sheetrat | ada767407c8bc302b79404c4a6b4895c45b08a48c593472599cc2373cf445e96

Resubmissions

20/08/2026, 15:07

260820-shetvaszav10

20/08/2026, 14:59

260820-scp3mael2110

Analysis

user interaction
yes
max time kernel
900s
max time network
899s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/08/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
w5uexnu2lns3pa1y.exe
Size 488KB
Sample260820-scp3mael21
SHA256 ada767407c8bc302b79404c4a6b4895c45b08a48c593472599cc2373cf445e96
MD5 21b6a6db075dcd0f36a02c064ea63bbe
SHA1 3056fa139cca9a3eedda3a3588ad8b79dc029086
SHA512 87a0dbf4846fe2913e32b4ecabbc536d84f6ecd646f8997925b415c798ec5ce69be956c69c4c3d843348c9a584e17db437c68e329e3af6e370fea564ad4544c6
SSDEEP 12288:7dAuKGVQ35/OZwI/wY6CHTyMobMvoPff:dKdI/weHTqbCaf
TLSH
T120B419257FA48E00D580287ECA7E3A09CB16E0F225426347370AF7A25D459DEDE6D3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

irvine-zebra.tun.ply.gg:46022

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/1232-0-0x0000000000580000-0x0000000000600000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\xdwdDefender.exe"	w5uexnu2lns3pa1y.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 18 IoCs

pid	Process
1496	xdwdDefender.exe
4152	xdwdMalwareDef.exe
3596	xdwdDefender.exe
4000	xdwdDefender.exe
4640	xdwdDefender.exe
2564	xdwdDefender.exe
836	xdwdDefender.exe
4408	xdwdDefender.exe
2236	xdwdDefender.exe
3024	xdwdDefender.exe
612	xdwdDefender.exe
3588	xdwdDefender.exe
764	xdwdDefender.exe
1032	xdwdDefender.exe
3412	xdwdDefender.exe
3808	xdwdDefender.exe
3152	xdwdDefender.exe
2512	xdwdDefender.exe

