1bc5307edd98df38a4bf57c76cac67b899643fce672b48e368bbe2482afb718f

Analysis

user interaction
yes
max time kernel
899s
max time network
889s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
111.zip
Size 1.7MB
Sample260903-1mtskafr9s
SHA256 1bc5307edd98df38a4bf57c76cac67b899643fce672b48e368bbe2482afb718f
MD5 8561d3dcab8e1e02905ae5f4a4d53029
SHA1 d64120398f553b5577906db5420ed929eb572e65
SHA512 b81706cb5b4edc49cc194f7d56397e9a6bb3a5dc175aeda31d8aeb6b86db3ecb6a9a2005bd3ad693ad746bbd90cf3fc6dbd1d0609a583608442c6fce70730656
SSDEEP 49152:ARFM3dMT5yU1OkJUiOGAgVI2DtuEcsIoMfRd6Z/:0MtMbfJyGFVfL2oQP6F
TLSH
T1CD853316C7B9F13CCC0B2DFC4696E648B6554F80E2913C7E4AC573582A7ED8663B68C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence ransomware

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
5268	takeown.exe
2308	icacls.exe
1848	takeown.exe
3584	icacls.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RIJPegsYdpDNhbVykKEDlMnF\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\RIJPegsYdpDNhbVykKEDlMnF"	kdmapper.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bsAfdOIUYRzHwSLjmSPl\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\bsAfdOIUYRzHwSLjmSPl"	kdmapper.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5268	takeown.exe
2308	icacls.exe
1848	takeown.exe
3584	icacls.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	mediafire.com
53	mediafire.com

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe
File opened for modification	C:\Windows\system32\clipc.dll	loader_spoofer.exe
File opened for modification	C:\Windows\system32\clipc.dll	loader_spoofer.exe
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
264	cmd.exe
3996	cmd.exe
3432	cmd.exe
4164	cmd.exe
5992	cmd.exe
2948	cmd.exe
4820	cmd.exe
800	cmd.exe
476	cmd.exe
4104	cmd.exe
1920	cmd.exe
4056	cmd.exe
472	cmd.exe
5496	cmd.exe
2236	cmd.exe
4744	cmd.exe
3488	cmd.exe
3348	cmd.exe
5480	cmd.exe
2644	cmd.exe
5220	cmd.exe
5896	cmd.exe
5504	cmd.exe
3196	cmd.exe
6076	cmd.exe
208	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5288	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 17 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber = "SYS-RRYP066NZ9HQ"	loader_spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardSerialNumber	loader_spoofer.exe
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	loader_spoofer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	loader_spoofer.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardSerialNumber = "MB-SC2SID4IWV5TU82"	loader_spoofer.exe
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardSerialNumber	loader_spoofer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	loader_spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	loader_spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	loader_spoofer.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber = "SYS-DW2AD6OSQ80X"	loader_spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardSerialNumber	loader_spoofer.exe
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardSerialNumber	loader_spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	loader_spoofer.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardSerialNumber = "MB-5SSS2J2YFDUXQXC"	loader_spoofer.exe

Kills process with taskkill 24 IoCs

defense_evasion

pid	Process
2624	taskkill.exe
3904	taskkill.exe
4036	taskkill.exe
3280	taskkill.exe
3336	taskkill.exe
4700	taskkill.exe
5340	taskkill.exe
5880	taskkill.exe
928	taskkill.exe
5112	taskkill.exe
4712	taskkill.exe
5916	taskkill.exe
3020	taskkill.exe
2716	taskkill.exe
3916	taskkill.exe
3352	taskkill.exe
3452	taskkill.exe
2128	taskkill.exe
3676	taskkill.exe
1060	taskkill.exe
5456	taskkill.exe
4032	taskkill.exe
4836	taskkill.exe
2764	taskkill.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329456579942736"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
5588	chrome.exe
5588	chrome.exe
1152	kdmapper.exe
1152	kdmapper.exe
5192	kdmapper.exe
5192	kdmapper.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
1152	kdmapper.exe
5192	kdmapper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 42 IoCs

