cdd533ea17f264ff28a1d8ad06f43c267fa913f065528c28b65ce038d2cf5a32

Analysis

user interaction
yes
max time kernel
570s
max time network
572s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
essential-installer-3.2.4.exe
Size 33.7MB
Sample260910-bwj72stbnf
SHA256 cdd533ea17f264ff28a1d8ad06f43c267fa913f065528c28b65ce038d2cf5a32
MD5 ef234b5ded05737f1e6243031e534f96
SHA1 72037c2e62c1029f50d372cb38e562da3a40278e
SHA512 c7f380852ae70ccf056d5664d76a7f9da3c29e9001712ee74e28dbc6afcb5950debb7073ef599d6632b246893e4e8f41fb140ebb59b7d0c9399b545478c8ced9
SSDEEP 393216:OXz7GjX3lbomevyhfK0gnMUkrUOzUw+ixi3crQ5ly2TfG2F5/PQXks7XKFvjH56d:OX/4NgvIfpgFIUO4v3cr+EkGXKVjZ0v
TLSH
T18E77F102FE8A5868E06AC874C3474A63AA3334CF5527F4BF05E425652F7EBB56F19309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
159	api.gofile.io
161	api.gofile.io

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Loads dropped DLL 2 IoCs

pid	Process
3320	java.exe
3320	java.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2272	cmd.exe
1064	cmd.exe
3664	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3968	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334774147273577"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
1308	chrome.exe
1308	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5232	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe
Token: SeShutdownPrivilege	5116	chrome.exe
Token: SeCreatePagefilePrivilege	5116	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
4844	essential-installer-3.2.4.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5296	7zG.exe
4804	7zG.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe
5116	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3320	java.exe
4844	essential-installer-3.2.4.exe
5232	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 1396	4844	essential-installer-3.2.4.exe	85
PID 4844 wrote to memory of 3320	4844	essential-installer-3.2.4.exe	87
PID 5116 wrote to memory of 448	5116	chrome.exe	97
PID 5116 wrote to memory of 3928	5116	chrome.exe	99
PID 5116 wrote to memory of 3968	5116	chrome.exe	100
PID 5116 wrote to memory of 3928	5116	chrome.exe	99
PID 5116 wrote to memory of 2392	5116	chrome.exe	101
PID 5116 wrote to memory of 2392	5116	chrome.exe	101
PID 5116 wrote to memory of 1636	5116	chrome.exe	103
PID 5116 wrote to memory of 1636	5116	chrome.exe	103
PID 5116 wrote to memory of 4356	5116	chrome.exe	104
PID 5116 wrote to memory of 4356	5116	chrome.exe	104
PID 5116 wrote to memory of 1660	5116	chrome.exe	105
PID 5116 wrote to memory of 1660	5116	chrome.exe	105
PID 5116 wrote to memory of 1280	5116	chrome.exe	106
PID 5116 wrote to memory of 1280	5116	chrome.exe	106
PID 5116 wrote to memory of 2336	5116	chrome.exe	111
PID 5116 wrote to memory of 2336	5116	chrome.exe	111
PID 5116 wrote to memory of 3336	5116	chrome.exe	114
PID 5116 wrote to memory of 3152	5116	chrome.exe	116
PID 5116 wrote to memory of 3152	5116	chrome.exe	116
PID 5116 wrote to memory of 4164	5116	chrome.exe	117
PID 5116 wrote to memory of 4164	5116	chrome.exe	117
PID 5116 wrote to memory of 1120	5116	chrome.exe	118
PID 5116 wrote to memory of 1120	5116	chrome.exe	118
PID 5116 wrote to memory of 5452	5116	chrome.exe	121
PID 5116 wrote to memory of 5452	5116	chrome.exe	121
PID 5116 wrote to memory of 5488	5116	chrome.exe	122
PID 5116 wrote to memory of 5488	5116	chrome.exe	122
PID 5116 wrote to memory of 5936	5116	chrome.exe	125
PID 5116 wrote to memory of 5936	5116	chrome.exe	125
PID 5116 wrote to memory of 5196	5116	chrome.exe	126
PID 5116 wrote to memory of 5192	5116	chrome.exe	127
PID 5116 wrote to memory of 5212	5116	chrome.exe	128
PID 5116 wrote to memory of 3596	5116	chrome.exe	130
