PID 5392 wrote to memory of 4952	5392	chrome.exe	97
PID 5392 wrote to memory of 4952	5392	chrome.exe	97
PID 5392 wrote to memory of 3880	5392	chrome.exe	98
PID 5392 wrote to memory of 2104	5392	chrome.exe	99
PID 5392 wrote to memory of 3880	5392	chrome.exe	98
PID 5392 wrote to memory of 2104	5392	chrome.exe	99
PID 5392 wrote to memory of 5792	5392	chrome.exe	100
PID 5392 wrote to memory of 5792	5392	chrome.exe	100
PID 5392 wrote to memory of 1984	5392	chrome.exe	101
PID 5392 wrote to memory of 248	5392	chrome.exe	103
PID 5392 wrote to memory of 5632	5392	chrome.exe	102
PID 5392 wrote to memory of 248	5392	chrome.exe	103
PID 5392 wrote to memory of 5632	5392	chrome.exe	102
PID 5392 wrote to memory of 5656	5392	chrome.exe	107
PID 5392 wrote to memory of 5656	5392	chrome.exe	107
PID 5392 wrote to memory of 5780	5392	chrome.exe	108
PID 5392 wrote to memory of 5780	5392	chrome.exe	108
PID 5392 wrote to memory of 3744	5392	chrome.exe	109
PID 5392 wrote to memory of 3744	5392	chrome.exe	109
PID 5392 wrote to memory of 4120	5392	chrome.exe	110
PID 5392 wrote to memory of 4120	5392	chrome.exe	110
PID 5392 wrote to memory of 2092	5392	chrome.exe	111
PID 5392 wrote to memory of 2092	5392	chrome.exe	111
PID 5392 wrote to memory of 4420	5392	chrome.exe	112
PID 5392 wrote to memory of 4420	5392	chrome.exe	112
PID 5392 wrote to memory of 1300	5392	chrome.exe	114
PID 5392 wrote to memory of 424	5392	chrome.exe	115
PID 5392 wrote to memory of 4592	5392	chrome.exe	116
PID 5392 wrote to memory of 4180	5392	chrome.exe	117
PID 5392 wrote to memory of 4180	5392	chrome.exe	117
PID 5392 wrote to memory of 1428	5392	chrome.exe	118
PID 5392 wrote to memory of 3416	5392	chrome.exe	119
PID 5392 wrote to memory of 3416	5392	chrome.exe	119
PID 5392 wrote to memory of 5656	5392	chrome.exe	120
PID 5392 wrote to memory of 5656	5392	chrome.exe	120
PID 4416 wrote to memory of 1804	4416	chrome.exe	154
PID 4416 wrote to memory of 3528	4416	chrome.exe	155
PID 4416 wrote to memory of 960	4416	chrome.exe	156
PID 4416 wrote to memory of 960	4416	chrome.exe	156
PID 4416 wrote to memory of 2576	4416	chrome.exe	158
PID 4416 wrote to memory of 2576	4416	chrome.exe	158
PID 4416 wrote to memory of 5708	4416	chrome.exe	159
PID 4416 wrote to memory of 5132	4416	chrome.exe	160
PID 4416 wrote to memory of 5708	4416	chrome.exe	159
PID 4416 wrote to memory of 5132	4416	chrome.exe	160
PID 4416 wrote to memory of 2900	4416	chrome.exe	161
PID 4416 wrote to memory of 2900	4416	chrome.exe	161
PID 4416 wrote to memory of 6004	4416	chrome.exe	162
PID 4416 wrote to memory of 6004	4416	chrome.exe	162