pid	Process
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3360	svchost.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe
Token: SeCreatePagefilePrivilege	2340	chrome.exe
Token: SeShutdownPrivilege	2340	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe
2340	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4608	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 200	2340	chrome.exe	100
PID 2340 wrote to memory of 3672	2340	chrome.exe	101
PID 2340 wrote to memory of 5288	2340	chrome.exe	102
PID 2340 wrote to memory of 3672	2340	chrome.exe	101
PID 2340 wrote to memory of 1336	2340	chrome.exe	104
PID 2340 wrote to memory of 1336	2340	chrome.exe	104
PID 2340 wrote to memory of 2756	2340	chrome.exe	105
PID 2340 wrote to memory of 2756	2340	chrome.exe	105
PID 2340 wrote to memory of 5752	2340	chrome.exe	106
PID 2340 wrote to memory of 5752	2340	chrome.exe	106
PID 2340 wrote to memory of 2364	2340	chrome.exe	107
PID 2340 wrote to memory of 2364	2340	chrome.exe	107
PID 2340 wrote to memory of 2668	2340	chrome.exe	108
PID 2340 wrote to memory of 2668	2340	chrome.exe	108
PID 2340 wrote to memory of 3956	2340	chrome.exe	109
PID 2340 wrote to memory of 2664	2340	chrome.exe	110
PID 2340 wrote to memory of 2664	2340	chrome.exe	110
PID 2340 wrote to memory of 2528	2340	chrome.exe	111
PID 2340 wrote to memory of 2528	2340	chrome.exe	111
PID 2340 wrote to memory of 5308	2340	chrome.exe	112
PID 2340 wrote to memory of 5312	2340	chrome.exe	113
PID 2340 wrote to memory of 5308	2340	chrome.exe	112
PID 2340 wrote to memory of 5312	2340	chrome.exe	113
PID 2340 wrote to memory of 2432	2340	chrome.exe	114
PID 2340 wrote to memory of 2432	2340	chrome.exe	114
PID 2340 wrote to memory of 1212	2340	chrome.exe	115
PID 2340 wrote to memory of 1212	2340	chrome.exe	115
PID 2340 wrote to memory of 3796	2340	chrome.exe	117
PID 2340 wrote to memory of 3792	2340	chrome.exe	116
PID 2340 wrote to memory of 3796	2340	chrome.exe	117
PID 2340 wrote to memory of 3792	2340	chrome.exe	116
PID 2340 wrote to memory of 5884	2340	chrome.exe	118
PID 2340 wrote to memory of 2448	2340	chrome.exe	119
PID 2340 wrote to memory of 5884	2340	chrome.exe	118
PID 2340 wrote to memory of 2448	2340	chrome.exe	119
PID 2340 wrote to memory of 1808	2340	chrome.exe	120
PID 2340 wrote to memory of 1808	2340	chrome.exe	120
PID 2340 wrote to memory of 1340	2340	chrome.exe	121
PID 2340 wrote to memory of 2356	2340	chrome.exe	122
PID 2340 wrote to memory of 1340	2340	chrome.exe	121
PID 2340 wrote to memory of 2356	2340	chrome.exe	122
PID 2340 wrote to memory of 4316	2340	chrome.exe	127
PID 2340 wrote to memory of 5028	2340	chrome.exe	128
PID 2340 wrote to memory of 5468	2340	chrome.exe	129
PID 2340 wrote to memory of 5588	2340	chrome.exe	130
PID 2340 wrote to memory of 2924	2340	chrome.exe	131
PID 2340 wrote to memory of 2924	2340	chrome.exe	131
PID 2340 wrote to memory of 4736	2340	chrome.exe	132
PID 2340 wrote to memory of 4736	2340	chrome.exe	132
PID 2340 wrote to memory of 5884	2340	chrome.exe	133
PID 2340 wrote to memory of 5884	2340	chrome.exe	133
PID 2340 wrote to memory of 4912	2340	chrome.exe	134
PID 2340 wrote to memory of 4912	2340	chrome.exe	134
PID 2340 wrote to memory of 1484	2340	chrome.exe	135
PID 2340 wrote to memory of 1484	2340	chrome.exe	135
PID 2340 wrote to memory of 2848	2340	chrome.exe	136
PID 2340 wrote to memory of 2848	2340	chrome.exe	136
PID 2340 wrote to memory of 3664	2340	chrome.exe	137
PID 2340 wrote to memory of 3664	2340	chrome.exe	137
PID 2340 wrote to memory of 248	2340	chrome.exe	138
PID 2340 wrote to memory of 248	2340	chrome.exe	138
PID 2340 wrote to memory of 3432	2340	chrome.exe	139
PID 2340 wrote to memory of 3432	2340	chrome.exe	139
PID 2340 wrote to memory of 2296	2340	chrome.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\111.zip
1⤵
PID:5324

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4556

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:2220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff82484c728,0x7ff82484c734,0x7ff82484c740
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,13557259982001307931,1060465061575498744,262144 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,7681734213090774634,9000922239949925491,524288 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,8160313881668452472,2665233749556238404,524288 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:13
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,8303576093238410596,12387919791736184658,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,8869944543227859725,15502086113850075547,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4736,i,1779456622242997298,13208765174695776012,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,9797222307502689904,18386504584253993491,524288 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,4916692366200299090,519119505973417917,524288 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5480,i,7212251664212618301,11504102637484181809,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5492,i,5272888113548770827,16119384325277456772,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5836,i,13596780896269098324,3383361186794675770,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,13573980972086511318,888702110016032844,524288 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5484,i,22862541759151407,16931875060860081989,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6312,i,12445400194036535606,3226231440139974334,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6184,i,17366978074913300131,10673198792413622892,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,14775159597225637199,15772214091032534595,524288 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6432,i,4048777305021639840,3171069987257318144,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6280,i,1075314282168124588,11318187777128664104,524288 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5664,i,13887113278450402803,1031932779930114376,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5996,i,3404802548818322064,6555037768699903229,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:9
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6644,i,3881958800483124384,14821973671001321214,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6532,i,12795124111406120829,17630532552072460740,524288 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,12236812673618304519,3657054052486541114,524288 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6304,i,1866741882503463111,9163141263042252252,524288 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5776,i,18090801935687800874,17717190086408464141,262144 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4864,i,7977989533455276955,12030518574360341590,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6044,i,50629929562591631,12724741603416287940,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3616,i,205240409554852263,5092493935841416617,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=4472,i,711314129838072388,596877798079647606,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3708,i,10770552662784566910,14825034010408836986,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3508,i,8848938589672769998,9620127720123978324,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6736,i,9301672674018103072,14926097393598551655,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5544,i,6475251394385006650,1807168119138897612,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6004,i,580121710399963057,13646257811734704362,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5628,i,6902919508037521713,18252040345636736165,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5696,i,1120118105119992815,17584421599636788187,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7264,i,17488567719986682621,17628855767426810883,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7448,i,17141847796132728462,3344793815323922714,524288 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7648,i,3254779094589514949,17526603047374579325,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=4480,i,12884037801558983279,7232480181051460606,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7688,i,16929991702045063946,1443567572485250944,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=7412,i,9997000615802952650,743940039012076751,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6924,i,11897077479180007855,13570208866535433963,524288 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=5476,i,6705178896238702575,9813120723520900624,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=5684,i,8719270958682386123,15979068996634909547,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=5568,i,4805985943455234744,10161269132037198860,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=5692,i,6511316125459273072,16191811113749148745,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6760,i,1202483890568879845,11100669480155137024,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=6768,i,16909701303973923054,16962740923595303719,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7196,i,2222168468192726442,11246362751485335864,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7428,i,3947776242932865386,12520794554546603839,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=6668,i,15530159406898853898,11963978636556116537,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=3532,i,10392345106643965626,13990360131329631122,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=6196,i,989286605987066982,16269665228818437779,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=1588,i,3403062579735269073,17548587016538117043,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=1592 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=1572,i,10049054136272246592,8766858947628251410,2097152 --field-trial-handle=1908,i,10605198295655646278,12278883613316364944,262144 --variations-seed-version --mojo-platform-channel-handle=1584 /prefetch:1
  2⤵
  PID:716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5276

