f7d96fde643f99aad02bc23b172b6af1949132782cc7379082723851f3881326

Resubmissions

16/08/2026, 16:53

260816-vec7ysep2x8

16/08/2026, 16:53

260816-vd6g4ssybw7

Analysis

user interaction
yes
max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.php.exe
Size 13.4MB
Sample260816-vec7ysep2x
SHA256 f7d96fde643f99aad02bc23b172b6af1949132782cc7379082723851f3881326
MD5 6a5c5eefb34cd7775c8b636faf821132
SHA1 76058f2cacc0fbf93e7aa6b6231a03d4a55f269c
SHA512 b1dfdc795f6ef48d5987c9897e11af00bb9c69bf9135a11b9959db3e5806dd09cd5f6fcd9b1e0ece6e9f965b3611e014d8ee386e377e1802483ae8f692c92394
SSDEEP 393216:SgAEsZ1i/2DzxDNrHrgxHj5FRK0xRXMCHWUjScuI3/PGTAI:SEsZQORtgxHtFRK0TXMb8vH/O7
TLSH
T160E6332CFEC116EAE5B3813CE7F243A29ABDB4245771C6DF176982A05E531E0453E263
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

microsoft discovery execution installer phishing

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
293	5780	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
2956	Composer-Setup.6.3.0.exe
824	Composer-Setup.6.3.0.tmp

Loads dropped DLL 15 IoCs

pid	Process
3352	composer.php.exe
3352	composer.php.exe
3352	composer.php.exe
3352	composer.php.exe
3352	composer.php.exe
3352	composer.php.exe
3352	composer.php.exe
3352	composer.php.exe
3352	composer.php.exe
3352	composer.php.exe
3352	composer.php.exe
3352	composer.php.exe
3352	composer.php.exe
3352	composer.php.exe
3352	composer.php.exe

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
216	3308	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3612	cmd.exe
5304	cmd.exe
5208	cmd.exe
2928	cmd.exe
4660	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Composer-Setup.6.3.0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Composer-Setup.6.3.0.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3308	chrome.exe
5780	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x000a0000000240bc-1763.dat	innosetup
behavioral1/memory/2956-1787-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313728421332761"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3352	composer.php.exe
3352	composer.php.exe
1644	chrome.exe
1644	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3352	composer.php.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe
Token: SeCreatePagefilePrivilege	1644	chrome.exe
Token: SeShutdownPrivilege	1644	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
1644	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe
5748	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 3352	4012	composer.php.exe	84
PID 1644 wrote to memory of 2744	1644	chrome.exe	87
PID 1644 wrote to memory of 3644	1644	chrome.exe	88
PID 1644 wrote to memory of 3644	1644	chrome.exe	88
PID 1644 wrote to memory of 3308	1644	chrome.exe	89
PID 1644 wrote to memory of 1328	1644	chrome.exe	90
PID 1644 wrote to memory of 1328	1644	chrome.exe	90
PID 1644 wrote to memory of 1764	1644	chrome.exe	92
PID 1644 wrote to memory of 1764	1644	chrome.exe	92
PID 1644 wrote to memory of 3128	1644	chrome.exe	93
PID 1644 wrote to memory of 3128	1644	chrome.exe	93
PID 1644 wrote to memory of 4760	1644	chrome.exe	94
PID 1644 wrote to memory of 4760	1644	chrome.exe	94
PID 1644 wrote to memory of 1920	1644	chrome.exe	95
PID 1644 wrote to memory of 1920	1644	chrome.exe	95
PID 1644 wrote to memory of 636	1644	chrome.exe	101
PID 1644 wrote to memory of 2676	1644	chrome.exe	106
PID 1644 wrote to memory of 2676	1644	chrome.exe	106
PID 1644 wrote to memory of 2596	1644	chrome.exe	107
PID 1644 wrote to memory of 2596	1644	chrome.exe	107
PID 1644 wrote to memory of 4264	1644	chrome.exe	108
PID 1644 wrote to memory of 4264	1644	chrome.exe	108
PID 1644 wrote to memory of 4492	1644	chrome.exe	112
PID 1644 wrote to memory of 4492	1644	chrome.exe	112
PID 1644 wrote to memory of 4264	1644	chrome.exe	113
PID 1644 wrote to memory of 4264	1644	chrome.exe	113
PID 1644 wrote to memory of 2328	1644	chrome.exe	114
PID 1644 wrote to memory of 2328	1644	chrome.exe	114
PID 1644 wrote to memory of 2756	1644	chrome.exe	115
PID 1644 wrote to memory of 2756	1644	chrome.exe	115
PID 1644 wrote to memory of 2856	1644	chrome.exe	117
PID 1644 wrote to memory of 2856	1644	chrome.exe	117
PID 1644 wrote to memory of 4696	1644	chrome.exe	118
PID 1644 wrote to memory of 4696	1644	chrome.exe	118
PID 1644 wrote to memory of 1120	1644	chrome.exe	122
PID 1644 wrote to memory of 5080	1644	chrome.exe	123
PID 1644 wrote to memory of 1940	1644	chrome.exe	124
PID 1644 wrote to memory of 5292	1644	chrome.exe	125
PID 1644 wrote to memory of 5292	1644	chrome.exe	125
PID 1644 wrote to memory of 5776	1644	chrome.exe	130
PID 1644 wrote to memory of 5776	1644	chrome.exe	130
PID 1644 wrote to memory of 5896	1644	chrome.exe	131
PID 1644 wrote to memory of 5896	1644	chrome.exe	131
PID 1644 wrote to memory of 5572	1644	chrome.exe	132
PID 1644 wrote to memory of 5572	1644	chrome.exe	132
PID 3352 wrote to memory of 3612	3352	composer.php.exe	134
PID 3612 wrote to memory of 5152	3612	cmd.exe	136
PID 3352 wrote to memory of 5304	3352	composer.php.exe	138
PID 5304 wrote to memory of 2936	5304	cmd.exe	140
PID 3352 wrote to memory of 5208	3352	composer.php.exe	141
PID 5208 wrote to memory of 1892	5208	cmd.exe	143
PID 3352 wrote to memory of 2928	3352	composer.php.exe	144
PID 2928 wrote to memory of 3816	2928	cmd.exe	146
PID 3352 wrote to memory of 4660	3352	composer.php.exe	147
PID 4660 wrote to memory of 4992	4660	cmd.exe	149
PID 5748 wrote to memory of 5756	5748	chrome.exe	151
PID 5748 wrote to memory of 4556	5748	chrome.exe	152
PID 5748 wrote to memory of 4556	5748	chrome.exe	152
PID 5748 wrote to memory of 5780	5748	chrome.exe	153
PID 5748 wrote to memory of 5336	5748	chrome.exe	154
PID 5748 wrote to memory of 5336	5748	chrome.exe	154
PID 5748 wrote to memory of 6116	5748	chrome.exe	156
PID 5748 wrote to memory of 4728	5748	chrome.exe	157
PID 5748 wrote to memory of 6116	5748	chrome.exe	156