Loads dropped DLL 27 IoCs

pid	Process
1496	xdwdDefender.exe
4452	Process not Found
4448	Process not Found
4152	xdwdMalwareDef.exe
3596	xdwdDefender.exe
2796	chrome.exe
2340	svchost.exe
3740	chrome.exe
3288	chrome.exe
4132	chrome.exe
4000	xdwdDefender.exe
4640	xdwdDefender.exe
4748	chrome.exe
3556	chrome.exe
2564	xdwdDefender.exe
836	xdwdDefender.exe
4408	xdwdDefender.exe
2236	xdwdDefender.exe
3024	xdwdDefender.exe
612	xdwdDefender.exe
3588	xdwdDefender.exe
764	xdwdDefender.exe
1032	xdwdDefender.exe
3412	xdwdDefender.exe
3808	xdwdDefender.exe
3152	xdwdDefender.exe
2512	xdwdDefender.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File created	C:\Windows\System32\xdwdDefender.exe	w5uexnu2lns3pa1y.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	w5uexnu2lns3pa1y.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xdwd.dll	w5uexnu2lns3pa1y.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File created	C:\Windows\Web\xdwdMalwareDef.exe	w5uexnu2lns3pa1y.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File created	C:\Windows\xdwd.dll	w5uexnu2lns3pa1y.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	w5uexnu2lns3pa1y.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RealSetup_7274e9111691ef186411e839887f9d1950fcaec7d88901f7bc1736c8d8836681.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1292	cmd.exe
1780	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2348	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317115607557982"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	w5uexnu2lns3pa1y.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RealSetup_7274e9111691ef186411e839887f9d1950fcaec7d88901f7bc1736c8d8836681.exe:Zone.Identifier	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2108	schtasks.exe
4044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3428	chrome.exe
3428	chrome.exe
2796	chrome.exe
2796	chrome.exe
2340	svchost.exe
2340	svchost.exe
3740	chrome.exe
3740	chrome.exe
3288	chrome.exe
3288	chrome.exe
4132	chrome.exe
4132	chrome.exe
3428	chrome.exe
3428	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
4748	chrome.exe
3556	chrome.exe
3556	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	w5uexnu2lns3pa1y.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeDebugPrivilege	1496	xdwdDefender.exe
Token: SeDebugPrivilege	4152	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3596	xdwdDefender.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeIncBasePriorityPrivilege	1496	xdwdDefender.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe
Token: SeCreatePagefilePrivilege	3428	chrome.exe
Token: SeShutdownPrivilege	3428	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe
3428	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3032	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 3468	3428	chrome.exe	83
PID 3428 wrote to memory of 1400	3428	chrome.exe	84
PID 3428 wrote to memory of 1400	3428	chrome.exe	84
PID 3428 wrote to memory of 2348	3428	chrome.exe	85
PID 3428 wrote to memory of 4140	3428	chrome.exe	87
PID 3428 wrote to memory of 3748	3428	chrome.exe	88
PID 3428 wrote to memory of 4140	3428	chrome.exe	87
PID 3428 wrote to memory of 3748	3428	chrome.exe	88
PID 3428 wrote to memory of 1820	3428	chrome.exe	86
PID 3428 wrote to memory of 1820	3428	chrome.exe	86
PID 3428 wrote to memory of 4048	3428	chrome.exe	89
PID 3428 wrote to memory of 4048	3428	chrome.exe	89
PID 3428 wrote to memory of 4536	3428	chrome.exe	91
PID 3428 wrote to memory of 4536	3428	chrome.exe	91
PID 1232 wrote to memory of 2356	1232	w5uexnu2lns3pa1y.exe	93
PID 1232 wrote to memory of 1292	1232	w5uexnu2lns3pa1y.exe	94
PID 1292 wrote to memory of 2108	1292	cmd.exe	97
PID 1232 wrote to memory of 1780	1232	w5uexnu2lns3pa1y.exe	98
PID 1780 wrote to memory of 4044	1780	cmd.exe	100
PID 1232 wrote to memory of 1496	1232	w5uexnu2lns3pa1y.exe	101
PID 3428 wrote to memory of 2796	3428	chrome.exe	106
PID 3428 wrote to memory of 3740	3428	chrome.exe	108
PID 3428 wrote to memory of 3288	3428	chrome.exe	109
PID 3428 wrote to memory of 4132	3428	chrome.exe	110
PID 3428 wrote to memory of 4284	3428	chrome.exe	111
PID 3428 wrote to memory of 4284	3428	chrome.exe	111
PID 3428 wrote to memory of 3988	3428	chrome.exe	112
PID 3428 wrote to memory of 3988	3428	chrome.exe	112
PID 3428 wrote to memory of 2452	3428	chrome.exe	113
PID 3428 wrote to memory of 2452	3428	chrome.exe	113
PID 3428 wrote to memory of 4360	3428	chrome.exe	114
PID 3428 wrote to memory of 4360	3428	chrome.exe	114
PID 3428 wrote to memory of 2824	3428	chrome.exe	116
PID 3428 wrote to memory of 2824	3428	chrome.exe	116
PID 3428 wrote to memory of 4400	3428	chrome.exe	117
PID 3428 wrote to memory of 4400	3428	chrome.exe	117
PID 3428 wrote to memory of 2940	3428	chrome.exe	118
PID 3428 wrote to memory of 2940	3428	chrome.exe	118
PID 3428 wrote to memory of 3008	3428	chrome.exe	119
PID 3428 wrote to memory of 3008	3428	chrome.exe	119
PID 3428 wrote to memory of 4748	3428	chrome.exe	121
PID 3428 wrote to memory of 3556	3428	chrome.exe	122
PID 3428 wrote to memory of 1632	3428	chrome.exe	123
PID 3428 wrote to memory of 1632	3428	chrome.exe	123