PID 5116 wrote to memory of 3596	5116	chrome.exe	130
PID 5116 wrote to memory of 4412	5116	chrome.exe	131
PID 5116 wrote to memory of 4412	5116	chrome.exe	131
PID 5116 wrote to memory of 896	5116	chrome.exe	132
PID 5116 wrote to memory of 896	5116	chrome.exe	132
PID 5116 wrote to memory of 5956	5116	chrome.exe	133
PID 5116 wrote to memory of 5956	5116	chrome.exe	133
PID 5116 wrote to memory of 5680	5116	chrome.exe	134
PID 5116 wrote to memory of 5680	5116	chrome.exe	134
PID 5116 wrote to memory of 3060	5116	chrome.exe	135
PID 5116 wrote to memory of 5816	5116	chrome.exe	137
PID 5116 wrote to memory of 5816	5116	chrome.exe	137
PID 5116 wrote to memory of 5992	5116	chrome.exe	138
PID 5116 wrote to memory of 5992	5116	chrome.exe	138
PID 5116 wrote to memory of 5412	5116	chrome.exe	144
PID 5116 wrote to memory of 5412	5116	chrome.exe	144
PID 5116 wrote to memory of 1308	5116	chrome.exe	145
PID 5116 wrote to memory of 4636	5116	chrome.exe	157
PID 5116 wrote to memory of 4636	5116	chrome.exe	157
PID 1064 wrote to memory of 5760	1064	cmd.exe	158
PID 1064 wrote to memory of 2776	1064	cmd.exe	159
PID 5116 wrote to memory of 4572	5116	chrome.exe	164
PID 5116 wrote to memory of 4572	5116	chrome.exe	164
PID 5116 wrote to memory of 1148	5116	chrome.exe	165
PID 5116 wrote to memory of 1148	5116	chrome.exe	165
PID 5116 wrote to memory of 1992	5116	chrome.exe	166
PID 5116 wrote to memory of 1992	5116	chrome.exe	166
PID 5116 wrote to memory of 4528	5116	chrome.exe	167
PID 5116 wrote to memory of 4528	5116	chrome.exe	167

C:\Users\Admin\AppData\Local\Temp\essential-installer-3.2.4.exe
"C:\Users\Admin\AppData\Local\Temp\essential-installer-3.2.4.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  "java" -version
  2⤵
  PID:1396
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  "java" -Dinstaller.debug=false -Dwrapper.version=3.2.4 -Dinstaller.noModInstall=false -Dinstaller.temp=C:\Users\Admin\AppData\Local\Temp\essential-installer-1789003795 -Dinstaller.cache=C:\Users\Admin\AppData\Local\essential-installer -jar C:\Users\Admin\AppData\Local\Temp\essential-installer-1789003795\installer.jar
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa8f31c728,0x7ffa8f31c734,0x7ffa8f31c740
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,9134766480223086410,18177574336589754129,262144 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1616,i,15660759073885093243,18027490248870253439,524288 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1848 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2432,i,16852322482637061544,16002035907016841889,524288 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,3370714437382927294,13546842121761677746,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3372,i,2456518085069850650,17902767848074931190,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,6029789702309325453,13596223355936376947,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,13072890319643406557,15954346176036896315,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4896,i,15963723012805758241,16737550878375198460,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5388,i,7049641171116779680,14635852425001638462,524288 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5760,i,14658731050742572538,14110088407047239453,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5992,i,5949011445588938752,2214544558511593696,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5944,i,18094232933088821290,6164443548345459745,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5780,i,17924979016370264997,2011541187189308538,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5636,i,4187886366843600731,16935082109443901830,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5740,i,3464927991383176316,7028939798421057037,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5008,i,2913392199760252297,2308096733553538952,524288 