C:\Users\Admin\AppData\Local\Temp\composer.php.exe
"C:\Users\Admin\AppData\Local\Temp\composer.php.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Users\Admin\AppData\Local\Temp\composer.php.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.php.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:5152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\cepuyid""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5304
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\cepuyid"
      4⤵
      PID:2936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"
      4⤵
      PID:3816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"
      4⤵
      PID:4992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc58acc728,0x7ffc58acc734,0x7ffc58acc740
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,2160506733405382091,15850563122249957307,262144 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1540,i,16926103995766375498,16170461405122519859,524288 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1784 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,239259658830691621,10661338439653697196,524288 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,8215405605826138883,3816292349498138352,2097152 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3512,i,9038591110089138150,11877903898555525807,2097152 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4624,i,4309503339348169914,7887900011323342848,2097152 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4488,i,5583089392439376038,15046004065788655183,524288 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,1469616972008054066,2200318718573608136,524288 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5688,i,9469603460138265016,5145113219533961463,2097152 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3644,i,15994773602961341331,12562164081872253384,2097152 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5676,i,11658332331579361515,11054653841050577300,2097152 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4676,i,10596228528626430153,7393596414078125068,2097152 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,5542887618557947345,17920754972607702811,524288 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3436,i,4889383057734002755,577040190445844478,524288 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4436,i,9568939556470786031,9408902118771569395,524288 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3620,i,9036597223932168072,9673748423268025044,2097152 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:2
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5752,i,3709575387901414025,16071780628804428463,2097152 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3140,i,8955561013173635560,10796671580010838868,524288 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3984 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,7249224739863348813,9949926104836106475,524288 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3664,i,7225952532080951094,15298762383861814178,524288 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4648,i,11027399970047988463,9622532809688319961,2097152 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5848,i,4425369435165541855,4346845914135170081,2097152 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5352,i,2461057175807196356,4636576644151285662,2097152 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,17297445189845922460,9364381517094980745,524288 --field-trial-handle=1972,i,9044289417264237860,3348839559125856555,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:5572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc58acc728,0x7ffc58acc734,0x7ffc58acc740
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,4584766359294296450,3200366480866272620,262144 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,3898063250444748613,17412708103819935780,524288 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,7691663999545243817,16879281762608362740,524288 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,15144506925936197847,9495887798094290145,2097152 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,1163707016409322257,5060276417114833511,2097152 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4608,i,10994719641135925298,1209479888395419830,2097152 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3916,i,10289364107890206479,6475086225016697377,2097152 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4896,i,18250028464732212887,10923084616358398991,2097152 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5172,i,2666604413080099562,14125073739642318450,524288 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5216,i,2782850151592157664,11847742583705470020,524288 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5512,i,14618368949918990687,7511938785894484806,2097152 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,4379768433900126399,18211502787952124508,524288 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,1639711500211334811,9070739604212074398,524288 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,693466891499344954,9919701178845308566,524288 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,13229233068207847971,3919087139807563367,524288 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5872,i,12227705210870421743,2726494065786324803,2097152 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,10053828488119519342,9664800692890647201,524288 --field-trial-handle=1948,i,6401917494424567608,281791695036715291,262144 --variations-seed-version=20260816-030043.531000-production --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:5488
- C:\Users\Admin\Downloads\Composer-Setup.6.3.0.exe
  "C:\Users\Admin\Downloads\Composer-Setup.6.3.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\is-FCK99.tmp\Composer-Setup.6.3.0.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-FCK99.tmp\Composer-Setup.6.3.0.tmp" /SL5="$1001DE,882897,831488,C:\Users\Admin\Downloads\Composer-Setup.6.3.0.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:824