PID 3428 wrote to memory of 1928	3428	chrome.exe	124
PID 3428 wrote to memory of 1928	3428	chrome.exe	124
PID 3428 wrote to memory of 960	3428	chrome.exe	125
PID 3428 wrote to memory of 960	3428	chrome.exe	125
PID 3428 wrote to memory of 4340	3428	chrome.exe	126
PID 3428 wrote to memory of 4340	3428	chrome.exe	126
PID 3428 wrote to memory of 4008	3428	chrome.exe	127
PID 3428 wrote to memory of 4008	3428	chrome.exe	127
PID 3428 wrote to memory of 4980	3428	chrome.exe	129
PID 3428 wrote to memory of 4980	3428	chrome.exe	129
PID 3428 wrote to memory of 2528	3428	chrome.exe	130
PID 3428 wrote to memory of 2528	3428	chrome.exe	130
PID 3428 wrote to memory of 4360	3428	chrome.exe	134
PID 3428 wrote to memory of 4360	3428	chrome.exe	134
PID 3428 wrote to memory of 5024	3428	chrome.exe	135
PID 3428 wrote to memory of 5024	3428	chrome.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\w5uexnu2lns3pa1y.exe
"C:\Users\Admin\AppData\Local\Temp\w5uexnu2lns3pa1y.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name=";F6eg'I2g60vgB" dir=in action=allow program="C:\Windows\System32\xdwdDefender.exe" enable=yes & exit
  2⤵
  PID:2356
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\xdwdDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\xdwdDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2108
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4044
- C:\Windows\System32\xdwdDefender.exe
  "C:\Windows\System32\xdwdDefender.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdeaa0c728,0x7ffdeaa0c734,0x7ffdeaa0c740
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,6700220775066419234,17938412334300887143,262144 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,13465933561053949965,17804037099054848487,524288 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2272 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,2959945902124570279,16536538181663428399,524288 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,17946660178687096440,11743847401300184748,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,13320501538142620515,16385165815979251729,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,7774394705191712328,16076645516721893847,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,7877314821059255471,4631329674696986307,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,16123553283858237232,4086821138543909911,524288 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,12063390160590191634,15995481771755594963,524288 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:14
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,8493769046358822501,9642095833775515704,524288 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,8016817236728458925,18286604932081641447,524288 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5860,i,7953546791496829862,5394873921445235502,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5952,i,2758295524897571592,11057342340938715120,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4324,i,5988150030525288059,8564698199944087685,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4436,i,4905080241839896443,14042002994782831872,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4432,i,9342705756093241346,13189467166440743643,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3408,i,14473155478007908053,15989818947738165074,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4304,i,427406159625328704,4284987313609366309,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3528,i,6136016136616341628,13193854090852523353,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6020,i,9536787270710655248,13236399066006548961,262144 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4324 /prefetch:10
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,7811639977074609179,9621370768199114321,524288 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  - Loads dropped DLL
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4336,i,2876111124758226462,1478933166871159775,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5956,i,11225606879892408921,17076976254303010793,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6132,i,12210272024028080931,17359127115473782247,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6164,i,15053649367114662492,17309909396903820424,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4328,i,13119932890866215650,743157648399451945,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4308,i,2286074056849814912,4734287087665523952,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,164112800100380110,14943327398710179590,524288 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:14
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3136,i,16832064451969392345,17840646441192830644,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1920 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3252,i,12835523594376825215,12525847937645850802,2097152 --field-trial-handle=1904,i,1583095951614990978,5918190167694028129,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:5024