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5012,i,2298570528951065608,6364836946863451910,524288 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4996,i,947693139736779891,9503323978745741831,524288 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5092,i,8104630115409787099,12268389743952732369,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6272,i,14772215355575312544,7557540686335359132,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5960,i,7692889215446930568,15402185471032593593,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5968,i,8785627378380793063,18438619444737237167,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6020,i,2901734817766712968,14065172931592909110,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5820,i,6080757535601690595,9990012186897599251,524288 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5932,i,15705802763367498831,14779727312799165255,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5776,i,14978474039205838482,77886556586560562,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5000,i,13052346668593573110,12947232087412122837,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5048,i,11919759467015552283,18231464263409158765,262144 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5624,i,12879736933227236747,7239500080263773615,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6020,i,15781662015152805198,10531884252426373607,524288 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6536,i,16134179522699240789,18075023249995903607,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1328 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=3968,i,15612374056080462233,10069045946864613545,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1544 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=1324,i,3509008811435371609,12897443340848086108,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6460,i,15128551515421876159,17566656086741206455,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6604,i,2858485424400131928,14319007980794996727,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5872,i,12981560498442314481,871321754875843530,2097152 --field-trial-handle=2040,i,16841419622354894703,3681892984112734973,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5172

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5232

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\exodus\" -spe -an -ai#7zMap9359:74:7zEvent29557
1⤵
- Suspicious use of FindShellTrayWindow
PID:5296

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\exodus\" -ad -an -ai#7zMap30840:74:7zEvent19230
1⤵
- Suspicious use of FindShellTrayWindow
PID:4804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\exodus\start_avax_logger.bat" "
1⤵
- Executes a command shell one-liner
PID:2272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\exodus\start_dot_logger.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\system32\where.exe
  where python
  2⤵
  PID:5760
- C:\Windows\system32\where.exe
  where python3
  2⤵
  PID:2776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\exodus\start_trezor_mapped.bat" "
1⤵
- Executes a command shell one-liner
PID:3664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7a009aa08df161a943281995f6a916ca80d161d2a5ff9e4222ef445782cdd624
MD5 846d486f92bb6466238a5e80dfb0eb26
SHA1 62b2a4d121546c1377365174fb60782b2b8fdc08
SHA512 a7db8493cd7fa7552dbf2727b8da9cb6c52544f0786cca9b44cd3a0ff163012985d30eee531095bcd0378eca4e4fd164988d4bc9d01c26ecf762ed4fbdc56ad6