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5896

C:\Users\Admin\Desktop\111\loader_spoofer.exe
"C:\Users\Admin\Desktop\111\loader_spoofer.exe"
1⤵
- Drops file in System32 directory
- Enumerates system info in registry
PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM "FiveM.exe" /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3432
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "FiveM.exe" /T
    3⤵
    - Kills process with taskkill
    PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM "FiveM_GTAProcess.exe" /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5496
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "FiveM_GTAProcess.exe" /T
    3⤵
    - Kills process with taskkill
    PID:3336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM "GTA5.exe" /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2236
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "GTA5.exe" /T
    3⤵
    - Kills process with taskkill
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM "GTAV.exe" /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4164
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "GTAV.exe" /T
    3⤵
    - Kills process with taskkill
    PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM "RockstarGamesLauncher.exe" /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5992
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "RockstarGamesLauncher.exe" /T
    3⤵
    - Kills process with taskkill
    PID:5916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM "Launcher.exe" /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4744
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "Launcher.exe" /T
    3⤵
    - Kills process with taskkill
    PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM "RockstarService.exe" /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3488
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "RockstarService.exe" /T
    3⤵
    - Kills process with taskkill
    PID:5340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM "SocialClubHelper.exe" /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2948
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "SocialClubHelper.exe" /T
    3⤵
    - Kills process with taskkill
    PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM "CitizenFX.exe" /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3348
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "CitizenFX.exe" /T
    3⤵
    - Kills process with taskkill
    PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM "subprocess.exe" /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5480
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "subprocess.exe" /T
    3⤵
    - Kills process with taskkill
    PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM "RGSPCLauncher.exe" /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2644
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "RGSPCLauncher.exe" /T
    3⤵
    - Kills process with taskkill
    PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM "PlayGTAV.exe" /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5220
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "PlayGTAV.exe" /T
    3⤵
    - Kills process with taskkill
    PID:928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\Windows\system32\clipc.dll" /a >nul 2>&1
  2⤵
  PID:5512
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\system32\clipc.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Windows\system32\clipc.dll" /grant Administrators:F /c >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5896
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\system32\clipc.dll" /grant Administrators:F /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2308
- C:\Users\Admin\Desktop\111\kdmapper.exe
  "C:\Users\Admin\Desktop\111\kdmapper.exe" "C:\Users\Admin\Desktop\111\spoofer.sys"
  2⤵
  - Sets service image path in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  PID:1152

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5816
- C:\Users\Admin\Desktop\111\loader_spoofer.exe
  loader_spoofer.exe
  2⤵
  - Drops file in System32 directory
  - Enumerates system info in registry
  PID:5920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM "FiveM.exe" /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4820
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "FiveM.exe" /T
      4⤵
      Kills process with taskkill
      PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM "FiveM_GTAProcess.exe" /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:800
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "FiveM_GTAProcess.exe" /T
      4⤵
      Kills process with taskkill
      PID:3676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM "GTA5.exe" /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5504
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "GTA5.exe" /T
      4⤵
      Kills process with taskkill
      PID:3916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM "GTAV.exe" /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3196
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "GTAV.exe" /T
      4⤵
      Kills process with taskkill
      PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM "RockstarGamesLauncher.exe" /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:476
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "RockstarGamesLauncher.exe" /T
      4⤵
      Kills process with taskkill
      PID:3904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM "Launcher.exe" /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6076
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "Launcher.exe" /T
      4⤵
      Kills process with taskkill
      PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM "RockstarService.exe" /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4104
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "RockstarService.exe" /T
      4⤵
      Kills process with taskkill
      PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM "SocialClubHelper.exe" /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:208
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "SocialClubHelper.exe" /T
      4⤵
      Kills process with taskkill
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM "CitizenFX.exe" /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1920
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "CitizenFX.exe" /T
      4⤵
      Kills process with taskkill
      PID:5456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM "subprocess.exe" /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:264
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "subprocess.exe" /T
      4⤵
      Kills process with taskkill
      PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM "RGSPCLauncher.exe" /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4056
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "RGSPCLauncher.exe" /T
      4⤵
      Kills process with taskkill
      PID:4032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /F /IM "PlayGTAV.exe" /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3996
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM "PlayGTAV.exe" /T
      4⤵
      Kills process with taskkill
      PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c takeown /f "C:\Windows\system32\clipc.dll" /a >nul 2>&1
    3⤵
    PID:4836
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\clipc.dll" /a
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c icacls "C:\Windows\system32\clipc.dll" /grant Administrators:F /c >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:472
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\clipc.dll" /grant Administrators:F /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3584
- - C:\Users\Admin\Desktop\111\kdmapper.exe
    "C:\Users\Admin\Desktop\111\kdmapper.exe" "C:\Users\Admin\Desktop\111\spoofer.sys"
    3⤵
    - Sets service image path in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: LoadsDriver
    PID:5192