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86e547cb-2463-40b2-8898-ff300d2033b6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\86e547cb-2463-40b2-8898-ff300d2033b6.tmp
Size 115KB
SHA256 e1c930323e21d6ec18eb82c680a2cb549632d6b05f8f88ed2be5a43746ef1e2a
MD5 4da55ac2f794465de959916d53972818
SHA1 37d1629f36baf6b89fd380dc5b96825c3d94c18a
SHA512 d6dae0645fdd80e6408038cc7a9e99d80a1b1013d7259096f948a6a9258f1b9ff842143bf12a2d1e8368d8bf248ceb68ae19774907aef885084e6fe5d7424708
SSDEEP 3072:QGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:bm7Rkm1tYpBeh2BAom
TLSH
T19BC3123B5E70E9775979B74EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 2607de90f2293e5dc2145f6fcd437367df06b92c4cbd1178a397aeb171104cc7
MD5 79378c146f4914f6234384b7eac7b9c4
SHA1 c322f25f1eed4cacf423af69f92ef8925dd9a767
SHA512 244c38de19e19e6192d713fff9b9bdaeccc164f4339325c09055650b4d82894c3b77b392bcbc565f9d2c22ab1e325b03719962a3d6397b8271b54314cda6c45f
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 725c45e16bf2fca83c9d78269a5ec54657ddca04d3a5d9dc08437460e5c9c70a
MD5 8f26a5d7d30f24d07ba7742137617b31
SHA1 8d3118464971c0789c4fcad62b12bce31932b553
SHA512 5475dc4003f9aeecb17bfe0adf17f1376f1f5fb34b1632bafc9d77d29d2f0c5d8bc02d9d218ce3ed6965bda4a2b893bfcc3978f3d729fc6b7ecdd23c3585dbf9
TLSH
T1DDE02BB9CC65EC3B28FE171860658746F714536B2641594B7B3C850C8FF0A3A5A89C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000041
Size 38KB
SHA256 3370f2e33b0f3a2dae282f78a6bda56adacc76aaf06c7b388db4fda41b90b92c
MD5 b06c7a8dd8ad214e1f952bfae09f9301
SHA1 a0ab87119773fcc0720f1732763c28db8200f802
SHA512 9755d8ce26ab5b0d2293f00285d2334dd48e4c1b6f78a452758821133bd3d7aa3c8134cb2fab12eebb7120e00feb0b719cacacea7c12eb977c937d5cc50c4c43
SSDEEP 768:MS2Glq2FZ5dIEmd9C/imy3NUm07IARvRqLI:dSYfydk7IARvRqLI
TLSH
T16003F12EB1C51EAC510CAB3D92B74368952353063E6952F08DC297CE8584BD06AEF3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 93c14944d866e8ab933038366c70e605c5a81974ace2ffb0699c8cb622034314
MD5 6d0fef5b1ad2c36dcb28331253175e2c
SHA1 7b5ca296ca516709c88e10f6f5ce5e71538f3742
SHA512 f35bf8f0c4f501ebd5bd961cd371c3ddefd40c8268e5b2e793154658066dcad0786051a767f9b865cfd112543c075b3809005365a5c6a0f82a6cce4dd78a5b7e
SSDEEP 96:JJV8Kl+QJO/C8OowVP0Afc2VceDBrlldXnHWoOGGRrUae3o:JX8DQJ2Oo40Gc2VtlOGGRrh
TLSH
T1D9B1548986C09746EB752278D8C139807A7A04EED9079F0A7754AD35BFC7BED8093388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 59c4692cc55d7b0ee09b9399c698e87879f9d449758676e74288b837fd04f9e4
MD5 c857e4734c55c0767df68ab2ae4efe36
SHA1 30ef97f213640ea70701cf13bd8e8666995dfa75
SHA512 81c5562f6db8c4f107e35ea26b2ca3817279ebe53af2748ca80afa8e1b965df9c5ee74e6a8d83037946dd6a29fd655a83a0553c5320dd913f18a9420d7644685
SSDEEP 192:BTxDO8MQJplVBeBxDZ2cfGVyulNcl13aRwx:BTL3BkSc+VyuEtx
TLSH
T15EF1B38889B09B45DB65227894C134C37A3B05EDC9079F0A77509D31EA87BBDC3933C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 1609300a900bb85d592d74266216747104417ef730662b571fbcfc223e0f5c83
MD5 a8974bb5acae5a7eddc63a1bf147a005
SHA1 6eed455e48e4d42c80a4daabb93f77ee57a3ebc5
SHA512 d1f9a31122876ebde4d6e39eb7b1b9429292a913b29b62f3aad689b5962c63fa3872c0f0478cbebfebb625be890f0d78e5cdde04ec02d5bf0f955faec9062a77