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Screenshot 2026-08-10 204024.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc1871c728,0x7ffc1871c734,0x7ffc1871c740
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,4769542712222279527,15966347364423853070,262144 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1528,i,9267863135502854003,5377729900555430265,524288 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,11656296706350334930,18336019153685645148,524288 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,6906766818433357199,15378311088495507526,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,17676918066987650461,8992797634938891786,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4644,i,17500220283304325481,3385001180857889488,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,17305530515747227722,9075977423215528947,524288 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5504,i,13792088530406083426,7556214945943259136,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5516,i,5220331285977806226,17019404471577752544,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5496,i,5082409883991569347,4833002679138136178,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5508,i,8575770527164621184,872490942169504004,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6136,i,13997836792980810562,7544727608796203450,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5416,i,15748689557627731679,1513713877396066491,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5552,i,12402911426364979909,17112854138471106752,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5792,i,6848963628823264545,163232921601522704,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,9476791633413942909,5397910912494763231,524288 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,99592464623821802,9208665525925497900,524288 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,15114883871888072923,1171558986693595345,524288 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5588,i,11426043707698759726,532945187817272710,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4760,i,16612406815382322509,8529571317390302505,524288 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5640,i,8898021654983845486,3098256051960403567,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6208,i,9449875619462953728,8055319100711171832,2097152 --field-trial-handle=1876,i,6028412425542949314,13143693286528647409,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:5656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4540

C:\Users\Admin\Downloads\nfatool.exe
"C:\Users\Admin\Downloads\nfatool.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:3676

C:\Users\Admin\Downloads\nfatool.exe
"C:\Users\Admin\Downloads\nfatool.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:8

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2556

C:\Users\Admin\Desktop\nfatool.exe
"C:\Users\Admin\Desktop\nfatool.exe"
1⤵
- Executes dropped EXE
PID:4100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5444

C:\Users\Admin\Desktop\nfatool.exe
"C:\Users\Admin\Desktop\nfatool.exe"
1⤵
- Executes dropped EXE
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5668

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004FC
1⤵
PID:4500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:1052

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1992

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2240

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:5068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:1564

C:\Users\Admin\Desktop\nfatool.exe
"C:\Users\Admin\Desktop\nfatool.exe"
1⤵
- Executes dropped EXE
PID:2956

C:\Users\Admin\Desktop\nfatool.exe
"C:\Users\Admin\Desktop\nfatool.exe"
1⤵
- Executes dropped EXE
PID:5808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc1871c728,0x7ffc1871c734,0x7ffc1871c740
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1820,i,793726297252651655,7176145164286486145,524288 --field-trial-handle=1912,i,18152013959791933871,18197711576147713225,262144 --variations-seed-version=20260811-010035.322000-production --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,3611304043555556945,2728835583802531114,262144 --field-trial-handle=1912,i,18152013959791933871,18197711576147713225,262144 --variations-seed-version=20260811-010035.322000-production --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,7482230522537312593,8485777459023553411,524288 --field-trial-handle=1912,i,18152013959791933871,18197711576147713225,262144 --variations-seed-version=20260811-010035.322000-production --mojo-platform-channel-handle=2292 /prefetch:13
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,1826265841010010152,15475087407347469443,2097152 --field-trial-handle=1912,i,18152013959791933871,18197711576147713225,262144 --variations-seed-version=20260811-010035.322000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,18244407856884269314,3941156612429963938,2097152 --field-trial-handle=1912,i,18152013959791933871,18197711576147713225,262144 --variations-seed-version=20260811-010035.322000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,7119647363889419482,2357959212836666750,2097152 --field-trial-handle=1912,i,18152013959791933871,18197711576147713225,262144 --variations-seed-version=20260811-010035.322000-production --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4888,i,1898336859768093348,16519826867544306334,2097152 --field-trial-handle=1912,i,18152013959791933871,18197711576147713225,262144 --variations-seed-version=20260811-010035.322000-production --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:6004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a46870a4f28554c5509a47642c26ea22c1a78e05fb0f2dc74fed97e95994a6d9
MD5 506af1388af22dbe29616f39ea82bc4f
SHA1 9cff40cb637867de4dc78249328adafda4abf41e
SHA512 866f5b5c612958f2c3ed7dad6f23775e511c08b2d1dea6ee850f4c0aabca1ff7f59dfdc560fb41ed601c52c6436ffef557f055f81a1bd5cd77066bfe003fe327
MD5 SHA1 SHA512