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f96467cc76ded029506471a02f78cafe26b8a65a799a3914265b1f5c0497b5a2
MD5 eb46038d9fb86bd59ec05f0963f3d282
SHA1 36938b8681fbe531eecdf9587e3fc1d6ea1fd1a6
SHA512 27c25b50ef70fb6c8461e8895a524b826a19c3360678625cdae215e26650d4d1d83e65e39b26ce59818711ccd12c318fb91c7ad39525809491ddf04982641c99
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034
Size 59KB
SHA256 2de4c9ca8552bd3810eaf45f2553ca03b23b6931059f2b6fccf5ca82e15d926b
MD5 9c61479df2088f2e6242fca45e3d2156
SHA1 b4bfbf32fb3f77268c13019eee11fa99c81478ec
SHA512 63e8ad42e77327c6a343890b18ea08f1d4f302f50ba23d4a8fd150d3efba7e5548389fc59fd6ed41d0198581bd50fa3d33853296d418903c94f2edf1c96db8d1
SSDEEP 1536:PK0h2R/YbjP4Wbl1tf2NbowiEeeCRfKWvNkT/17k1EHY:C8f42wkvKWvNkT61E4
TLSH
T1FA5301CC3A92654528687AE5251554CFA7A707E7A2770E403BAFBDF10C7E16873EC20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036
Size 73KB
SHA256 f3d2fda12260ccf193da50e70fe5efb8b89d3c5d4e246eaa053f2cbf4fb07ca4
MD5 345c1023e3d262fb90bd367013335e0f
SHA1 30fd5c4da80ace38caa4fc0da1c950b6ea210787
SHA512 9ae18642326e9e10579bf7b137e14cf5da51953fd2884db14dc6050c4734ec9ad58f7afa35e1d9ee2d0672827845fba2a076bf25069ad40a31de93179c76c842
SSDEEP 1536:gJJpWKEN0+OUU0C2XYIyfDqHbs9hB09CfZlKMVOSUFV+qnCQalSYnUxMv:cjW1b1U09DGyQPKzSUFVXCQalSYntv
TLSH
T1D87312C66BCE83A9791BCF3D0D254488AB74C4F0329AEFC3957AA08D7515134B1C63A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003c
Size 60KB
SHA256 61c412fbdbbf1417355373a80125c8cf7e5cbaab4218bae0316fe6ef917bf798
MD5 1033a47731e45f7bd46a1962359e96b4
SHA1 ac6abef8d1819a685db48a9515f77a24a153e2a0
SHA512 84ca95f89e0a16efd962b44bd3f7ffe09b328f33c068acd8a1fefd08101d824929e8b9eeccb0786483aa2fd2c60bd0b76fc2242479268d69faab72c48902e34b
SSDEEP 1536:D0bcbU0BkgaaHDF868T5Io63Udr9xCHGD1AMYN4+:gbcbUq5a4x8VV63ErD1g
TLSH
T1DC5302F28B610140E55B9B74EB449D3CB59806124AF275CEA30BEABEEA1DCD0F0D5D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003d
Size 60KB
SHA256 02f1dcc0c722e24cba9be4b720831a79489e766d5edf8b77f582e0869312d86e
MD5 ede84d96808c486e3de74cbd8f2a2c80
SHA1 bae3ce34f928be471ee489bbfe5b7425aee8298e
SHA512 996d7258dd45f8676916f05138e7f3141abd7c0207ae43ca820a10211bd237c6bdac0209967b45c4a1d27c08dbaad2f933d16d0400b0710981804e651d4b804b
SSDEEP 1536:k6Fj5vgPSsqNzcvwFQsQK+CKxd+Vs6lj9BsA:zl5vAqEVXKexB6tPsA
TLSH
T11A530299F9870437E49641B30E7FA4C64DFE3BD4AC7E4CA88259593852E263BB1401EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000043
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 d3ec0064a8b4b1fdf5a39a29353a456edd2071801d5714e80017e0063b3ceb03
MD5 ae02606a06511fadc7c6eb680d25a7db
SHA1 2085cccf3fd65127c5d24d0a995e3b6a227eee7c
SHA512 3d1c4d692e441da3188d7e937e1e9595c15b8ed71ec359b01365c3f215d9d9ef12d6de4ac64276d291fd845adf31f824761a762d78e7644c71ee542a505db9a8
TLSH
T177511E969DC43019EB5C053778E10EC7B1B85497913FAF064AF5CEF42A7AB891134CBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4129ec7d7841da443f8ca67bf7e8f13df2e4cc9e051bc90cc1ea586e57f03b04
MD5 3a10d28ebcea14df47af465983976868
SHA1 543441107e5ce39f3f92d12f1bd19220fe0e2a4c
SHA512 2700e151fb58e4caaefdf302bc430c40e9eedc0a5058cb742da5670ddb94dd7a8d9323fb8559d880bcab534da0bbd9fb960fe457232cada4fb684023d6d38c25
TLSH
T1E55130928DC43019EB5C063675E14EC3B1781497913FAF064AF5CAF51A7AB881134CBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2b9c1ab256d8e4b325c86ddbcce056ef5cb5676b17ed3a476b2afda6d282f94b
MD5 cf43fa81dd1d19e828976cf5c61150ed
SHA1 47051fe17e11a0a5e509a4ab6fef66b01afc9cd0
SHA512 a7f028303f84d313f6baa3af5a3a970b219b9ceb9d8114a155a77be27c71bbfbe886aafdd8d28beaa209c9ffd2542c19a5d32669c54bb6919c6d9c9c9b4cc42e
TLSH
T16451EC969DC83019EF4C053678E10EC7B1B850A6A13FAF1B46F1CAF4267EB945034CBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6db08faa26c49e4d7479e75f8d94040580a1c378caec8af089f85384502cac4d
MD5 df59523ff3fed8116ae3c5e9529b33eb
SHA1 991f2da4d6353b867fa4b1d8abeb6d8fb75fb5e8
SHA512 9fa7fa7f7931f75a77386a81d35a352cf58f4cb4fe0174c525db2668e918f9b1f0e7a4ded7fa23a5649e7d33e4b72be5ee1b779e2d6fed0c4500795f63560381
TLSH
T18351EC969DC43009EB5C053678E10EC7B1B85097913FAF164AF5CAF52A7EB885034CBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ea3baf5b0ba2df7104c2e724ed54902a7b95b34775fa7346af5d84ce757e1c49