SSDEEP 96:ydQl1b/mzqMj6lQPPXoWKXs5zBMZ6lPwg+z39sRl/+:KMb/kBPPojkzu8l8v
TLSH
T19A91DDC1C4D0AB8AEB551179A8C13D90793F05EED90A1B0B7754AD31BECBBED0097798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 b3fe6ecadce44d18c8fab8897248b63cab2b452a62738b37cdce54c7f78b6ff9
MD5 8ca64099beed4fcdb044066ab0b5ba74
SHA1 8ea3922a56a13ceaceb9d9df35b387c21bf7ce26
SHA512 312775652fc7f97cc6c4c449e71cf71ae379e5c35ebe927d232837292486f31371f0f2579b27daf7aa531369973c20cfe4d2892c82040aea8cccc698b7122348
SSDEEP 192:DRu+0MK5KdDnEmtmMIkGT6uyJGSID3BSCcbs44c7Q0i5Y+xymzmGmmmQ1mDmtD/:DRu+0MK5KdDnEmtmMIkGT6uyJGSID3Bl
TLSH
T1E112ADF787E8866DD91162F0DB147F1BCE2D0918831C3C66C9E4AE4B93E2472E181B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 41944308508ac900ca06b32fe4b1d5be1e6ebc946c2678bb9750fedc8ba4d394
MD5 eef7cce92d495855e30c1220a1418db2
SHA1 41d882152c4f4f75749998903ea4f580365a11f3
SHA512 20d9b50c25b4ea52b419af14d233c68cf4764cbad5d2c9639e003d1ce22dd008dc4e9abc80946288066be7eefab5cc7fdf895d85fd078563878e64b1bcbeaa97
SSDEEP 192:D0DhZB/pXogJrIkvSX7T6FNyJGSID3BSCg0GKx0Yz:D0DhZB/pXogJrIkvSX7T6FNyJGSID3Bp
TLSH
T1A1F18AF787E8866DC91162F09B152F1FCE2E0918431C3C56C9D4EE1B93E6472E291B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 59086db0ba34b63a29227deaa72e2e5cd720dbd7acb30521d30db093579b16e2
MD5 feddb1bd0941d6acc4654e90a8f13194
SHA1 32b8bd275c1a4ea0df8ae38ebd7a8ef1790aab1f
SHA512 ae44b28cf52d14680e3d66a850fc48c740c0841bb4bf812fb271c47ed7adec84635f093c61aa4112e01f8cd49e3b5e92b8f0262b748a228907f662a7c831f71d
TLSH
T12041BEA7CABE746B203858FB1D45B8061AB9A4715241B4F1DFF7C26CB0C5AF31A224D3
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0d9e76749a8f79533ff5ab4fe6902f3525cfa03a79d6466d006cff8e48bdcc1d
MD5 b804f26a984fc9e3c0ce456a946e63b3
SHA1 384bc57039a728782dcd459f5e16f54f697db198
SHA512 4ab9cfe4bbc38555ebc214ad5cb06220312130a370719323a437de36321edb389b0780fee5d0aaad60b587932586b286ec93e7b574aca57f89284f8d0929fccb
SSDEEP 384:5R1QDD9CCXalepvP/HeeyFw9YVN9OcXb4z2tA5E:hQDEjFw9Y3r
TLSH
T14752E86FA8602A3B5DDAE21AF921BB1BD7F5207165E41E84EBFC892C00D75DC3117407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a8d0644ea3ccf08ff67204cecd3a654a93631f1cb7670e5ce2a08c8226fecd4b
MD5 b1fea216871c582825b43331d4bd58b6
SHA1 654b1f81171208b3dc457ba3b01eb06d81863db9
SHA512 e4c6580015d100b393e8e71fab5f5f075234f7b929d55d2f16d32582b39f5c5e263f732064e5f29e5e07560cc048f44d1c97f603884d6dd38379214299e9dde9
SSDEEP 192:C+R1QHzXv72HAPRp299THsb+WNn5Ied1TyVkw1VyIsnAUge:5R1QT/CCXuFw5Nd9ADe
TLSH
T11332B62EA920253B5CDAE21AF9217B57D7F6207135E42E84EBFC892C15DB5CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4e2940582d8b1371cf15708fb5833385bc8bce71973c7234993607f3dd3afd35
MD5 6124524f96e6dcfee6182659130a6486
SHA1 3105219b340157a7bc26f5fd9c65ca95173bb10c
SHA512 c9566a8f1ca662d66797a1038e0f38354aaf38ae956357603b4da7d3a215cbb3f0deaba92c3590367aa25a72c55bd4538748d66c281c309461b99373e1d4c42d
SSDEEP 384:HR1Q2FdCkXalepvP/HgyFwt63YYG03b4z2bAFe:nQ26WFwU3Ywf
TLSH
T1F262E86FA860263B5DEAE226F921BB1AD3F5207165E41E84EBFC8D2C04DB5DC3117407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9b0e82132adf69e1afc7ad5cff02412ce22f0f42fb796ea803b8fd77a8b39140
MD5 79a7ce06c88e39b5c60be217f9b1b7f0
SHA1 5cc1259114d6ea77cb95f90ff3edc9f792a30b3c