TLSH
T1F1E02BE9C821BC3708FD5B6861504746E74003177F90C84F3B3EC2098FB5A3B826692C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 73KB
SHA256 fb9acea2fa7074cb3fdebf730adefc33c50367f8797af574901352caa814d779
MD5 15dcfa016684da43289216097cb32bc9
SHA1 4ec5fd9945ad55bea83d3b1e35238beb22c7e2b1
SHA512 24e4b2dc585a5a5c6bede5e1b735fb29c728b671afd88522030538be26c371519d7cd88cc57478eb8dbbda11fb761723dbf8669d7d7c9246395d6c52cef44948
SSDEEP 1536:fFe/4pJ09FbrtybC85RChT7HvY2njBfDTYubbnsge+oj:HcDfzjBfJbq+W
TLSH
T12B73127866985FE441A83CB93A54E5E2845323680348F1EEEF13C549D2439CC7EEDEE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 df57b98e99f09c7cc07443290b3e5a9a38ec6564251835c87d2e198680a4621e
MD5 f1f127dab6f408444dd1c4caa93307a0
SHA1 2aff2407d66322ea904d45f2a5fd5b94b30aad86
SHA512 2e1fd7b91656c348fcb5c9df7bcb5ec15d0d82764fc5df7e5fe63d9e8a88d338c06fb4a06e70c4989a7276e08a598d817cda859293a935534b4cd1f8415b212b
TLSH
T1A7F068A0B2A508C7DF30D6B2F9D12890247E045F12CE472E8A44E0F9F6336FA9C15736
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e2b591d633711c8719bf3ea5a26852c70466187e4dd2a458eeb328bccd931e8c
MD5 6c13be136c7f8a9757369a131fd16860
SHA1 7dd707029367bc6b0879cec355f79a2b4e4f2414
SHA512 410ba8a2ec6af72312caaf7093f797ca673d9a377b582780b904545ff7cc384f5dc1ade144448d933591e25aa11bdc7a769d801ce49049657d0e8aa3c708a583
TLSH
T18A31FE63B1E10463C734A2B0AFC56495E635CCA704C61AEE7534D0F4E7036BA3D98731
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 78dad67ba5474df141d1cfbeefe3a92c43601c7f59410d22d151c60a8b543050
MD5 4a47a8e070064ca22256e579dc4f77ac
SHA1 c17fa8c85041288b01dee3acb983edd03310f131
SHA512 3750f094fc26fc099940765351129389e61505da4fc4c4bb7468142f8ff15f9f721149a8cf1aaae376e590c0b679f16ca53bfa930b2eb3e7081506ac4e78e229
SSDEEP 192:D78NIo/BJSJaaIC1B7JeCNCaPvvXfPwNPtBZjJHSPhFGy8F:D78NIo/BJSJaaIC1B7JeCNCaX/f4N1BV
TLSH
T1C4F19EF7C3D8862DC91156F8AB15AF2FCE2D0924432C3D66C9D9AF1B93E2871D21524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 e63fcbd490eb8db1282f997828385801adc23dbdb3763fc39a3d527acf28ac1a
MD5 f4c628c57f9fa29537e687c65cf8ca63
SHA1 40ae5f97e974723d9c2d0b930c0076e6cf011615
SHA512 90ceeaad69f12d7e97013b1fa6323886e3aaa9c3d50b6d2280493d53184d48a1995795fdd66e2970edff66021b5f46bb2be3bfee69a0c5ecc13af08c2c843d94
SSDEEP 192:D0uiytHJJ5JwJaIC1B7kZCUCaPvvqfPiNPiEd7SPh8CqbbFrKK:D0uiytHJJ5JwJaIC1B7kZCUCaXSfqN6Q
TLSH
T109E1CEF7C3E8862D891196F4AB15AF1FCE290524032C3D76C9D4AE1BD3E2872E25534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 ab9ea9fc8f806c406bb6db15a33a577fab7420b0535a947396e94a05217f0595
MD5 c8ea82df8e3ffd49d3747cd3d533c35b
SHA1 19c69ef5f71a109470b85fd91183063eb5c6dd2c
SHA512 d961e87ae469b1dfbc0a8cfdcc888d0e1d65b72d25ef66f56416e56801c108220658492a4eab43cece85991ad1902b10117e44eef9109f800c87f6013603afb6
SSDEEP 192:D78NIo/BJSJiJaIC1B7JeCNCaPvvXfPwNPiZj7SPhFGy86/qebW:D78NIo/BJSJiJaIC1B7JeCNCaX/f4N6V
TLSH
T106028DF7C3D8862DC91156F4AB25AF2FCE2D0924432C3D6689D9AE1B93E2871D21524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ceec0f1286464a8462d2ac703f95899ffaed4b2d1fd65dabdde0f2f6d07d4913
MD5 c025aa8ed01874a811f9a069a20bab4a
SHA1 64ad36270de3140fb840f155c978511871b1162a
SHA512 5d650c0b78d017580314b271283ded5594d5dd6c084f7748a65f0420c28a2460c0e145165ec03574cfa4bf4292dc89bcf8fb63f684fd39c2a9121bbada0a24c0
SSDEEP 192:sRfTcBzv3lryDN2VAyzv7chAPRp2qFfC9BHsb+WNnEl4dS2352mLVyIsnAUgtaJ:sRfTmzv3lODEfLw8Xlsrwkl2J1N8
TLSH
T14852E82EB920297B9CDBD319F9267B57E7F5102224942EC4E7FC892C15E75CD221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 adeb03911951a9101516173b067de53e9eadfc77cdfeb27cccf215f95339a5ab
MD5 7a84bdcd1e0060ff50c278afa34c467b
SHA1 b4246f0c558d2d73ff1c346e27bbc4f2104898e2