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1708

C:\Windows\Web\xdwdMalwareDef.exe
C:\Windows\Web\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2340

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4000

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4640

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:2564

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:836

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3032

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4408

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:2236

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:3024

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:612

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:3588

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:764

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:1032

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:3412

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:3808

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:3152

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 60a0c8ed8cecadc0c45bfb756a110985a6f7c1b5fc6dd2bbb331107e5535b8ef
MD5 8e860c495db69fcd012b38080e948af6
SHA1 31de1ab869fcc876db71e5220e7527f21d476d36
SHA512 72e52e9804e7b5e1987dd3fb9f933af650a4722a991b2ca7532c6987eacc7f70f5da9703ba198dcf1ef045dd6411f1a6438950b14258d6f2fd08d18f95136ca5
TLSH
T1D1E02BA5C831EC370CFD171CA0544646E714135B2681C94F3A3D820D8FB163A459AD2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 72KB
SHA256 0df3c4f39d3f7f318e5e9c31c07d7ff54b52d551ac30ab1c709743167f53a64b
MD5 718bfb329979c646da12fa79376bae76
SHA1 28dacce140caaad9a8492766e18ed92b0c93d2c2
SHA512 cb670c914b72c530362c7df9c2eb5b77bdbbe3c6d10f089be55a01e7534b21042203eff4edf3780b3369942a371aaeb317adb6dc34783dad39fc8f7a681433b5
SSDEEP 1536:GuNC1lRrqCNDEMmaSTJ2ed+oQK7vsmLMv29xy68oaVBOMS5In3N:LMlQCNYZTJkPAvsmz9N8oavOP4N
TLSH
T141730246A7ED93FDB5EC33E31742A406180908A8DC7A9BDFFD1F07AA1C1CA0195D895E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 912B
SHA256 216acdc2089c6bb9bee20636765f08e19eb4d2ff2e254847fe7f6e6f415667f1
MD5 04336768cf1ca5f03c858d86b2af430c
SHA1 70c20d29eca10c61a6f65c461121ad62d615af38
SHA512 7506fef671ad9c836fca08c9df77a0404cd770b1bb139f832c9339fc73cd3eb92fd8127626311f71993d5f76cf064067419742d6b3dc5a46e548da4b9bca623f
TLSH
T14C112C5166FD1634CB142CB548F8081030B1A44883331F3300B3A63994EEBFC9AA0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 936B
SHA256 194c0a2f134c0c018e3eb6f660422fb79323ea15dc21b1fb43eed2a93c40684b
MD5 c658a8670d660c03fa7a74a48c3fd14f
SHA1 a9c711386d50c515221719be94e1f98e636c1c19
SHA512 472a469734e3a2d1f025c84070fe9212ea58702481e2c834d5e5bbce6a26812a82712eb28a540b64c8b31bcb29f7dbda885241ff7fe5bc63a58882f721e7fb8b
TLSH
T14511FD6A59FD1234CB646CB588F50C6135B0948883331F3300E3A63594EFBFC96A47B2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 0145f8f0e3d786401b5962240c2cf28c0dd25d6aaa6c580bb04f4b1b9e7334ee
MD5 0080f72d527e0fc3a75a0f228db1c282
SHA1 5e19ef78ef01ed4045e18d316a7d2324812f2436
SHA512 4ea63314b298cdb4328f0234b519870c69e286f7402e70339facac314c05b510f71bcc5fb7e292a715c688ecb3280feb7fea37478bd58117873533864bc49b50
TLSH
T1D701F9A126FD0234CBA16CB158F10C6030B0A44842330F3B01F3A93481EEBBD8A70BB2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 efc0a4cbd3f4969d3f3a5f785363ad492e91f738f7bd95280c9019dcd31cdf7b
MD5 ed21e394546d262e0709809af7b5e2a0
SHA1 0d3fc082b1a992e9420cf233ffc96e4d5aecbf6b
SHA512 07831ba023bc02d29ffe0c97fb77f42d885ae939e9172ff297522dc91f85007219ddda30eee49c19c9b24676c528c5fbabe3925b9c596f2d283c9af3b0fd2dd8
SSDEEP 192:D0uwxy3XyH3aICiXgpicmCPsbSEd7G93fK:D0uwxy3XyH3aICiXgpicmCPsbSEd7G9C
TLSH
T197D167F793E4C66DC91256F49B25AE2BCE2D1A24432C3C76C8D4AE5B93E2472D20174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f4d89b1d5432500e81c19e789ea2f2b380a68f3c96c825bf5e2e8df6f603e854
MD5 48bb4fb8ebd1e190fca489638a73c729
SHA1 f141d5085b8b37f34c0461c7489d82b9cb22a72f