SHA512 57c109d9ee3e8f0921409e7a24948d4f51aabbb36299efee8ac1606fe1ab43a935716f263fc14e311354b6ea97798c3b649174fd49bbf80df28e2e51e9cc247b
SSDEEP 192:C+R1QHOD9v72HAPRp2EqFXA6G4Qzy9THsb+WNQ9L5Iey3IQ+LIU2bTyVkw1VyIsR:5R1QuD9CCXoJ//eyFwqVNUb4z2PADe
TLSH
T12352E85FA920263B5DDAE21AF921BB1BD7F5207125E42E84EBFC892C14DB5DC3117407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 2aeba6731b2cde474b0f6b4b2181a1ad7d7b9284fd7edd97d6cfd59a59747651
MD5 7ade738947b154cb2792d4caccd4ab43
SHA1 2b8bb94063ad1eb56d354d1308da55bee56f1cb2
SHA512 409fbb90b0c0957e78ff0f90c4148bb767f9f51171934879da3f710414b9725dcd8eb25fec087a5128aaa854cdf9d5fe218e3a6030c8bb643353d3d98c7b367c
SSDEEP 384:HR1k2JCwXHlepEP/H9yFwtEMjn2YYG0yXb4z2kAhe:nk2MbFw+Mjn2Y1I
TLSH
T10772C86BA460267B6DEAE225F921BB1AD3F1307165E46E84EBFC8D2C00D76DD3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2ccce8568f4c8831b2d912296c2ea898067cd570f48132c6c6eef475f83ed71c
MD5 429e5e66410cf8dce94fb4f97670744c
SHA1 df3e50fa4add0db7251c3b4be52365aa55e1f077
SHA512 e5f9e69d6c515bbda1cf4c19b867e1fe23a498b68281fafc5dcca6b2bc161655a942ed74d1bf8219d2e2e8ada438486a93d7fa7c070aa4041ef765be854c2bfa
TLSH
T116A0021C91C01D26ED115B71606D09C72E91485D5B554343749108459D5F1C89D0650C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5911e8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5911e8.TMP
Size 48B
SHA256 abac159c6ca669a1ff921b95e1b0ea6ca62a30feebe30d88c2817810d6369e35
MD5 714f880b86949a4d2745ed98cb3a6e05
SHA1 4eba314a458bd4ef41d81fc2d0081341add081bd
SHA512 580377e0b68a87975ee6c6711fedc3ec3d7fb01cb91843557ee2379d83bd48b90dd935323e8308985f9fdfc58fa1194b56121da7607242d5ff8ea7110ecc4421
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe592e88.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe592e88.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 7d61d8b09aa8fea8e0f4a9e8a12e9822582fdd1a8f6b814add71123c8430508b
MD5 0df7e26736e1695c0cd0953ba87e1fe1
SHA1 da320f71b04f82afa3037bf39929570f980c7199
SHA512 f0101dafb97e6b222ccbc35ce558bd98c68e7313b657622908fa794ba5a1b9ec14f7b92dc3481d95a858d90fb06385f75b7be4e2ff728dedcee5d31bd0189dd1
SSDEEP 6144:ZW25N3BoXwUQlC0XQcLsUzI+/6m7Rkm1tYpBeh2BAof:/5JrUKXcGbd9oBGcAof
TLSH
T1F63412239D786E7A0CF9A75EB80D071A4FF606A29C5DAA8388D1974433EF7CD4685C31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 099d8b41210af6fe4c4a1be7bc61e5ffd65244c68fe7ff9d4410cebca2580167
MD5 b70f1b581e89e3d85a6ee7a44bd97cd1
SHA1 561449f0df08a4561284c7eb70e20f934b02b572
SHA512 417fc5aa9ce72ae2dcfd618c19caccefbe87a145db0378d5036da613c978384db7d3461b1536b977681bd1be17c9456bf5e33f87c935e75990eec49edd5894f7
SSDEEP 3072:SgSV5JcQaMBoEQwULMlC0XTIaPCfc/WH1c0kvsKWITkEI+lF9ZW:Sg25N3BoXwUQlC0XQcLsUzI+/W
TLSH
T17DD312B2AC792FA70CFA854D7D051355CFFA22939C8DBE8659C2478522EF18C8796C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 c268f4aba20d4d92cd24eecfdb95085b4a9ab853ef2b2877673103dda6d5427b
MD5 bd200f6d341817e90f0c65cbfdf9a78d
SHA1 7848292ad423562af71373263b21b03bbbff8bd6
SHA512 62fd725118031cf8b6ba4c07c2656ab431c9313842f6fc0fd3cbb83ad1bdd93f8b1e63094a8767f3b068477af7414bfbdf572bd83a6dfc5a93ff2d84fa262832
SSDEEP 3072:fJSV5JcQaMBoEQwULMlC0XTIaPCfc/WH1c0kvsKWITkEI+lF9ZW:fJ25N3BoXwUQlC0XQcLsUzI+/W
TLSH