Submit Download

322f4744-32e2-413e-a47b-f947a59e9ed9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\322f4744-32e2-413e-a47b-f947a59e9ed9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 52d9b5895ca941e1f18ef221e29831981fa988cae9a3806450e21a54913853c6
MD5 52122600b9264c76e83af96ccce7a2a5
SHA1 01a820da5eb10f80f31db4acb29113908d1cd20a
SHA512 de4b1ab29169e0ddde8dfb39c3b7b63c9dfba393aff71ebda1aba319cce5465bb060a27d10c7dc2d085b767f0703f8de65945387f5c91866aae98b69ca9db11e
SSDEEP 3:MsEllllkEthXllkl2zEklNht:/M/xT02znHt
TLSH
T16C440405FFC04415CD0430344011C35003F5F5501511574374510C337CC55D10C01010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 532a4aaa3a9d1e9d829db0d7f3b85165e9e3c8105d18eaeea86062c345d05144
MD5 694ec418e026a2653786ae7bb526841b
SHA1 a11f0f2bb5064fe14d3cbe8bed85a341bbefe85e
SHA512 727321d2d8805f76b4de8665d9222d8b7239265c2f5ca4f26ea19bbeeb29a5fa98e7c76f085b2e5e399c1cb1599d3e61b0fd04ee4b26065a6f7e2fef203a497a
TLSH
T1C0E02608388AC67D8C9485E3A2A9732ECBD03821E2DCB9474785C440B182E047181244
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 96c22037967b81c5cbbc776d3ebba0e0b357b431a3448dca8bf40aebb30f3d7c
MD5 fb6298f262c5c1151af369314893c2f0
SHA1 ad3144de0c29ac847288f0271e4ea69cb7ad2210
SHA512 4d47adf6b1efb74e70ed995234b2d02886ebdc7d244204eb2f10bedc68e42738dc9a4c32f20a37b87dc7ae5b04c3df99854b58918d974a9f8321e893eccf2ba1
SSDEEP 96:ZZPDlB2e0/uejzH+bF+UIYysX0fxQp977EHt/DfLcLq2piRk/E0waQ4:ZC/tH+bF+UI3iWGV7WNkqp3+
TLSH
T1AAF31D5F9F243201CDBE927B68E789B34D6DF02F8B5365856C6144B4CEE2652B02C4BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