SHA512 f71d36fa3fbb60f6bf85455aa2459d730a9064a8419c5e68afe3b2a3a3b2264fce42ee8de735391b0e92bb503ea00a67a9dc1fe1f135db047ebfc5654bae167b
TLSH
T1C3519CF7D3E48A7E851156F49B216E1FCE2E1A14022C3D6688E4BF5B53E2872D20179F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 34f1f6a6059171a603280b9ff4c27390787892fdb2fb527c0fbdfe3920b8f757
MD5 6b6bb913010208a4aa9cf3175aa0c3d9
SHA1 f9773197fe699729a909aae17b9ddba0278ad2b1
SHA512 06fed32c102c9b272104e99173de7b7b0791bf54ad99c7a2be3b0f6693e44f6e86c5f052bc015721c3522b833c9852c2fbe93122e16b101149a68a5c92c572a9
SSDEEP 96:D0uwY+kBluxIqVaICiXUbpoxcmuZfNEd7tLfDjhYVX:D0uwxkBluxIsaICiXgpicmuZfNEd7tLO
TLSH
T12BC17AF793E4C66DC91196F49B25AE1FCE2D1924432C3C7688D4AE1B93E2472E20174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 522a019401e978490099e0fc5e5a9b93527404f1e83e0676078a3db7e0a5967b
MD5 e92b7eaecd4779546fb226788f8eac49
SHA1 28dc14c7efe3df039d342f5e5172e9defca3c129
SHA512 96ec6111ce58160e90c261f39cea95c05449210cb7290a467b00e9fcf92ced86dbbdf05fdebf803c1c84ad7c55493a515e3521aadd58bbbf5ded46422012085d
SSDEEP 48:YALlqDq0h/FzWzaXYfoKsxgmgusDUWzsnDswoWgVs3+snjsTf2skf4sSfs/osiDa:DkVJVWaICihUbpoxUVW2fSmS2
TLSH
T1BD915AF7D3E4896E891156F49B246E1BCE6D1A24432C3C6689D4AF1B93E2872D20174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2fb69afc1e48f41148c5ef53d521723fdae5d1a46cebc9e28b3a08497aa4e080
MD5 63e38d3621faf79b73ce01c893b2bd20
SHA1 45b3ea7664c26aa67c9005f5744af55592519485
SHA512 fd8cd87289c1d24fdb95d5ea27dbe91d5db064f03abd2c4943e2c5c4fcf75587fc131708c8dac770b6ab14ca358373d42fea4f123fdceccc0aafcda582dd93b1
SSDEEP 96:DkVJV+y3XqaICihUbpoxcfxGHsH3a/PZ6E:DkVJEy3XqaICihgpicfxGHsH3a/PZ6E
TLSH
T1E5D18BF7D3E4C62EC91156F49B256E2BCE2D1A24432C3C66C8D8AE5B93E2572D20174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2e2002f1175029f2d6b1da786769a62edcd6fbfc78accde73f1384de80292186
MD5 f373dfea124ba868edb669b18cdf729c
SHA1 a954dfcb493dba59af143bb475e33d216209f951
SHA512 19fc1ec3e91f1b13f77f7b592e40ce29e4b8ef5a843cabd3551bcd4f03bcd6473ce6f4a2dba3be5b66726ad729102807e5001009d67f4e705497094e999babc9
SSDEEP 96:DkVJg+y3Xy7aICihUbpoxcm/PxJwpbStH2:DkVJ5y3Xy7aICihgpicm/PxJwpbStH2
TLSH
T117D16AF7D3D4C66DC91256F49B25AE1BCE2D1A24422C3C66C8D8BE5B93E2472D20174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 60bde5b61659e8659f89041a4ee42a5d44736dac51b0375116a9e380f159cd1e
MD5 f686bfff62c9f1e7bf09ca4b1504f885
SHA1 eac1ea243029adfd822db122fc8eaa9ca1a3ddaa
SHA512 7f3225479beac7ab6e5f43f9229db67c7c754ef46732848481808b424a9d023610ae3545e17718ae5f6acabda3f70e47464cfdeb91e506343533762b8cc50296
SSDEEP 96:D0uwg+y3XyH22aICihUbpoxcmuPxJsbSEd7k:D0uw5y3XyH3aICihgpicmuPxJsbSEd7k
TLSH
T1EFC157F793E4C66DC91256F49B25AE1BCE2D1A24422C3C76C8D4AE5B93E2472E20174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 3e7813e6b816c36f0b927b2733360992ea25b2fe1be41cf8c0e885014ceec089
MD5 bc0615bced2fff35aa12a14ac2510553
SHA1 efce9bbf8f8aa0c68a114e9df4519340fd2b11c3
SHA512 14603ac2bb6262e4b54da87f56d0fa3134202693685e7df6a2ebf3e8d8427fd189c5f9a61a00c7963cdbe818d472aa5a22cde6ae9dc2fdfb5c92fda3b12d408c
TLSH
T156217E57D1BEB467507848AB1E49B8055EBEE430024164F4DFAB81ADF0C15F71B26422
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 91d144b4add57e46dbb7aa607a661feb161cd01e930ff226c608dd4e1cce62a8
MD5 603dcbaa8c80a3d258a2b78bf3107b4e
SHA1 2feb86f13a3556d18514a0d24df1c577233c5349
SHA512 5f7c07ec2d8de2a9005e4b56faf6514f354150838e77c738949874cffeff8552edf70476775df4107463d43a5f1ec9077557eea9bd3ab3fb4684edd1566f15b0
SSDEEP 192:URcHv9TqtJv7H+hAPRp2X9WHsb+WNnRX0E92Re//VgbVyIsnAUgtaJ:URcPSJi8XQUwZ0o2E/Vgd8
TLSH
T12742D73EB914693B9CCBD329FA617B53D7F5202160952E44EAFC892C15E75CC221742F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 db4e9731e67f51c1731d7d76f139ad632ab9eaa4b46fbe839a0a57b128de90d1
MD5 b980233e2f528e416a191d29b089e82b
SHA1 b68234a4248eb99f55a0d4b61bb98ffcbf7cfa55
SHA512 fb37dcf87e9cd8df657b0c5b44723e230303006a74b54a04d7f2d0bc044956af73b1ca54475ed9f3e029833669a115164aa07bb69dc0d22bf0d27ac247cd61b9
SSDEEP 192:URcbv9Tq+Cv7H+haPRpYFVtn9WHsb+WNnRXZ6wYFlI92Re//VjbVyIsnAUgraJ:URcrBOiKXQUwZLY02E/Vjde