T1F0D312A39C782F7A0CFA854EBD091355CFBE12465C8D7E8255C297D922EF2998382C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 3e31a038c02502eaaf85358dd78e6da7f55790a1242ae3d76e34ca45e35cf149
MD5 6e802af6f8e9ed9ee44a83ce72e5037f
SHA1 868bfd3185177852b7fc2927820b11732498b216
SHA512 803bf4698d0970bfacf6a9117781287d01efd74d5b64024fd925f37adc66f707fb3ffe415f43d7b4d73d8237a0c584fd3b984fe28501f0ff1f5949aaf54dc5a2
SSDEEP 6144:PD25N3BoXwUQlC0XQcLsUzI+/6m7Rkm1tYpBeh2BAof:a5JrUKXcGbd9oBGcAof
TLSH
T1FB3412239D786E7A0CF9A75EB80D071A4FF606A29C5DAA8388D1974433EF7CD4685C31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 b1e89a7884c2f1703cc33afa257fff6b8a65c7a2539e1fce74728f02b6ce40ca
MD5 086eb413cfd908a8472ae76946ba3205
SHA1 d129e86a8507b3b44c98defba7836355ce706bcd
SHA512 8de7b4defee3efebe14e7b54e8fc00a0f345528f836b96ed8b508431e265fd119bc690b588f3d55a1cd33329cb5098548629e2834d16a2c7eab279524187c459
SSDEEP 6144:eW25N3BoXwUQlC0XQcLsUzI+/6m7Rkm1tYpBeh2BAof:s5JrUKXcGbd9oBGcAof
TLSH
T13E3412239D786E7A0CF9A75EB80D071A4FF606A29C5DAA8388D1974433EF7CD4685C31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_bz2.pyd
Size 82KB
SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
MD5 cb8c06c8fa9e61e4ac5f22eebf7f1d00
SHA1 d8e0dfc8127749947b09f17c8848166bac659f0d
SHA512 e6da642b7200bfb78f939f7d8148581259baa9a5edda282c621d14ba88083a9b9bd3d17b701e9cde77ad1133c39bd93fc9d955bb620546bb4fcf45c68f1ec7d6
SSDEEP 1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
TLSH
T16F838E42E3A56AF5F86B80B956C10367E771B954075093EFF348C2693F02F426DAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_ctypes.pyd
Size 128KB
SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
MD5 a55e57d7594303c89b5f7a1d1d6f2b67
SHA1 904a9304a07716497cf3e4eaafd82715874c94f1
SHA512 ffa61ad2a408a831b5d86b201814256c172e764c9c1dbe0bd81a2e204e9e8117c66f5dfa56bb7d74275d23154c0ed8e10d4ae8a0d0564434e9761d754f1997fc
SSDEEP 3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
TLSH
T1A2D36C0B735800AADA779178C5736F47DBF1B456171087CF02A8C5AA2F63BA26E7E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_decimal.pyd
Size 271KB
SHA256 b715d1c18e9a9c1531f21c02003b4c6726742d1a2441a1893bc3d79d7bb50e91
MD5 f3377f3de29579140e2bbaeefd334d4f
SHA1 b3076c564dbdfd4ca1b7cc76f36448b0088e2341
SHA512 34d9591590bba20613691a5287ef329e5927a58127ce399088b4d68a178e3af67159a8fc55b4fcdcb08ae094753b20dec2ac3f0b3011481e4ed6f37445cecdd5
SSDEEP 6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
TLSH
T138446A57A2490CA4EE73807889579B47E7F27C860360D38F43A48AA77F93393676E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_gektor.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_gektor.py
Size 600KB
SHA256 67dfdfa47443045b27b5fa477f66353095d2fe33dcd5eb0643e00fef9fccbacc
MD5 9d4775e0e9f2944758b85a0b6db9813d
SHA1 a203c5c7524ebd4a0927ac9111409ebdc3ca319e
SHA512 e420c2b82c7474777db1c8e568bfa1f71bd582b805d1a050fae512e345b41a175194b0c538a41dc551f8f701c0954cf12ae5fecee1d09776e388def762725efd
SSDEEP 6144:jxNOyoEpyU3OndFiA5AMDQiDyQQ9ZpFBxs7i5W9R/SWRyaQ8sX3RDIjGCqj9YG/f:tL33OeA2dCJIvls7io/5PCOVZ0Z
TLSH
T1ADD4C186AE4DE8270D353494CC41CC75EEAE3A452F077864F62D21D83782E69F47E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_hashlib.pyd
Size 62KB
SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
MD5 32d76c9abd65a5d2671aeede189bc290
SHA1 0d4440c9652b92b40bb92c20f3474f14e34f8d62
SHA512 49dc391f4e63f4ff7d65d6fd837332745cc114a334fd61a7b6aa6f710b235339964b855422233fac4510ccb9a6959896efe880ab24a56261f78b2a0fd5860cd9
SSDEEP 768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
TLSH
T1F5536C01A68080A4C96782B8D9934F5BE6F2F5415791ABDF0318C1CD1F23BC3DAFA796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_lzma.pyd
Size 154KB
SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
MD5 1ba022d42024a655cf289544ae461fb8
SHA1 9772a31083223ecf66751ff3851d2e3303a0764c
SHA512 2b888a2d7467e29968c6bb65af40d4b5e80722ffdda760ad74c912f3a2f315d402f3c099fde82f00f41de6c9faaedb23a643337eb8821e594c567506e3464c62
SSDEEP 3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
TLSH
T1B9F34982A794F4E5F7728C78D6624F17E7F5781A032092DA01CC876D2B1FB659E2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_socket.pyd
Size 81KB
SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
MD5 fe896371430bd9551717ef12a3e7e818
SHA1 e2a7716e9ce840e53e8fc79d50a77f40b353c954
SHA512 67ecd9a07df0a07edd010f7e3732f3d829f482d67869d6bce0c9a61c24c0fdc5ff4f4e4780b9211062a6371945121d8883ba2e9e2cf8eb07b628547312dfe4c9
SSDEEP 1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
TLSH
T141836C11A69050FADFB3C0B5C5675E23FBB4F4801395979F0166C66A1F33382BE7AA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_uuid.pyd
Size 25KB
SHA256 f9d5008f0772aa0720bc056a6ecd5a2a3f24965e4b470b022d88627a436c1ffe
MD5 3acf3138d5550ca6de7e2580e076e0f7
SHA1 3e878a18df2362aa6f0bdbfa058dca115e70d0b8
SHA512 f05e90a0feaa2994b425884af32149fbbe2e11cb7499fc88ca92d8a74410edcd62b2b2c0f1ecd1a46985133f7e89575f2c114bd01f619c22ce52f3cf2a7e37c4
SSDEEP 384:bROw4TUyiIWlIJ0wsaHQIYiSy1pCQxHoQSJIVE8E9VF0NyEIkz:4w4TUyfWlIJ0wT5YiSyvBk2E3kz
TLSH
T19DC27F56DAA05C46DD278A70B4E24E16EEB5BA514B50C3CB3318C2950F623C37BA73F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\_wmi.pyd
Size 37KB
SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
MD5 1c30cc7df3bd168d883e93c593890b43
SHA1 31465425f349dae4edac9d0feabc23ce83400807
SHA512 267a1807298797b190888f769d998357b183526dfcb25a6f1413e64c5dccf87f51424b7e5d6f2349d7a19381909ab23b138748d8d9f5858f7dc0552f5c5846ac
SSDEEP 768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
TLSH
T136037E56E7940855D937C6BDC8E64E27F5B1B5825711C3CF3318826D0F32382AA7A3BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\base_library.zip
Size 1.3MB
SHA256 5bb4da421b26ca788cf84d71597ef16072bab5ce7eef3346923af2f91aab4752
MD5 326e1423ac571f88054c45e7e437bbdb
SHA1 ba4e7d8162c33aefd22a729f0c255b5e14d018f1
SHA512 e160beaf882779618cbe342fdcf46c7117cb4e148ad5ffdeb8e012880a56dc463aa0541b1a82c6ceb7d361eee79109a75570db272b60dc3b6dc6dabe7f9e4ce8
SSDEEP 12288:iF6O/HW7Wp0aJZ36RXN7ti2cPudx5/dTdjQSD4tNLeGQbsuOBg80201jwCVRDVo8:p7Wpu5cPudx5/dTddsHasRCeSHkU
TLSH
T17E551A92B9527953FF14F37B80B7484CF32E86A2EF00C207355A42661FFEAB49D59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 625KB
SHA256 4c4161e63ba1c4e7fe49738aac0f2442e200101d78ae88652477640a9570f97a
MD5 99a18cde81571bb1a85a256b9757cc2c
SHA1 17a886a7977a08d5021496b4eb05110f4bf2b9c1