808c3ceb-0f33-4285-b976-6d282d149d70.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\808c3ceb-0f33-4285-b976-6d282d149d70.tmp
Size 3KB
SHA256 310b89476bd4a6cbfda1a5f6ab28a88c65ac0e95278e83fa9083462abe648102
MD5 7917539c50c9fff39bdc75ebfbfe088e
SHA1 ace134d31969ccc1a8e246a88dde2bebc9c5800f
SHA512 6b97804d7c9fef734278f358b04119f28b9bd2d8ef838e1e3f38991f6e7e796cac5468914f24381909aa8c8fc6d7e94b52442ed47aa321eb52bde221e50d5a2d
TLSH
T129717BF7C3E4866DC95692F49B256E1FCE2D0928131C3C26C9D4AF4F53E2971E21164E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 859B
SHA256 b3d8286cfe4b74efb0fbeec6bf0d162c293e00253d5c479236cb074ca99ad8aa
MD5 a7952e47c37c5a546ff220a1e95ac1e6
SHA1 4fee69416a01bfffe8cc2cfc51282e846c91a21e
SHA512 6847a7e904b26e232610ed295e93a6b171f91e5e39190bc385ae8e556dea344d26c5df2c261f06ebd02ff2a68d557bb329e15d988551550798f3c9267adda7e2
TLSH
T1DC1188D792BEB06321A949AF0E0ABC4A2571A834529118E8CF56C16CB0C18F71F468A7
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 76513d9a813c191108c05017b37c11bf4de1e69404b31f9690746765c9d1e5b1
MD5 f3f0054c2ab2d2f8cf859e2b1bb8b8ba
SHA1 8da95c6161fbedb90569b26b4873819fa0e7033c
SHA512 44d0b17ca68fa186f23db7c44027241549086d6a5c7d8c6a43d41265174842782f964e53b386be4547357c2f9ec88c4e50649fa6244d0c8c9b4d7cdb663be41e
SSDEEP 192:HRs6a8s4v7FAPRp2o9XxHsb+WNnPs04k1Ae4lBaRQVyIsnAUge:HRs6wksXjfwE0h1+aCe
TLSH
T1A642B729AD10653B6DCBC22DFA667763E7F6102121E43E54E7FC9A2C15DB5CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ea33f33a06d89c96d0545cafd1e0018f3649841627ac0aa28af0b606350036d3
MD5 70f1c6176bc580171bbb6b7a6061b856
SHA1 eb7ca568853751c007adda15a43d6a60a2f469b6
SHA512 addec3d87d09db4cd25710cffa658a67e77f78b561c8b2d6c47dd93027cecf275e60748235592281a831cc0965efe7950202bcf4f049654e292ad14752ea3390
SSDEEP 192:HRs6a8z4v7FAPRp2o9XxHsb+WNnPs04k1Ae4lBaRQVyIsnAUge:HRs6XksXjfwE0h1+aCe
TLSH
T14942B829AD10653B6DC7C21DFA6677A3E7F6102121E43E54E7FC9A2C15D75CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5071d138c221cef9de581432f71e92d626013a4fb975924ffc470663e4c55a94
MD5 b005fdb468258f60256b066dd4439b6a
SHA1 9fba239ab87b75150b7f58b70fadfddcef69e424
SHA512 0b34c1ecebffd7118dae31094b5a1cbdf3ec3fd87eba8e6a8922c028d6bc3a00a1465fd41cf39e220f649d4716e794f8f893dcfaecbe4b9780890d2ba3a59ec6
SSDEEP 192:HRsya8L4v7FAPRp2nC9XxHsb+WNnPsz432nk1Ae4lBaR8VyIsnAUgE:HRsynksXlfwE02k1+aCE
TLSH
T1AA42C72AB910693B6DC7C21DFA6677A3E7F6102221D42E44F7FC9A2C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0679e0bedf0e226eb8ad8abcddd2814a2fdaaf4b8ba62ab2c560f1373a7a8ec2
MD5 b70857dfe6e75dc38e14034db2f47014
SHA1 a6a4401a627a5426c303dbb3d247d0863738771f
SHA512 f55875b69ce35e1995dae6c4d23702813808108f5175d401d8e02dc7416f6a3b814b2021dda6e80b7b6d15646ef52c0f359225178d978f56088d3af3805089a0
SSDEEP 192:XRsya8L4v7yAPRp2nC9XxHsb+WNVL9scDk432gk1Ae4lBaRUPyIsnAUgE:XRsynkPXlfwrb251+a4E
TLSH
T1EC42D92AA910693B6DD7C21DFA5277A3E7F6102221D43E44F7FC8A2C15D76CC221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 13c266dbca2b5307ee00390fe19b8ba337aaaa8761fc666dc190220257c7478b
MD5 8082f8ab0ed8df264dc37c020887a27a
SHA1 f6b81d54b00a5c4e950dae19240b063d1d0fcfee
SHA512 94d820bbb6ffaa12de28f0bd1b73dc4d341353f4b1296941fa00a6c3c87bde8d03d12ad88ef1256d8afe8d50ec6d1027ba4691909947b616e737095a3c61509f
TLSH
T174E0265035CAC6BE18EB808702B0B30E97ECB526D6CC3D065F80D54095C7E087192241
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13430934258177568

