hxxps://invite[.]schengenvizeci[.]com/zm/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
109s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/08/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://invite.schengenvizeci.com/zm/
Sample260818-d1pdnsfb73

Score

8^/10

defense_evasion discovery installer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	4744	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ZoomWorkspace.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4744	chrome.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x001900000002b530-103.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314973341580878"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ZoomWorkspace.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2464	1424	chrome.exe	81
PID 1424 wrote to memory of 4088	1424	chrome.exe	82
PID 1424 wrote to memory of 4088	1424	chrome.exe	82
PID 1424 wrote to memory of 4744	1424	chrome.exe	83
PID 1424 wrote to memory of 1780	1424	chrome.exe	85
PID 1424 wrote to memory of 1780	1424	chrome.exe	85
PID 1424 wrote to memory of 4528	1424	chrome.exe	86
PID 1424 wrote to memory of 4528	1424	chrome.exe	86
PID 1424 wrote to memory of 4700	1424	chrome.exe	87
PID 1424 wrote to memory of 4700	1424	chrome.exe	87
PID 1424 wrote to memory of 3428	1424	chrome.exe	89
PID 1424 wrote to memory of 3428	1424	chrome.exe	89
PID 1424 wrote to memory of 2252	1424	chrome.exe	90
PID 1424 wrote to memory of 1152	1424	chrome.exe	92
PID 1424 wrote to memory of 1976	1424	chrome.exe	93
PID 1424 wrote to memory of 2016	1424	chrome.exe	94
PID 1424 wrote to memory of 4008	1424	chrome.exe	95