MD5 859201b1b7dbea4e69fb5e43c44db939
SHA1 361a9a3cd183e20c6dc8995556b3043269a8aae4
SHA512 d885e2ac0cbbb886d61732310f2d567e9cca4ca18bbefd71d186c7561cbe5c59dc8ab13ee3efc015cdac1bee6bc3f7ddf9ae6e61286175630c851ca43e5a07c1
TLSH
T16951FE969DC4301DEB4C053678E10EC7B5B85497913FAF1B4AF5CAF46A7AB881034CBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 de50eef7bf82005c5a38a856e77960efec915c770ee878dc5da0403f5f0b6b1a
MD5 92b890294ce2393a2b103bf1a6710bd8
SHA1 f1557fbb5d5e0d589e2e89a5f9a906711c98be98
SHA512 81e3b58f4f4eef5adebc83ca93a9e5e08ba62ad8a71a63b7220a101b7136d3f8259d8fcb93e640d467696a33f0fc3e2ebfbff11cd2c6b9b6fcf3f788703b4ca1
TLSH
T1865120969DC43019EF4C053678E10EC3B1B850A6913FAF0746F1CAF4267EB841034CBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 66c80cdb63bdb96a05f021ee2647b06c44d1f0d5bdd1ac1494d146c5377eec17
MD5 55d114bf939ca5a3544f0e59376e6972
SHA1 eec36c74d927e4d59007c38e32efef3bb0fca617
SHA512 a296f4c212984e96564743f9cc36a103f140524b9c264450f24accc9a8cda2580db161284e93d29b4ff72a3eb3a77e44af039230ab53c85a7df89ead02d282c2
TLSH
T188510F969DC43009EF4C053678E10DC7B1B85097913FAF164AF5CAF52A7AB881034CBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4fcd6e1d272de165e04324a6916e4c8c5642238b2a7a800f6b00f24aa6aade4c
MD5 05386694a97bcd2f60eda304862613a6
SHA1 b342a3b0d57704829103ab10016714cb63e5a128
SHA512 fcfa54450d221c8e84527f7184b33bfe868d8bfbee2966304cb529543beaebc07b82201b75c0cd614587786a6e895298b035f0f08fab663144bade06c6a630cc
TLSH
T1C7512D969DC4301DEB5C053678E10EC7B1B85097923FAF064AF5CAF42A7AB891134CBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0e1b5429ddacef8bfeabc29bbb44b7559608e5c5fec81c0065c189b6d9c4ae85
MD5 7fef571b1756966f8c13ee0d9b847277
SHA1 23836035124b84ebacf92d2ad00e8c725da78ffe
SHA512 24f2a857fba7c6f3b56f511e5edd3df5aeaf33e34cd4a70842ce3c2633faa97fd16449af62a8df8609dce5e208b5389e3dceb5ae8455d1f594c7320cdcf3ef21
TLSH
T13C5120969DC43019EB5C053675E10EC3B1785497913FAF074AF5CAF42A7AB891034CBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 72c943f3891f8778d6271821ee4bb67a5fddeaf9432aee3c52bf34c1aa0798f1
MD5 63455fc0b71341b51e62c4ae2063de39
SHA1 bcecd5e08cd34bbfa39cb99b4ae3ada7adbef960
SHA512 3bac52d22863f69a8c97eb95863b69b7e814d961e1c3bfa5a7dd07b6f263944d40a6b31845d6e35749d86f3689d970f26c7a825697bc63e04269b7017ac522e7
TLSH
T171514E929DC43019EB5C023679E10EC3B1B85497913FAF074AF5CAF42A7AB881034CBA
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0703c09fb397ced1b2e1e74c0601f2a875fe3abb493fe8f9a388b6cf9b718bf5
MD5 cf6a7865837966c995018f41524a8a00
SHA1 4bb0c9d8e467e0d41853a88bbcef2ed298b3c909
SHA512 88dc3df0303dd6fc0457be560d32d4f9000b90ed85e928ad300cb96eacf6b80ab57c54ba51b75b66cd6d321e6f908e151d12ebf6e33ae5b111c5a04cb3198583
TLSH
T1D75169F7D3E48A6D851196F49A217E1FCD2E0A14121C3C66C8D8EE5B57E2873E21178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 35KB
SHA256 ff480d9dab9d6769b1a016094660f40f88bb63a91ab63ab6a67ff4acdbcb134b
MD5 496338d8ecee996cfd3302e2199451b6
SHA1 6ae67bc64ce1731a2dcfb89e32cf0ceef8f8f04e
SHA512 065353c52afa827508ac014674464ec450112274ef57411d0a3ee11c9c2853d69a46b078ba346679f2abf1a5f3bebbcf713f340a7630e40135b6a759c9822df0
SSDEEP 384:DEu4dtJgxEbkreh6egUXWJE2GKukJKKJZ72GeUMBeccG7l5vdIENKXAK/4QyYmrp:bFUtAv/sEyg1SsT8qbJ8G5A
TLSH
T116F298F383E5D96E89115BF85A106E1BCF1D1619432C3C2688D5EE87E3E2433E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 35KB
SHA256 e768fc1fe8e17267c30ae01f132b3f1b39c548911b9e4f569e1807be59970d98
MD5 c1f239c6108f8ee184b8131a33d4b9c9
SHA1 6092f6b28f76199b6cdbbe38c57c301d9ff8bdfa
SHA512 652672cc6df953477df760393e60a4ac674c9b6b044ff98caf2dab68ec0df210b7e4ebcb8f6ad764a3c356bd6d79794cc09414caee1251b6b4aaa7b6974ccdb7
SSDEEP 384:D0umdZl0Wt+l4eQOJmRw8RJhJYbXe+KVTnXt/J7LjWo7eOeE8O7T5BeBIENKEdKX:eTrmA1sEVg1hsVRFXaGTHX
TLSH
T1EDF2CBF793A1D96E8A115BF89A14AE1BCF1C0715432C3C2589D5EE47E3A2033E16E64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 34KB
SHA256 1bac5a743b63a44f7d64ba33c256894fbd69e5da80ca711ab647701d45df5914
MD5 0af74ee7f8f35da2ddd6c8e3e86f368a
SHA1 03013b67a1fef902e7dece4821052be846d738f2
SHA512 d8c75390e438a183eb89daa7eed35e09172fbdf8bb79f1ff518ab7553e218b3912c3f6fbd63851382276dfa8eb04058c4fabc1478ae055010d04a954fa2a273a
SSDEEP 384:D0udZl0Wt+l4eQOJmRw8RJhJYbXe+KVTnXt/J7Lho7ebeE8O7T5Be5EIIENKEdKf:7T34A1sEVg1hsVRFXaGROQ