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13430934258177568
Size 4KB
SHA256 96390dc45b0de56b0db7a16c58d179b0b86e9838daf498768130cb6e2158e505
MD5 eab37323ee214cdf8eac6d0c1142472b
SHA1 0e82815a81e2dcc9c84996b2ca06f0b056545a02
SHA512 2e10c5fdd0c4c7acd16735105e6087a51a6594d22e4239f6faedb86c84a7c9c3d7f60c0f678f599d6dc66201d34a21a0d5d8ced550e6020db48ddb9a3b210582
SSDEEP 48:3hNUKv9o5uioiSrFiHIgRxjWkhDAk1EGMHSx90iMricpSiEnH0Cjp7+yFXBUn0O9:3hNbuGMI2jCkCdnKLFi0O29m
TLSH
T180A16D269AE4013FF23F853955B611F2BF76B94232925D1F607595080C22B836FB4EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 dba6e669ce4801e088715fab78f3819747ed9a1acbc9fd1f5531e41bc83d0de5
MD5 664c57e0dc44ac078e379c59e69a4a66
SHA1 296497f8c3010acbee5e8aaa7740f59b6a6af2ec
SHA512 1a036bc7874f1e77c7a20e8645e897b0c8beb797a67b7e10c1823779a43eff15afa947d6d50358084ecee6e7d0fb60810b2389c9d24536974def2c70ed244a7b
TLSH
T1F2B012C0B7398106D984053003D79F451764EA5E7080820FCC569A51CD443FC2C050D8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 bf00f65fec27ca78b6c227efd611c2012ee62c1100031520ec282a73eb3bf56b
MD5 c8d50735fea7f1aa75448ebc468f00d6
SHA1 5c97017fa5517579525f3868f676c5dd5a6b1120
SHA512 63a438f5ce1c271f0bfb6abc64708b5d42ff5803e0ef4bf66fecea379626ab1c3eaa67783a2824a50c8ff29b1efa5fbe47a03e74fab80bb98352445995ac61c8
TLSH
T172E0C06031CBCB2F54C640E722B5F30EC1F1B010D6DC75021F15E140D2C7D047293280
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Size 2KB
SHA256 a70423c48119f29be0127edf68dbffe2a325b9955a3462f5d6224af84ac397ab
MD5 903e512bbf5604c333ba41266a37f2b2
SHA1 03e0040d85a348e1e8e5c1d0c2369ff26a2cdb8e
SHA512 7b6bb3a5296220d5dba5703c14b057335669de57967ab8ea9ce4116c7522f1097f8c990bd1bb4926350f2ac4203b71c2606c45d8709d32ee76a561ee05a874d4
TLSH
T1FE51D1F37D015435FD6398FA11EA385CCE6B930E18A8D3E5D3C65D31204395AB41F2A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 41d2372481232d547205bd4bc8b6cf8458f500ef90251ad0c4931ff42f7a7c69
MD5 8b2b5d13f416425aa5dfb63e5ad44899
SHA1 6dff2a9b375714e74b1e6ce2b4b47908250b6f3e
SHA512 fe4ac6a15a2e56f88bc14f018e21196776b449b3cc36bf490668bbf1813a0358ccbd677e33d12eab866d4c03f374946543f20ce289800620b148bf67860581f9
TLSH
T14EE0267035CACB7D0CD2C0C752A8B72F86F4B81593D9364A47049045E183E04A2A16C0
MD5 SHA1 SHA512 TLSH