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://invite.schengenvizeci.com/zm/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e601c728,0x7ff8e601c734,0x7ff8e601c740
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,2576077654209969015,16879896816527256803,262144 --field-trial-handle=1996,i,13250599889853605124,2479132455801806747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,14299514950549550410,2398324017433736919,524288 --field-trial-handle=1996,i,13250599889853605124,2479132455801806747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,7917674572519300194,3020307662564089552,524288 --field-trial-handle=1996,i,13250599889853605124,2479132455801806747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2416 /prefetch:13
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,14388539366579949871,18264972903710285826,2097152 --field-trial-handle=1996,i,13250599889853605124,2479132455801806747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,2205045928018323793,15702636161442140015,2097152 --field-trial-handle=1996,i,13250599889853605124,2479132455801806747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4512,i,5200798543240170523,4960327630113075486,2097152 --field-trial-handle=1996,i,13250599889853605124,2479132455801806747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4572 /prefetch:9
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,4172403158716487199,10618752824473056013,524288 --field-trial-handle=1996,i,13250599889853605124,2479132455801806747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,18243411616413159926,17874194962630519507,524288 --field-trial-handle=1996,i,13250599889853605124,2479132455801806747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,14122484297387577070,6368623068780855686,524288 --field-trial-handle=1996,i,13250599889853605124,2479132455801806747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,5269070592421165756,427431120037992632,524288 --field-trial-handle=1996,i,13250599889853605124,2479132455801806747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,12255005460110947359,12069395579794803922,524288 --field-trial-handle=1996,i,13250599889853605124,2479132455801806747,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4d34b1a9-fe27-4fdb-a9fd-b557c517a515.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4d34b1a9-fe27-4fdb-a9fd-b557c517a515.tmp
Size 161KB
SHA256 0687b714510ca5ac34c76b5efbc90661b99e76e180fb355216b4d41e065dcf04
MD5 0667504bae9847093c826076baec35ea
SHA1 484e92b68148a429c4e6300d0abc96f4b398243e
SHA512 ece923d7ff45b7d41f5bda1e18e8a58693d88b3af6938e9bd1bf451dfc2c0a523f600dd6ccf56702f7483914e58e67fe1d01a82a68e35507c0866da904ab363a
SSDEEP 3072:CzdNwiioeQ/SomULyQzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:WdUo/mULhWDfxA3OnjrYQ9EU0/hEV
TLSH
T136F312A50C35BC6B0DF9EE89B51D2F90BFD85C9ED6876DA662D82F4C14FA4C80135930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bac74cf9d0083fca8fc933381c151ebda7728fd07af90f094d43e25f007d1988
MD5 1f7f2505aca9438d102cca1ab1709073
SHA1 46b5d892231a8a93ec22804c509ca55a9cfc2a80
SHA512 a88c146d2f96324f1811ab418f8d37a38dfdbf93d51c180e2848b6ec56ae4210ba2adc265a9884eec33c5fb75698a5153ba5846bc22d4c95d3e6064cd66bf678
TLSH
T192E02BA6C831EC370CFD071C61944646E720135B3780894F3A3D550E8FB177A419AD1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0f1c3183bcdd3a8a87fedceaa21e1baec81ea2608042b9714e7d6d516bd26154
MD5 56e9cd98c23d680afc2c2b95fd285afd
SHA1 59cd3fcd20623be229358c067b5adf23bdf5f1e5
SHA512 dfaf41f7bcff51ee0c75d9ee63b60ff49f61047b4faf79a2a1b683072e539f6434cd29b98d752a16de3378c55b6212ef5a8c6a3f49dde1d14c97e1c4f1b979d6
TLSH
T16E81C1F793F8956DCA1155F0AA146E1FCE6E0624531C3CAAC4E4AE4FA3F14B1D24164E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5793ae8d955b4afd4378bc36f5b640694b7b7b901ae91e4eee0917e91c67ed03
MD5 3f8483467d3a1201535b20fbd74a15a5
SHA1 36714b1e95bdf4b362808c29167c0197399e76e9
SHA512 3c6ed212d48c4125e092d957864e755179d46b6d25e011682522ea061fc14be5a13df47553bcde70c1edb3f9a8e65484f5b0734e477ae4921ef9e8bfcccca107
SSDEEP 192:RR23v1ueFhv7H+pAPRp23+9WHsb+WNn+kBbH2p2XaymA3aVyIsnAUge:RR2flxiUX3Uw9J24awae
TLSH
T10A42D72EBD14693B9CCBD329FA227753D7F5112121942E84EBFC8A2C14D75CC222B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0c7202a2fe3c35f1c5da4f28ab1a1a26ba78bc2d24833ed8484ac5d6b45690d8
MD5 e56c3846677db43639c501b1a2a946fd
SHA1 706f2ad5dfc7e9265b3782ab54fcec35b70ff3a2
SHA512 1741c4e125014175d53719bad1fd31fdba8bb3d5a11cb6c90f9897389cedd8966713f24ecdcef92d384aa23a661a2fb9e19e6c1007456d982372c83c4344e296
SSDEEP 192:RR2rv1ueFwv7H+pAPRp23d9WHsb+WNn+kBbH2R2XaymAtaVyIsnAUgE:RR2blsiUXEUw9J2AaGaE
TLSH
T12642E72EBD14693B9CCAD319FA227753D7F5112121942E84E7FCCA2C15E75CC221B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b103be5e6d2392c7ba445c1dd51c253f0d743a62bcdb648d5717e9d3b770ca12
MD5 ad65f0ba898b522477f4e43596711807
SHA1 6c77edf0144eb4c6e2fc173e31986dbb0f475e02
SHA512 a9342ad0c87e302a22fabba02324b730146844b45690e6abca84e84e1a36014f25b9bd40ff6e7c8740dca0aa6e9650166371b81edb787885ac55a1bc879a1da1
SSDEEP 192:RR2rv1ueFKv7H+pAPRp23hd9WHsb+WNn+kBbH2R2XaymAtaVyIsnAUgE:RR2blGiUXMdUw9J2AaGaE
TLSH
T18B42D82EBD14697B9CCAD329FA227753D7F5112121942E84E7FCCA2C15E75CC221B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b7d4611819e6d8e62c20f0eebddc1f5f40c5725dae9139b9462f271498124d5f
MD5 e5ce4bcb1f9970665c2b23b752ec468f
SHA1 5e82f328be9ecb34093267817be70e09136ab75f
SHA512 bac4f4f5c6d3bd71fe8f5f5b8396ab68210b0dc6f9459631999fa37eb46a2c5cb947a57d7a02a8efdacf9ea104d1909c7a3daf8b56a3110cede861fbbe63bf5e
SSDEEP 192:RR2rv1ueFyv7H+pvPRpb3hd9WHsb+WNn+kBbH2y2XaymAvaVyIsnAUgE:RR2bleiJXtdUw9J2vaSaE
TLSH
T1FA52E82FB910697B9CCBD329FA667B53D3F5112121942E84E7FC8A2C15E75CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 602a19806575ce9e8ee5bd22a83578eae19d25ff0e428915ec66d294a6868404
MD5 e8195a66fc4ab18618541ca648cd300f
SHA1 e11d3b41c2c304c7916ba61dc489d2fd1e73475f
SHA512 b1276bc27797cda06c6704982ddd72f1be1ce26e80b75489b694a012e79619155e5fe6ce7f28dcf311fa20398497792c05daa6dbf7cc765aed7191a619e5d0cd
TLSH
T14BB0125080016502C01603F4114674C87118DF10960A1F0153E26B369835351C1241D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5877bb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5877bb.TMP
Size 96B
SHA256 23492f429e13bfcee28364a808be66cefc240803f7d1e91c7059e49ec28b959e
MD5 5e63c7e94e83955688a83bfec93faf96
SHA1 d6ba9c8958ba2180db8f11901b39d7c58c06f555
SHA512 ff0794a89b4cbb96829431737d5ed7fb52e77d5ec0cfeb0e4477717d2ebb3ff3d7319d5e43b6efd5e71917d1402adf7e4ebd2e69c517177bea668abd56b0aa95
TLSH
T189B02288C0022202C00203B828A080F83030CF20C203220EC2F02BB2CCB0220083E220
MD5 SHA1 SHA512 TLSH