TLSH
T1FAF2CBF393A1D96E8A115BF85A10AE1BCF1C1716432C3C2589D5EE47E3A2033E16E64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 38KB
SHA256 7ad1fe8f6a9cb433cf21a84445289435b77ecae18d89799a208824058aa7f60a
MD5 59886b1323dea7909451634b555a6f19
SHA1 73430a564d5f90055bfd3b39777f72a094b8b4e0
SHA512 dc56f7c287bafa23f2e8d483b95e2ad49e65f95307f02f1d109af3a62e6f0161eaad621c77572407c06721ad037c14b49b93d11e9d70cd6b1f3cd9c9da58fe8c
SSDEEP 384:D0umdtJgxEbkreh6egUXWJE2GKukJKKJZ72GeUMBeccG7l5vF/YHM3IENKEdK/4c:FFUlAv/sEyg1SsT8qbJ8G2+
TLSH
T18903A8F383E5D96E89111BF85A146E1BCE1D1719432C3C2689D5EE87E3E2033E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 35KB
SHA256 e7efe0e6bc0c1af8136383d275a4ec0061a134400462fa57ff13f2fe4a2a67e3
MD5 2f653c6ddc969d17a745ee21d048ec69
SHA1 247544bf2fea17ab19dcb019e0724649b0fdaf53
SHA512 431817439682a7944ba44f2d1ba3f0f69da278622d86caf713fe098148b3c6dac78cbcfaffaedd67316ed70fd83e48b082d970b198fba8c6648824b922ce1d27
SSDEEP 384:D0umdZl0Wt+l4eTQOJmRwY8RJhJYbzXebmBe+KHVTnXt/J7MjWo7eOewIENKEdK5:FT0pA1sEVg1hsVRFXaGTHB
TLSH
T18AF2BAF393A1D96E8A115BF89A14AE1BCF1C1715432C3C2589D5EE47E3A2033E16E64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 70a6d931f6c8694d1a52743d332f8cc6734bffbbde34c684c2c0acb35aef6d7e
MD5 b669f29bf3201747f940cce392e1da10
SHA1 8c99b4658c96d1b738dbc10ed80c7a4d32e43b6c
SHA512 f2e12d3a752e8d19bb7d81700a718e1752851b1ba7185f434380dc62c210ac6996724512b02234ab736c818d8ef9a8b4fb9da2b6dfda6f5cd427f3df681ac262
SSDEEP 96:UUcvsbUOAU8kUPUUGIdUZeieUHsUJeUsfUtqUqUPUgUfUjUkFNUyU6UQAUVU7vUp:UU4sbUOAU8kUPUUGIdUMUHsUgUsfUtq+
TLSH
T115C1CFA3C6BEBC5B21795CBF1E4878056D7BB8311342A8F4DA5BC26CB0858F71B02067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 677f1c089074a2bc8867e09946ff62c69fcb82678267174b6414d8aac9d32e3f
MD5 c7055e4e27692ca496b64c8fb9b5e31a
SHA1 9952e15fa97c81ec4a83327efbfdc0f1c7dfca93
SHA512 946b79df3b247277d315f51e6e6ec86a5e3ab72238bc149dacbd7196d07d55bb75d6a5b96876918a23f8f1225f32055d4bd80142d8a6fccb53c4bca2079d88c4
SSDEEP 192:4RIjAETfv7QPPRp7s9EHsb+WNnqI0q1nq85kw8a1VyIsnAUgE:4RIjVT3kXwmwd0qgycajE
TLSH
T1D642B52ABC14793B5CCED669FA55BB93D3F5102121942E44EBFC8A2C25E75CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b6981ff5b7fadc67965dd9300c459cb9ce4e18ec4b3369fe6f9bc394c09dd2f7
MD5 8c68674e06dfe3703889ea093d48059b
SHA1 d95d11b8c82610eae626bee6eb026d9eb6ce269c
SHA512 ced41eb8c4f9291702e6d96f1dbd7221b42fb3201902828233642b9482c8edf04c0f0a6bd684ef0183083f5463c2d1f5f6a69bac32a850cafdabbf5b4c47209c
SSDEEP 192:4RIjAEaZv7cAPRp2s9EHsb+WNnqI0q/nq85kw8anVyIsnAUge:4RIjVa5JX7mwd0qCycaBe
TLSH
T18C32B62EBD14793B5CCED62AFA65B793D3F5102121942E84EBFC892C20E75CC221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d50a61f2264091025b2a4971b7c2d1e9de67c9efc45dc87b68e704d6df57ea3b
MD5 4e4d4805780988bba220d2d0b6ddd5ad
SHA1 746666815d110d485b260ab55eb605d4aa9b92e7
SHA512 5ebbf3764ee310715417b9f7ee0c93478ad620a02cf4aa1c0c9a135b286651b934d47cc7924c09d698ea4d362ba73180575573f27215d74f026ca88da4237259
SSDEEP 192:4RIjAEVfv7QPPRp7s9EHsb+WNnqI0q1nq85kw8a1VyIsnAUgE:4RIjVV3kXwmwd0qgycajE
TLSH
T10842C52EBC14793B5CCED66AFA55BB93D3F5102121942E44EBFC8A2C25E75CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0d5ab1be391a002ed9a70d47b11eeb7956f2adda7c2d37243b7d0f70371e58d7
MD5 62c1c4a1d68bc30f513e5eb42dfe4f56
SHA1 51cec6dfc36e6b1d779cd1589620270174ecacc7
SHA512 c096004ac7a96c5102192456670bb0d8da0b6a8dc7af92cf1a77684337618ad00a40d5a618ee5e9d1f5c350bc2b9ef4c65b460f2b7228e636f667071b2bb5771
SSDEEP 192:4RIjAEaphv7cPPRp7s9EHsb+WNnqI0q1nq85kw8a1VyIsnAUgE:4RIjVapxgXwmwd0qgycajE
TLSH
T15F42B52ABC14793B5CCED669FA55B793D3F5102121942E44EBFC892C21E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7840084a81a817c3b8a37692ed591a7f1a9286834fad7e8e9965be3060121536
MD5 a74c665edd6d75fc2cd483ca4cd7fa7c
SHA1 0bc6fda6d7bb9b25ae0ad562f9eb5e797320ce27
SHA512 04901d130729a305c837d8ee63a668d83203bd773940f2a8cca3c366a83dc8b303f40c1935f52e6ede1f22e157384c00d6a6e0ce0569e2823faaa637c0864338
SSDEEP 192:4RIjAEHsv7QPPRp7s9EHsb+WNnqI0q1nq85kw8a1VyIsnAUgE:4RIjVH4kXwmwd0qgycajE
TLSH
T14D42C52ABC14793B5CCED629FA55BB93D3F5102121942E44EBFC8A2C25E75CD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 807c40e6e5482b1e71a34f698b02e1f7e6eeede43c1b7e7efac9687f9b98d6de