Submit Download

Top Sites

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Top Sites
Size 20KB
SHA256 446aeff81755b24ace63a3343c23f5c228feee8714e5b62f77c5a2a39704412f
MD5 f3a412a167aad85d5940bea49e16128a
SHA1 88c6a49a33d5a43e5786c30ed898bdb6470ad903
SHA512 ed281bcceb7bedac98350ac947cb4ff083259ecb91b31ae84ab678dd7f3c030c8ea10ff8351254bbabc808a8414d88e70936ab990ec9fc77422a9c87c3206902
SSDEEP 12:TL17CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSzQGKuzQccogHOKupzccogL:TLVCZwE8I6Uwcco5fBkNrc1L
TLSH
T1B69220CF5F10A433D8B04778A2DBC0DC4E7FC61DCBC1EE8440645821AED0890114E0A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png
Size 1KB
SHA256 06c00fa3cb29713aa4317b352fc1e1e035c0c7720a42f107cf758fbb21eaed0c
MD5 247675501d3cf1f7987fe8e20dc4a994
SHA1 c0630fbc0c9c7c2aec627667b21b5b9add1d7925
SHA512 6b6f5e0feb15ecde82191178df36fcf9cebb762289116b88a466ab31152d6f8e769e97252e3a41f7f538867920866ce12bd60c9c87fbb5019783de0c5158bfd8
TLSH
T1C721DB9786803C5AE71F76BD5402AE9BF92060197254970E1A560A15C93C5D3FD873A0
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 7fd53f5a830ffbaa8131614ca3db502001105506e6df6b25c50849c57a84177a
MD5 284db07ad7367a1671e258096f51f0ad
SHA1 51660537dd00ff43ca9775ec8b2279a69f3910e7
SHA512 bc81b1790b0b4963f2ce9b186a2cf4dd1240bd921bdbc0272946459d6387fb17c32c650cbfb7ca3b54dd91fa8902f04e9216a564cbfcb01afdb34420240731f2
SSDEEP 48:T3j7dojKsKmjKZKAsjZNOjAhts3N8g1j3UzBulLULK2VL1LB:f7doKsKuKZKlZNmu46yjUuTS
TLSH
T18B03408E9B7881F3C0F2C13EEEC246E6FC7C6A08D7262DD111F903B55E88036616466A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 5405a6c464ed76ac69bef311ed4cbec60fa1f32a068397ac26dfe7505fffc70c
MD5 1e3cda4110d19f5c86fad6789b657bad
SHA1 c8902d72aae2dc753b49c4a9baaaadf8d42a4d43
SHA512 21c76f02c01ed1afadedf4ed924977eaa2cad92fc18694b7c3a4708a53bb822533eaa36b31872f0c57d6423cfc1e40254027c95ba4edf7547247c9ce28554d9c
SSDEEP 3:mF/lNllv/etXlG2l2Ml+qg/G9TjffaXM/RuWGJpDEJ7KgJpDEJ7HBQLc2lEZxQ6J:mylNMSCc/mLEJOgLEJLbN
TLSH
T10802228BAD408111C432003DCBCFBDE03A3D8D583F96260125E000993C9801640F07C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 29KB
SHA256 65172f99047f0669a16942b6c8592214bb0b275921eab15fff949a119f3fd72b
MD5 1699485b757fa5acb1cea0b1ace2078e
SHA1 fcc15d6dcfa6630bc528c01e47dba3b0dcde8764
SHA512 38eba4a47c3c53faed40a6a80d161f75a0769bcc60ff7274937b7cb3721f3a463331ad6fddaee58630ae8a94a5c34261c2a23186dffbd1a62b2c217193dc8f71
SSDEEP 384:d5pnsdGd5UvrauFJsbsdGKlLapPsdGsr4QM2IIIabaMIMxBEQHLsdGtdGOVSkTQG:VVol7r4QvMhA
TLSH
T14FD2C697B3B00681CC9FD7FBEC648D2E1773DC8E899B0005A6A656BE3873D17684134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 fc84d0a76b90a2f4dab528e3a694495038968eda8a76e189928c66b953b81efa
MD5 f54c301db4b12848596097e4c2c57131
SHA1 a9daf9364229c2fbc9b05a7f0446337236d59efe
SHA512 be31a807fa862b29d8c4faec9c769dba157c4684f9b08216718397e1a61dd67880cef00e2b21baecff1f4dcd4e4f22ffed9491a6f1004f83ee42a291d1eff4db
TLSH
T169E026047CCFC6BEE89681C761A5730ED7C43D22EAE8258B4F40C844E082E046181241
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 11bdcfaed8040d310aea89197ebff176cbaae0a3816e19297f8286cae682daf0
MD5 da361b49a7444d89f6f35d2f91b4a43c
SHA1 656e47135d8d7eab02d2d60b66b5959de3920544
SHA512 38417e879938a74a8551112f21367ee75cd8b7dd5800d276bf6c0a699fef94a14ebd972a82b7d78385c8b77f5e6d29e9aacdd3717251bbc723723799723777b1
TLSH
T11721D256F330C208C199867A247EAB251331E4529FF8ED0F15B530683EB2A151D4B2E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 d71529566a9570d53b9608a186a5df654e822c2195137cb75197877ebee7313e