TLSH
T19052D77EB924693B9CCBD229F9617B57E3F5202260912E44FBFD892C15E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8cb20dc2a8fe8410527bafbb7ff922c058a9d60e870eb5255ab36e8c26700fc2
MD5 a5a096252f80f416ed7bdf3dcb55d1a5
SHA1 b159f28749706de71055db954f17d90382036d7c
SHA512 5676c55e84dce7870a06f5045207d70331a6e39b04eaf12aa357a86a666f2c9af79d14399dd4383e3d474350338df6ed18c3c5684c285ee93c2b6933232438c2
SSDEEP 192:TREbv9TqIZfv7H+MaPRpYEUVt/U9WHsb+WNKApJm6wAFtN2ulI92Re//VjbVyIsB:TRErDdiTXtUwLMAt2x2E/Vjde
TLSH
T16A62D77EB924697B8CDAD229FD217767E3F5102260D12E40EBFD892C14E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 64b77edf09116913bacad50e54ac0b8fcec260c554c5e3418c9e96cfee78c7da
MD5 92a95394e1cfdf5fb3523e59d98e3492
SHA1 c9a9d518b9c85c5891f9f8dd5039e059d0cfc353
SHA512 2710ff8adf25df6919b80ab47d66cdbdcb3d6da69aae5dfe8abb4779eb6d90154254616feffcd6a70642003adf79ae74bba73986712f946fe3fbf502454b8fca
SSDEEP 192:URcHv9Tq+3v7H+haPRpYFfn9WHsb+WNnRX02lI92Re//VjbVyIsnAUgraJ:URcPBfiKXkUwZ0Z2E/Vjde
TLSH
T12652D73EB914697B9CCBD329F9617B53E3F5202260952E44EBFC892C15E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 933babb290aa7527fcc8b94af548293ae4f1af3a1517c2f338874f2e8612f250
MD5 3dee08c8a01a556732f622496c7752a8
SHA1 63d1ee5dcb224e6dd1388696c92709ec8d0f77cc
SHA512 a3bc1bd9ae7c6385e4ba9f7e0b95e4cb81123bd6efdb6923684bbbb15650316bdb82022a75bafeadf49307827e7da273a70d27fda0d02ea7e5921cfcf3930614
SSDEEP 192:JREbv9TqtMv7H+MaPRpYFVtn9WHsb+WNnXLI6wY8lI92Re//VjbVyIsnAUgraJ:JRErqYiTXQUw7mYL2E/Vjde
TLSH
T11F52D77EB910697B9CCBD229F9617B57E3F5102261912E84EAFC892C15EB5CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3c36be41a2b7b62a128c51daa9d047aa28e36bb6a86ba58742774cf549e5eb95
MD5 142bca2c4134051c8e1b35db33ccb8f5
SHA1 259531ca4f34702ca545073d4b6723d16c2913ed
SHA512 8bc4e0587715d8cebe9b100d42b4d61a203ba27794dd543260d83c259db2248cee24895026210383b7e8905fe49e513ba5515e59e1a8652b2b1842293bafba3c
SSDEEP 192:URcHv9TqY3v7H+hAPRp2Vn9WHsb+WNnRX0or92Re//V3bVyIsnAUgraJ:URcPLfi8XkUwZ002E/V3de
TLSH
T19152C63EB914697B9CCBD329FA617B53E3F5202260D52E44EAFC892C15E75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6ff4f36b9825bed5e1158d9955f4e757e9ac3d356dfa6e3dbffdbbb9e34fe541
MD5 9610b978b81f3c643dab11a1ef0b2284
SHA1 e97098df4a580e1584589427db34d3c42c3fa3ed
SHA512 6a4d1df4c5cd4b0dcb2838dce931f6e50b8558d4e85653ee4e32f1b9b1c0e0017fc6e015b0946c03939bdb249622f4760ff66f3fc505fa47e4b5f067a727647c
SSDEEP 192:URcHv9Tqj1v7H+pAPRp2X9WHsb+WNnRX0E92Re//VgbVyIsnAUgtaJ:URcPuFiUXQUwZ0o2E/Vgd8
TLSH
T14A42C63EB964A93B9CCAD329FA617753E7F5202160952E40EBFC892C15E75CC221742F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6331df7a30397a3bc39e63f33cd94e3a7c59d3b9f90f8dbef7b5b9c5b560982c
MD5 52f3e92c4c705f37b42c78a0aeb6e6b0
SHA1 9e3d1cfa26ac32b4ebd1e73aafe1e1a027cf13c4
SHA512 9fd696d613909bff37a2b29790afd7097a0cf6597da319b41f2a3c128be78d385b61bf3acf1c881dfe004ca9d3fea867108eecc0007db7e1723358f87578b741
SSDEEP 192:URDbv9Tq+Cv7H+haPRpYFVtn9WHsb+WNnRXZ6wYFlI92Re//VjbVyIsnAUgraJ:URDrBOiKXQUwZLY02E/Vjde
TLSH
T1C452D77EB914693B9CCBE229F9617B57E3F5202260912E44FBFC892C14E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f1ddb60a641f45406237a8b83f7c0a905adfae9585232bac8e6a1aa1eb7d944a
MD5 239c63196829bb7abe557af56998c7e0
SHA1 4816817e93fe4f9bb37427ecac98512f60a72f0c
SHA512 28c4a0ecfb2f2dc44c9a32e7aed854841f0729591d8746bdb6d8274746f6f38f2b1176771509204db33c8109f6240c660a56e9758d05d9ee432b37924bc25208
SSDEEP 192:TREbv9Tq6Mv7H+MaPRpYEanVt/59WHsb+WNKA+CY6wAFN9WalI92Re//VjbVyIsB:TRErNYiTXSUwH2AZWt2E/Vjde
TLSH
T1E062D77EB920697B8CDAE229F9217767E3F5102261D02E44FBFD892C14E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c11454bd704d35f25a2bfa9b37ebd9fea566254822b42895a8b3cd18e354231f
MD5 887268a0b526ae85ecebeceddbf91064
SHA1 b86bb674d3973f8a59e24b403ed560fa5216b058
SHA512 b43369fd6f685256e3ad362640f2642efbaa125bd0a9aa2b45dfa3749547fc47e1de2c135b95aa5a93f5d86443e63493be366fd2ad8d149cfa59a0280746d4a3