MD5 035f2c2642597441bf1e4f24116fa9ff
SHA1 6ef5ea050576875cb93793f0aab6dff5d798a1a9
SHA512 67269518d1b3571f8063dc73817e6372ccb7c9241bc9ef5605197b01a387bf7b0961262068454cd995cf0edc047bef1f978502da25183682c3415ed7b7cc63c5
SSDEEP 192:4RYjAEoev7QPPRp7MFE39EHsb+WNnqIjDh2q8nq85kw8a1VyIsnAUgE:4RYjVoakXfmwdh2qFycajE
TLSH
T17C52C62ABC143D3B5DCED66AFA12B793D3F5102561942E84EBFC892C20E75CD221B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9778167f2132d99c41545622b89ae3db3d345c8bdbebdf6ca3c665acf085676e
MD5 1efd6184a987e6451b156f511f0ac289
SHA1 bfed4fc324133445b6656280dafde3a0493375f9
SHA512 918cf48c99743c943717ecf5046809e3454491766c2f040a03206cfe59acc249c9ed8c2c829a3553e9b20fba63731c391e9929d5331a7c1957b4af03b412fa8f
SSDEEP 192:4RYrAEoev7QPPRp7MFEoya9EHsb+WNKgmVqIjDh2q8nq85kw8a1VyIsnAUgE:4RYrVoakXSmw4h2qFycajE
TLSH
T12C52D82AB8142D3B5DCFD66AFA11B797D3F5502561D42E44EBFC892C20EB6CD221B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 04ca6c54fb46e6014dd2ccd827a7b9b19e69d6544d7c7c45a1b80b44ae584ab3
MD5 d9a210955db973951b21cbe5b306ca69
SHA1 f1a44ea101cb56d20a36ca3ec141ee98dfd0bee9
SHA512 e4327ea6d863360f0d04763fed99fecd09411c2af892ce26247747db8eaa557e622fb926cd98635cd2b8ee6d371cd72f386e203faa7b3bd92d801804a76d1494
SSDEEP 192:4RYrLEoev7QPPRp7MFEoya9EHsb+WNKgmVqIjDh2q8nq85kw8a1VyIsnAUgE:4RYrAoakXSmw4h2qFycajE
TLSH
T11E52E82AB8142D3B5DCFD66AFA11B797D3F5502561D42E44EBFC892C20EB6CD221B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1123c81b7b7fb4d53115623ccadab0deb1eb72b22362b25abf67fa1ade515973
MD5 4407d860835eb9b38405abca366c237f
SHA1 e3fa344b7b2a336cdd8b34d9a911cff9b92dda8a
SHA512 c15bad3dbdf172c3c6cf5997175f3b48d09bf83ddcfa606f3d280abc323a924132d3973260dcf56caf77a0e37e01f732dc3b04233ee7406e02f9c62a90e817f4
SSDEEP 192:4RIjAEaphv7cAPRp2s9EHsb+WNnqI0qunq85kw8aHVyIsnAUgE:4RIjVapxJX7mwd0qfycahE
TLSH
T11A42B52EBD14793B6DCED62AFA55B793D3F5102121942E44EBFC892C21E75CC221B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ee1338ec36c4ff6a3c49618393dafcfa2b412a2e5ae5e5985332c2aa8bde941f
MD5 60bdf42ee979cb64104c88ed7e49b831
SHA1 43b4e72a4736c908e1ca733bf01a6b5ce6f0ca05
SHA512 6f9324211be5f0984bc49536e7622693bc98a822f41cb06ce1b92f398a0b7191064f69b5c694bfe50dbc5d0a07ea657e4e5fdfb18bf866869b8a2abca130cbe8
SSDEEP 192:4RIjAEQgv7QPPRp7s9EHsb+WNnqI0q1nq85kw8a1VyIsnAUgE:4RIjVQ8kXwmwd0qgycajE
TLSH
T1A242B52ABC14393B5CCED669FA55BB93D3F5102121942E44EBFC8A2C21E75CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 4a805f6d0dc8023426333df00f9811f2c6e616d1fed56ad750a49d0c52c08a0c
MD5 a5e6b04902b5ba4091da1d90c996c950
SHA1 1e2e39e3142c1602af9e6dc17d744fcd2724c872
SHA512 3ed507e4ecea47567866b8f6d7d09ced0ac28526dce9d0eab8b56d0dae15bd05c4990f166376ab311f0c0da28a86fa25e871341ff1fbe890354d99c71899fb88
SSDEEP 384:WQjZ07KxkXqKf/pUZNCgVLH2HfgsljhRXODZ8+ErU3+AHG3pGYqI:WUZ07KxkXqKf/pUZNCgVLH2HfgsH1O1Y
TLSH
T19652F967684D9A3B0FD8C94DDC12AF8FACF50256A6A8082497FA5C0803997CB114B1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9e926bbddcf8314_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\e9e926bbddcf8314_0
Size 63KB
SHA256 246f6ed06a5ccfe4cae8f1aa1a53ed15cb56f24940e01f97072ff2a5455abbd5
MD5 d68304195b07376b7d922c8c0cb5fe15
SHA1 63cdb47222618aa34decfd4279da04457ac8af08
SHA512 ca0bceac498a9b5692f1fbd41ead3c642e3ab2eff72fb01115d15bc0fb18c313857e63acf5adcc89e7252fc1b24681437ad01fd0d3ade8b265855736471fb6af
SSDEEP 1536:fmy3ZRmiHxSuQXhviJCQiyBi73bNiRr8QJ43PnVY3ihA86:fmy3yi/mhYici73RidP4vi7
TLSH
T1F0535B963371B4B3837BA1F1906F1307713AE5A7F40884E4B198EDF15E54A96026BFAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 bf5f2b78ae8b8d14f68b203bbae98b79ccc8c83f6fbcb75ca42ea768ebe61242
MD5 79c911324cb9fc87ec8f95de4599c882
SHA1 9e788e91f5467bc1dbd36c6ffec22229091242cf
SHA512 cdf7e13657df52d8c0bbc90a81cd9d4084769640c3f3981aa16550e2d20e30d647c414b813f6c462ffcea7d956b2a890a300ac5b16ab9df944b72184bd2ce440
TLSH
T117A0021143400115C9C057B5118103803374CDD6462913E3C2F580F48CB5954B911410
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 64e546a530d7ca6e9a0d0781446da0ebe27a285d2217abe0ab3c59e13922e6ce
MD5 c0f6d20871c48eef902c09ff1d9bbfb7
SHA1 d29478b4e58cd3637b77102bc063f676c123298f