MD5 e1a8813022fefc82c247c5ff7ee313af
SHA1 177c09676b610ea845a99c764aa3c573776d7f78
SHA512 7a0f62597cc0f91ae6a78f87c3eaa4e58e2e0378d7101a4a53fec6c1786ec041ba1e8e451b7e0dd6e38139aa54b7fc7e5ddb4db9ff19a5ea5a7502acfb191210
TLSH
T17DE0DF8478CAC6BF8892819311A4B34ED7943C32EBA82E4B4F04CC44D182E047186241
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 c1677debf068a69d5cac007dd11280b9fce8d8de47b3dbf1789bfb3406f32bf0
MD5 c800e0277e7d297296f167cd7f1a69a7
SHA1 8e1a5ff8e35d268f13a1844784ff5fa725545cfb
SHA512 8b69b8fc3d9d72ba10543b6d44c0e06ae32e7a1cc477b541b4f12adf8f2e372d7d57aa40193ccb8b537fcb285e141a815cd0951df15bc231cdaa4708a0c37322
SSDEEP 3072:QX0eFCvQtcs32Wa6ntplHc9QSTeZMIaRTw/r3vKHGy:QXJFcQt732W7tplHc9VTex/uD
TLSH
T123C312BBF5A54BAB1EB4CE0551377FDA8FD9288AD9EC7BF191A0B70500250CC9B49C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7b5ba6d20d0e8bccf5569d09e674b41c36fefd08802694fae9514b559b3871cf
MD5 6c6f3b33c41051ac14970dfc3c7a6f88
SHA1 9afd8a4ab2563396a04db6e2aec8975d39f9325c
SHA512 0a3179bc34099b42c1d310c38e6741c8a99c1e9f6ac0a83f64f0f17f9e19aaec4bf3450677048304f6c5fabdff29e6f87f95652d0d05f9564090d4a00f4b27ef
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5+mDxB6nGyvn0b4T80ybJv4a:xC0ITo+TQ0InDUD1HPPb4T80ybl
TLSH
T16DA10835A0284DB74476D446B1626A93CFB97067E972BFA4EAD90F0D25F70EC1341A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 01ac0d12a451116d925c60f70ae825b0acb827c635dae72720c8c95a3998837e
MD5 f674ce04675591f864f5fba6c7612457
SHA1 6e377e54aca0e8e158b0ebefc35fefe97575de70
SHA512 015b8e408d40ec3171037af0d99a1415787c0a12aa5b7f9c8f1074d5345e82651fd35c6b2dd35600c33f0dae0dd31d84f88305713a356f798b08d6603acb3fe7
SSDEEP 3072:TX0eFCvQtcs32Wa6ntplHc9QSTeZMIaRTw/r3vKHGy:TXJFcQt732W7tplHc9VTex/uD
TLSH
T1A4C312BBF5A54BAB1AB4CE0551377FDA8FD9288ED9EC7BF191A0B70500250CC9B49C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 8a6b4dc4092046a14de40aa961503aabbb35c5018002282753efa217a89bcd4b
MD5 da5bb51442c208082d1369441a26f39f
SHA1 e51a47f0eaccccb9da492815f29aec7d78813886
SHA512 ada998f649559a9013777a88b28bf2525a2b74f52e85d7d43f32c28c5bd2fb9598989b80228f4543a7e80736c84f492cd4b461ed080493c4993218de8cbc9d75
SSDEEP 3072:1t0eFCvQtcs32Wa6ntplHc9QSTeZMIaRTw/r3vKHGy:1tJFcQt732W7tplHc9VTex/uD
TLSH
T146C312BBF5A54BAB1AB4CE0551377FDA8FD9288ED9EC7BF191A0B70500250CC9B49C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 35623ebfad1bd469d3ac91a0d353b135b83b3d393067357776f5ac7eb028825b
MD5 1f49c1f28d95063c2fffebd23c90dabd
SHA1 600545896ef1d9c93a93b7c0ec6b3d060cf0a5a4
SHA512 28db7f2fefe2d3a5b687910d0effd3346bfac1c31f2f17d7be5f4967020eb55eb484709abdc9aad3f616709310a90a6fd819feed23edab4783aa6919162d88ff
SSDEEP 3:MsEllllkEthXllkl2zEklMfK/t:/M/xT02znMfat
TLSH
T1AC4404447FD04405C54470315015C3700370D4541571574334510C135CC55D14C04010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 2636e2431e23429ec5b9b26965b65edd09ecf8e852789dce8ebaba029f13903a
MD5 09f00bb954c47a473819ecd1a3fdaff6
SHA1 fd15b9283b429b137ca55e6c221a096534e21c34
SHA512 8101ee2582afcf8f5de445bec9aff9d3f0d6c5c0f90ef2a5cbbd85d8dc37ba58be911030af0294d6a66a257c107ace563b53ff9dd0f4c2f83dcaac3ef58d4d84
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0J0:TkkhCU2QB2zbBxx3DEv
TLSH
T175239B4F2B5821D9D1D6183EFED24CA17DBD4F598B2B68D209E00C764CE14AE542F4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfatool.exe