SHA512 ddf0d33ddba13b0c691e6019d196e0a5c7a02a1230294f3d647cf4fe2f989369c5b7cdad1368369a3fc448d63895967e83267899f61fa27663681f7e2067f8ef
SSDEEP 12288:kcIxPU6PCVHvi5v3ctjdcg7fUoP9c95RnEvAICG:kcWM4ctjdcg7fUoP9c95RneAP
TLSH
T19CD4294BE1FA25E0E6B6D17C078BF2737C3ABA488160775B355CD3A127D4A5212E1F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\python3.dll
Size 68KB
SHA256 a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
MD5 16855ebef31c5b1ebe767f1c617645b3
SHA1 315521f3a748abfa35cd4d48e8dd09d0556d989b
SHA512 c3957b3bd36b10c7ad6ea1ff3bc7bd65cdceb3e6b4195a25d0649aa0da179276ce170da903d77b50a38fc3d5147a45be32dbcfdbfbf76cc46301199c529adea4
SSDEEP 768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
TLSH
T14B635CD26B57F8A2D6F669FC38DD99CD142B12CC83258DDFA57893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\python313.dll
Size 5.8MB
SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
MD5 b9de917b925dd246b709bb4233777efd
SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33
SSDEEP 49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
TLSH
T1E9568D16729D40ADC97B8078CA038A4BF7B27C417F60534B61A6BB5E2F733624B6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\select.pyd
Size 30KB
SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
MD5 20831703486869b470006941b4d996f2
SHA1 28851dfd43706542cd3ef1b88b5e2749562dfee0
SHA512 4aaf5d66d2b73f939b9a91e7eddfeb2ce2476c625586ef227b312230414c064aa850b02a4028363aa4664408c9510594754530a6d026a0a84be0168d677c1bc4
SSDEEP 384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
TLSH
T1A7D28E47AF605846D923C972A8E28F26ED35B752875082CF3268C15D0F627C27B7B3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI40122\unicodedata.pyd
Size 693KB
SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
MD5 0902d299a2a487a7b0c2d75862b13640
SHA1 04bcbd5a11861a03a0d323a8050a677c3a88be13
SHA512 8cbef5a9f2d24da1014f8f1ccbddd997a084a0b04dd56bcb6ac38ddb636d05ef7e4ea7f67a085363aad3f43d45413914e55bdef14a662e80be955e6dfc2feca3
SSDEEP 12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
TLSH
T1F9E4F6D5BBCF8D26E69B363A48E3710F5171C2735F0A863BB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ec2c086-7eea-4c56-92f8-e93775e17399.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1644_379549854\8ec2c086-7eea-4c56-92f8-e93775e17399.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1644_379549854\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Unconfirmed 881641.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 881641.crdownload
Size 1.7MB
SHA256 10826b503ba6823f14893f0627823017ee1778881222ea9960a7e268739d6956
MD5 add3ad031f6f9be619c766657933f049
SHA1 ba1859d5d2f964f4ad2d3f6eeddb2f34b4699a44
SHA512 9abffa53210168509d47ec7fcd2928e9c2c2547c45ffea7459f5d942cad31754d1afa73426119792141fa072db39435d1502a491821ddaec5f7fcd66e82ad275
SSDEEP 24576:h4nXubIQGyxbPV0db26WPf4ySNYmAkfaGwZL9J3ph9E6A0No/uRiwwVZPZnHJo3:hqe3f6a4fYm1Sn3phjjNoGsww7PtpA
TLSH
T1AB85C03FF268A53EC46A1B3205B39250987BBB60681A8C1F47FC394DCF765601E3B656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2956-1787-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/3352-1328-0x0000000070180000-0x000000007022B000-memory.dmp

Download

memory/3352-103-0x0000000070180000-0x000000007022B000-memory.dmp

Download