SSDEEP 192:RREbvJTq6hv7H+MaPRpYEanVt/59WHsb+WNpEBNp6wAFxtCGlI92Re//VjbVyIsB:RRErpxiTXSUwybAtCJ2E/Vjde
TLSH
T17A62E77EA960693B9CDBD229FA217B57E3F5102261D11E80FBFD892C14E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b2d672fd458be33b29a29b3a3030369cc301b86ce09e71cc151a7836ee4abc0a
MD5 1a3fba1b1bc10a7ec0567a6a92da1100
SHA1 2aeea7b1029a8a69c9a2e284e65f386557d429c9
SHA512 9345a4b8f7b81a228583b95612bf23834f81de1c2b9a57c9294e62878d9711bbfb84120182ba12e4b1fe6c76d2eee6a6d073ecf5e043027a7d115eee26035674
SSDEEP 192:RREbv9Tq69fv7H+MaPRpYEanVt/59WHsb+WNpEBNp6wAFxtCGlI92Re//VjbVyI6:RRErN93iTXSUwybAtCJ2E/Vjde
TLSH
T15962D77EA960693B9CDBD229FA217B57E3F5102261D12E80FBFD892C14E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 91a00d19d0d69d96876d1ebde5d3260f1baa71ce437a9f495782614966dfff92
MD5 93ed5268771c2c8dc8ad805dbb30d7ef
SHA1 71a714adea27b8b0350cc313196376b6e48ae416
SHA512 9a113b3b47a7c4e4b22c7ffae072c931387f127cf9a17729e89122c2b19bb06fa3004da3490eb4b7ca526599acbe0845140f75ec2505af84d53a7f242db13334
SSDEEP 192:URcHv9Tqc3v7H+hAPRp2Ffn9WHsb+WNnRX0or92Re//V3bVyIsnAUgraJ:URcPTfi8X2UwZ002E/V3de
TLSH
T14952C63EB914697B9CCBD329FA617B53E3F5202260D52E40EAFC892C15E75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 00ea9bc05419cac94075bd82cae3e304c290a9bb4829b5a43d4f30528b070e8f
MD5 21e0414a5066253a63412f4781f151ce
SHA1 faeeed514e16219f8ef97180332dd1e43b8260ee
SHA512 c5d634b4db09773784b9e9a99dbecd4150c33d7731e3bba95a31b479158a136ef5c866facabc31ab976ceb9b33a65508342b536f1f9cf9930d718fd9822a3c07
TLSH
T19EB0120080025342C44206B0214624CC71685F19960B270983E86D33C8361A2C014090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587ceb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587ceb.TMP
Size 96B
SHA256 c51b28ffb44636d00d193753b10e8d51db40283876e890eead3b98f131a7b63d
MD5 0eccf6c8457366fb91b4ec538859fdbf
SHA1 df73547dfb8c94a661be463d5371bdd06ea11834
SHA512 29b720f02fe311e28492b6f2cec76f1c5c052201ec61e76eb903678815861881c78c05e26ba00467759cb23f081d4b7e4dd45d4740e062b2fc75a8545843e38d
TLSH
T10CB00255C142A352D25207B026E599DDB160EF6AC6035216E2E62A66DC256B1862B1A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 2a289af98b27bb5cf57912baafc15cbc835f32ba9056051fdb828e126cbb43d9
MD5 163614e9dfa6888decba54f1e180050f
SHA1 13250a0d50aec5f936df146ecfd23bc2f11640db
SHA512 35c33b3ced7a946f7ccb1e1aec602d1c081c30d5bdae2ab1e845509f601a797ec5440e51cce77fae179022d81430e177db5093562f8e6d48d4cb7f2dbb25a2c7
SSDEEP 6144:7ZLFuAXBoEmA3+eOE4iYceMWDfxA3OnjrYQ9EU0/hEH:1LXeRS+q4EODfxjjs+Cg
TLSH
T1573423E25D24FE314EF8EA98B09F2B48F768AD1A91C64CE6D7942F4D00B55D4211FAB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 0bd12ad2f0284d25c5c513cec14fdae24f4de94495ea0ac552a5942cf6dbe9a9
MD5 da2d118ec713320f077646a4ecc77e6c
SHA1 b9ee96195f98f4e8de0e509f88945922f091c8a5
SHA512 46b9777b6c12508d090b15745c9864795f3908908481340a088f1b20bd70912dd2c279cf56069d671df00f93e568fd3df6f30c950857e13e5f8caf899f991c73
SSDEEP 6144:gZLFuAXBoEmA3+eOE4iYceMWDfxA3OnjrYQ9EU0/hEH:yLXeRS+q4EODfxjjs+Cg
TLSH
T15D3413F25D25FE310EF8EA98B09E2B08EF78AD1795868CD5D7942F4D00B45D8221F6B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 011a7f1b9d78be8368e8d15c4c8b7f7b1d3e83b9a2b511747e728818cdac8528
MD5 d101a8b8a1d7cbd3b2c6e2a8bb561d29
SHA1 66080a0e6dd5a4d9f83b2bb66d1b264d7ebbc36c
SHA512 6850813d6fe1df72ca19255f53ffef8841e152974f60ceae793b7d1b6e251046c1b766ba64687b03e714a0657afba8a3a69e22b3edc398aa0d3e41ff36a7d054
SSDEEP 6144:MZLFuAXBoEmA3+eOE4iYceMWDfxA3OnjrYQ9EU0/hEH:GLXeRS+q4EODfxjjs+Cg
TLSH
T1A13423E25D24FE314EF8EA98B09F2B48F7686D1A91C64CE6D7D42F8D00B55D4211FAB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 36b467380f66b7c5b98d85d10ed5fbfea1b0264b9fd5e0c99829d7ff386fd397
MD5 b43faecc0127e63d4618fe7c5eb4d761
SHA1 2119b1294a20e7b06ae3314af30f8d6c14d2d657
SHA512 2a90b6bd3c2ddad510418ca65a18b8ccac8cc06eaf6d2d7a6104fa57daa5cdac4b1a435b8e50d71dc24ed3ddec5866922d9de932dd554ec7402fb4626c8a52b4
SSDEEP 6144:PZLFuAXBoEmA3+eOE4iYceMWDfxA3OnjrYQ9EU0/hEH:RLXeRS+q4EODfxjjs+Cg
TLSH