Path C:\Users\Admin\Downloads\nfatool.exe
Size 8.8MB
SHA256 9f155be4cecd6a914cc61246d6c54050428a59be62457dab23f2480e4a165ab4
MD5 c11715b0d41136035616935b23615de0
SHA1 e2d57d9084f5de64383300a95dbbbfdecdacdfaf
SHA512 d6f353967248f879ee469c4584dfc367921492217890764a2421feff27105bea2c9dca50376f47836a1437a302563d1704e54e16d6e54ccd5d29e66428fdd503
SSDEEP 98304:71u7rbIxYJ4EFKIGFgp1rS05dGfobQzw+Xk8qDnIX:HEFKkrOQnRIX
TLSH
T14B967C12B65B95ACD15AC4B0834686736E2270CB0B36B9FF55D856383F6ABF01F38718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2556-324-0x0000027869400000-0x0000027869401000-memory.dmp

Download

memory/2556-329-0x0000027869400000-0x0000027869401000-memory.dmp

Download

memory/2556-332-0x0000027869400000-0x0000027869401000-memory.dmp

Download

memory/2556-333-0x0000027869400000-0x0000027869401000-memory.dmp

Download

memory/2556-330-0x0000027869400000-0x0000027869401000-memory.dmp

Download

memory/2556-331-0x0000027869400000-0x0000027869401000-memory.dmp

Download

memory/2556-322-0x0000027869400000-0x0000027869401000-memory.dmp

Download

memory/2556-328-0x0000027869400000-0x0000027869401000-memory.dmp

Download