Submit Download

b0a58eb3-ae85-4c2c-a107-332a22b0ab06.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b0a58eb3-ae85-4c2c-a107-332a22b0ab06.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3dd452eb983b5baf9d25a05d96abd45028af26f44cc5779d682eec3d98a3ef85
MD5 68e1c342f994af9c9d346181a284f606
SHA1 0de8b28c29c839d780ede2d644dd5bf573894be0
SHA512 f74d0b00135f74436ed9bbe2bff0fd7c8ab6a59b8c6b7a296b8ec650e6cb2d2f9003f84d054a16d2bfcfb29ccd27a43df85cc3a0089cd921eceb60eb928596f2
SSDEEP 3072:QczWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:9WDfxA3OnjrYQ9EU0/hEV
TLSH
T1D8C302A11C3ABD660DF8EE98640D3A60FFF4ADAA92875DD352ED1F4C14FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1a15061bf2d3b7921f185d7d1827f7da04aacc90b8806487f81b5ece5a902685
MD5 84b64ca84ad0db9c321cc1da317b14ac
SHA1 d56cd01dd6002c610778863651e2ddfb870aa608
SHA512 e104d842c84b09136d991c25ed4c00742929207aac88d392dc572d32028302089e0bc65c1850d45baf38ab1d61e3d45a3c567d2f4066f9514e9728bc3912abf6
SSDEEP 3072:WzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:0WDfxA3OnjrYQ9EU0/hEV
TLSH
T18EC302A15C3ABD660DF8EE98B44D3A60BFF4AD9A91835DC361ED2F0C14FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 838b0165d157d3b8b849caec2f493291bccb4fa111bd4b2c07cf51a3b5c41e51
MD5 e702bc6d760d35197c395fb2b67d1d44
SHA1 5652b9f3965d033ed272bae1b9a3c3c6703fae05
SHA512 4357c02763f60cee1ef4034620f73ec8b517d4565fbe2370618d3c61d843bedc78de64b2d72765f9a4c849a3df8e67acf9333661240e558d2a929d3d153831f2
SSDEEP 3072:xczWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:kWDfxA3OnjrYQ9EU0/hEV
TLSH
T175C302A11C3ABD660DF8EE98640D3A60BFF4ADAA92875DD352ED1F4C14FA5C81139D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZoomWorkspace.exe

Path C:\Users\Admin\Downloads\ZoomWorkspace.exe
Size 10.5MB
SHA256 0710dff181f01c0e05442f0fb0e8dc922f510c0866d8b9fff279c7a9d1c58217
MD5 2ddb85dd5b770d51d00030b4ce9a5c4f
SHA1 75932be5c198e17f1d6982d53ca84a0f2828da95
SHA512 70b10cf7c1dd1d6a6a09b60b57aef2815967194d58045f5497f185b16e73e642db9318e1a757191c9383bb5a303f0c94bd36e75d44e3883b8a15d2e12df9007f
SSDEEP 196608:1aZk+w/P+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2P:xnumzZFw5S9pE7Asjp29qIT0jarlZr8z
TLSH
T175B63347D9778DF0CA330B3890D21A6B3305980E485BF4C9E509277ADAF35AADD2879D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZoomWorkspace.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\ZoomWorkspace.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download