SHA512 1524117812018cabbcf4ac5d7c13fe79555289b892c3adc52e44a874224b807ded6d3afcdef0d2b4e9972872909127c435115a6e25d5c821ca01c3d0616d67b0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 3eaf53e8514e908b4350373dc093fe501993b09ea84efad78d06b86cbcb506f9
MD5 bac163cbe7567bbdecf5c1f4c8723063
SHA1 a63ab79d1483381c3dbe2206185d32b0de8a19e1
SHA512 793ef1337ae9e7eab6fa024d687378cc0daab58816418a41be5c3b0af2015ca5f6ea418996fd5944b6c87a27ba32e80826666679da413fd9e28adc1c306c40b2
TLSH
T1FEA002504EC01911ED94427061A50B9122A28D192976730B56E5CC48896F1C08512168
MD5 SHA1 SHA512 TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 ea51e5c7c6d766b7e22bd3a425b9e21213097522b2bbfc2586dd1c5a6c16abae
MD5 567bbe726d1f50010dc5009802d15294
SHA1 810c5a4928b92aadc8d0ff9112ea1adbdf1fe940
SHA512 d8ff979748bb1f4627a109a8eaa6fcfc3e99b10efdadbf089cdaff77e59bc1527594407eeaec861e94eac977629f347552a9ca413625abe5bb2db5109523ad51
SSDEEP 3072:5XguczvjfetUdJx6TzNn1xRKaVoNOVoZ19sZ:5QPzvrwMSzNn1xgolq1SZ
TLSH
T118D3127A59B98C3FCA258DC8853A2F4D1D5360E18983CED01BC7A35C56BCDD62737168
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 7584a028226bc4ca52a911d22cfc2cfb3d17c1116ea672d7238a309edbc9a85f
MD5 e98dae9b83ea2bccedeb453e6dd7d199
SHA1 b54ede6440cd5c0a18dd7f7defbb62e1e008e15f
SHA512 114c6ffe84b04de1f9a9cf65a1ec1790bf600b14a3c1761d0af7ffd5f7db98e9c5953797d927ffd42994bb3653c8daa69abc50871710708110a025e8ccc9b471
SSDEEP 3072:bXguczvjfetUdJx6TzNn1xRKaVoNOVoZ19sZ:bQPzvrwMSzNn1xgolq1SZ
TLSH
T1DBD3127A19B9587FCA319CC8843A2F4D1C57A0D78E43CED01EC7A348167CDDA2B27468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7f67eb5e6551ae9f43294bcd54643c7de0f2ee917e217d3af840493a74de3313
MD5 7b307198f24a55430d2005ac4b5b528d
SHA1 200db1d39a641f8be26d6ccee1657d14d324ae89
SHA512 0db28993882732302d1b704030c0df54a474385201c84c8ae2a99ac33607ec5f765b509c563d057c32c68c71a37ac43826cc2ca10a46e703db52b33c90fa0490
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5ilD+dIB60GyvnnXrlbKmb0v4a:xC0PtbKFKu00UUSb/iDUDC+d8ECXrlba
TLSH
T191A12B72B8698D73597AD549FD622A03CF74E12B9D229F54D9DD0F0C10FB1D80342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 4195ee13400b44613438126d7c32b59bd754af7c26589e4b2d3fa8f8900ae53f
MD5 12db6f9e313dc85a96ee0bf86b7f0511
SHA1 1afc5bd2fc774e226622fdf94fa44e78acc0573d
SHA512 8d7631bac9b9caa105be2a4406b608aad5f1a303039b31ac6f44a17bd716f15389d2a4197458ef90ac42e1a81c55ff8fb082417a03087ebb4e5b4280938f8b3c
SSDEEP 3072:/XguczvjfetUdJx6TzNn1xRKaVoNOVoZ19sZ:/QPzvrwMSzNn1xgolq1SZ
TLSH
T143D3127A19B9587FCA319CC8853A2F4D1C57A0D78E43CED01EC7A348167CDCA2B27468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 caed606e9a7e67ac3d4006ce78b396613a5b9e9fc962dd7026cbb298aa30a4cb
MD5 6425ba91fa28861fa68a8e1cdb4a8134
SHA1 1ec67df0fdcb2da48c5ee18e3108e819686dee4c
SHA512 87fbbf49e9f4ea7e4351406e24768caac6792b14f8f34a421924ffafcba2256de9c516aa902f8316639f6d9f7adcce5e11595f8c8a4c4614925823796ba45f4c
SSDEEP 3072:wXguczvjfetUdJx6TzNn1xRKaVoNOVoZ19sZ:wQPzvrwMSzNn1xgolq1SZ
TLSH
T1F8D3127A59B98C3FCA259DC8853A2F4D1D5360E18983CED00BC7A35C56BCDDA2737168
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a447317d-fba2-4d3e-8fdd-8324b0e24303.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a447317d-fba2-4d3e-8fdd-8324b0e24303.tmp
Size 130KB
SHA256 d2352b156faf9ccb4edc9534132b06560d17a771847aed20a057033c425ac894
MD5 5ecba0641da069bbfa3f34543d947ce8
SHA1 8b9fcfa9ce1bf846f39c249c3744603a6912227b
SHA512 e2e88aaea5d0756b99e57af8b9b2c364153b8a299290ee662527a912530d41db6fa0d72632b67136ee8d5c8408ca2ba807cddf9d391d2dfdb892e52065419ab8
SSDEEP 3072:3XguczvjfetUdJx6TzNn1xRKaVoNOVoZ19sZ:3QPzvrwMSzNn1xgolq1SZ
TLSH
T1D3D3127A19B9587FCA319CC8843A2F4D1C57A0D78E43CED01ED7B3481A7C9DA2B27468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2340_1694326061\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

111.zip

Path C:\Users\Admin\Downloads\111.zip
Size 1.7MB
SHA256 1bc5307edd98df38a4bf57c76cac67b899643fce672b48e368bbe2482afb718f
MD5 8561d3dcab8e1e02905ae5f4a4d53029
SHA1 d64120398f553b5577906db5420ed929eb572e65
SHA512 b81706cb5b4edc49cc194f7d56397e9a6bb3a5dc175aeda31d8aeb6b86db3ecb6a9a2005bd3ad693ad746bbd90cf3fc6dbd1d0609a583608442c6fce70730656
SSDEEP 49152:ARFM3dMT5yU1OkJUiOGAgVI2DtuEcsIoMfRd6Z/:0MtMbfJyGFVfL2oQP6F
TLSH
T1CD853316C7B9F13CCC0B2DFC4696E648B6554F80E2913C7E4AC573582A7ED8663B68C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download