T1623413F25D25FE310EF8EA98B09E2B08EF78AD1795868CD5D7942F4D00B45D8221F6B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 9768f007751292be2a18bd95199de6297a2b5fdb05ff80c72970fb192bbbc4bb
MD5 4ff3c9b3a411d3bbff49e291b8e09e52
SHA1 28395a3525629048060fdc06b9f2a10a32e26a29
SHA512 e11f10a1179e80ab40eaef791f8ca950f152475c335e8489dfc63a242655758e796b8aa6e0eba80164d152f4ea0b8a898b54222693754f821ca94cecc57ef6c8
SSDEEP 6144:zZLFuAXBoEmA3+eOE4iYceMWDfxA3OnjrYQ9EU0/hEH:9LXeRS+q4EODfxjjs+Cg
TLSH
T1D43413B25D25FE314EF8EA98B09E2B08FF68AD17D5868CD5D7942F4D00B45D8221F6B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b0adc667b2b9881f921ce2e8b4b11257043a66537833c382bb30ad143d864634
MD5 ea320c23190334bf29dac8ce2c59e14d
SHA1 36accb147945bfe6ac506470d60a9b34c07c7f97
SHA512 100f223ebb1c7273905f0855601e6795e525dd97122f719cbfda0bdafedf41f94a37711e5e52bfcc3184a8cb97070beb57ddd9fe6126377047c38b326a851884
SSDEEP 3072:CzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:YWDfxA3OnjrYQ9EU0/hEV
TLSH
T1DCC302A11C36BD660DF8EE98B44D3A60BFF4AC9A91835DC362ED2F4C14FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwdDefender.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwdDefender.exe.log
Size 642B
SHA256 07cd502f2fffb7c6a891a219527278857fed0061bac452445b945c4753899f2f
MD5 fd08d0d1c404b16d00be959c6656523f
SHA1 d4849d6219a49ab44a105a99d451ded26173470c
SHA512 2f788cb4d91b021966ae25ab68c7a0973cb1e5f53425e6324d5af71d6e0a5fcf8b15da341335acc30740a9aa4a6104502c377da1fad6e81f6460c5fd017329c5
TLSH
T166F0A2313371A0D849563F432D2C179913BF4355A150EE0C7594625DD83681B6F313E3
MD5 SHA1 SHA512 TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 20KB
SHA256 35ba39b01c4d564a467e4571cc5fb2df28313a4a6ee7f2b7399da8e44c33f2cf
MD5 6871532237c898be8a84517c86b94034
SHA1 04d9895a46eedc6817c60f714fdb07b593d57f84
SHA512 fd60fe956d6f0553073d2a9b2d47a5a0a0f099fd35462a079ccad392efd589bc3bba13c87672decab98ae81e0773e2b108e5b4814982756220a21dbc99b04c81
SSDEEP 384:vJWJWLVca12krtuVm+hglBOVjeQ8RJoyrghzjUTMWI5P4Mm5H+GDa50foRcj3DYn:R+WLVcWrWl8RJFrgRjUTMdmzH+GDa50I
TLSH
T1E9A24B743AF51315F3B29F759BF1A95A643AB866AC00DB4D0162028D0977D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 21KB
SHA256 21f357df00afc176bbdc46e253296335e74868299487d6d3174c59df4cc367d9
MD5 2c66e38eb576b015799951658436b013
SHA1 82f54aa58377cd33c8b780872485e9a8a5535c91
SHA512 7d6d7c5730440bce96fb429386b05e42e97b9210384e0da22c2254d39865ccbd117a3933566edb9929f71f4a99785d53ed9fe5a715e38484c73d4945d28933d0
SSDEEP 384:RJWJWLVca12krtuVm+hglBOVjeQ8RJoorghzjUTMWI5P4Mm5H+GDa50foRcj3DYn:P+WLVcWrWl8RJTrgRjUTMdmzH+GDa50I
TLSH
T102A24C743AF51315F3B29F759BF1A95A643AB866AC00DB4D0162028D0977D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RealSetup_7274e9111691ef186411e839887f9d1950fcaec7d88901f7bc1736c8d8836681.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\RealSetup_7274e9111691ef186411e839887f9d1950fcaec7d88901f7bc1736c8d8836681.exe:Zone.Identifier
Size 176B
SHA256 9eeaab96883f52ce8d59f9da56a35f9c391ce7ceb1f0fa7da2b578ab335deed0
MD5 2d63fb3dbf32c6f9faf7f0ecdd72003d
SHA1 9bda4f3bb3077eaf440bcc30780289e25c96dc56
SHA512 d776564caff0a05be19104953cc46765ab521dc371b691fb5f4bbb2dc51efc6b081f41a35321ebbd46ce64c504f3e7b1b8b85f3b795351adc2875639c6ad5a9f
TLSH
T150C08CBF58568C70AB7123E41ABE94ACF00B34224EC79100E81500EBBDA0879E6A620B
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 705564.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 705564.crdownload
Size 17.0MB
SHA256 9714c12fd530c43d6ad3f54d7aecca6a2e50297c4537c034b69c589a810be0e7
MD5 19cfef255fc2834f10e286a912fdd0e9
SHA1 3005400f5edc18745214bb0857208fbdf50fffa4
SHA512 1aaaf7fa19e5157392bd5d224c34da0a466dc6ed7d3fa2fb586fbb3482eb0db6a65e04b9c99a4e1e1cc3ed4b267d88b7585d77dca3478371232758a20f0c544a
SSDEEP 393216:0TEo1mxTfHhGfqhquVJ+1bKx/e74QSQRwcf0JKPasvn4:xBhf0oqO+1bK4tAg0JCf
TLSH
T15E07D05C8575D006003FBE2BEA5DE411016D8BD012B8DB9C59FF623A7A16B4EBAE43D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1232-0-0x0000000000580000-0x0000000000600000-memory.dmp

Download