SHA512 9abc5f2920de6dfb564b8b5ad3b4f9c5a4fe997cd775960ed37a019e25dcbfc8e4241a4443f9c69f8acd99673ed253b56d0cd87167e4b76fa1ab4ba2058cb597
SSDEEP 192:KRfTcBzv3VryDN2VAsIv7cI6PRppqFHlsC9BHsb+WNnPgYj8edSTOV2EEp52yLVK:KRfTmzv3VODEJUwbXMjrwI9Xw2FHNe
TLSH
T16862C62AB9202A7B9CDBD325F9667B57E3F5102224942EC4E7FC8D2C15E76CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 72dbfcdbb26530601cafec523b55cf96bf13f258c29d53c829e95f447c07cf73
MD5 55ddf0237a8a82903993be3c86dbef1e
SHA1 1b97092a80a5c1f4e8ba05fedac14c9e63323139
SHA512 642b55f5d008d78f716820870c49b7ab149c7337b36ce4a5706c2cb49bff03da7dad501a792d2cfc7da41263faaca5ceaea3f5d03aa828f8c554602904bf9b46
SSDEEP 192:KRfTcBzv3lryDN2VADIv7cIAPRp2qFHlsC9BHsb+WNnPgYj8edS2Yu52mLVyIsnB:KRfTmzv3lODEuUwJXljrwI9X2TJNe
TLSH
T1DB52D62AB92029BB9CDBD315FA667B57E3F5102224842EC4E7FC8D2C05E75CD221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1b354e3a7cf32368afb2463367163164c3262ffb8cc8a05d0986e3d6af2bca03
MD5 afccbfb83677ccdad53bc8dbf2703cec
SHA1 ea952e9b5ef5c2ab631378b60bb3c75a24242168
SHA512 c3c4ff5c789c18f4129b8d33a99f35e568fbc9c611c3237d33e6fd0769ad9f40a153387908848ebbbde57ad08aa442a38cff0fc9b513cc5c4bef2b8e52c57232
SSDEEP 192:KRfTcBzv3lryDN2VAoyv7cIAPRp2qFfC9BHsb+WNnPgBdS20u52mLVyIsnAUgraJ:KRfTmzv3lODE9ewJXlsrwIm2nJNe
TLSH
T18652D62EB920297B9CDBD319FA667B57E7F5102224842EC4E7FC892C05E75CD221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 89bc62350800a9f51cfe63dd890e7f3f4afc9e8b5d9e21a43e49fd0c2b77c077
MD5 df6838930444436460e61abac3aea399
SHA1 48481324cd7c21198c33dba874a06d66b68bd00f
SHA512 a26101ad55cf85be275b473df57d6e991cd182f5d38a3a58264815165cac78e1ec36f22587238442a1488201261564a8aeb1997e80263a52076ae1e76e8854cd
SSDEEP 192:KRfTcBzv3lryDN2VAhqzv7cIAPRp2qFfC9BHsb+WNnPgBdS2p52mLVyIsnAUgtaJ:KRfTmzv3lODE+qLwJXlsrwIm2/1N8
TLSH
T15652D62EA920697B9CDBD319FA267B57E7F5103224942EC4E7FC892C05E75CD221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 82c1181964ffa8ee542f43ee6e42729e114b17a833f2424483b9042482cbec5a
MD5 ee8e0a07408d5d90fe2080521cec0281
SHA1 cfd925ac220ead0726e12974dd29f828bf7a627c
SHA512 489874e5ff058940f2d5cc131d6a770e8bd679ca16ffb2b7753d5f378a2e8f744e1447d4608f439f1e879f1d145a4bb1f945fffaf7cdac82faae5a4ae2140e07
TLSH
T17BB0121088019901C05203F4294314ACB1245F31960A270643F4A962C866561C814250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f567.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f567.TMP
Size 96B
SHA256 b85595cfb497933ba51f87d2fd9224a9132e139cb19a8d8cf00f731b845ab598
MD5 0729bd9dfd66442bdc8a409b578cf827
SHA1 b6d96576f5922f3efca6fa10459a09f053021e76
SHA512 ce896ee00010637f0a5d3e6377726a1e4c82ce67e55e59f5de9606f60bb1026a4f0bf5e741706b2bbfb6b42e2956f38de3c89927de758db55e00f76206442f53
TLSH
T149B00255C1126217C09683B125A6E5E87270EF26C6031252A2E17BAEEE6577549352A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 c6affe20de13eec996877be2642df9fc892d3fa9681c410858f09f8dfea7fa5b
MD5 2fcb752bf4988dbf1036f64e47990fe0
SHA1 a3b41af74fda10104b2a3a1f6ca53df25d40d54e
SHA512 96535af051b70d8c0206db06474340602aeafabda2d44a7e616ceacc57621bd0832e02abdc2fe0e93c069c748e5e4293c81f5e1b832eee42fe6819ff5374152f
TLSH
T19AB0113C80008B8AC0200EB022C022C033322EA2238380A208A800A88A8E3820E20A00
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 b01e9b21e14b3128a46f9324b5de4527bec467baefa5f4b4e0e61394dd0f8fda
MD5 ec6af37824239e17353f26e67c7d1854
SHA1 73d9c3537fb1118ec80d4a10d2fa27ee0a57c497
SHA512 ab5892907c734917d57d641bb6a9716da835e290a9cca793be623ea76069bf46a956b2a75afa8ea020ddfe905503bfcf9d07f59f90ed9aece9b8d47bb9634fea
SSDEEP 6144:1R1xTXQ0trg9XenFmUi21rSm8uUVNSlzY4:1R1xDQgrg9OFfi21b8j8zt
TLSH
T1BF3413D1FDF7FA72DB4C6009B09E22299EF94C82D164C7D01A3B8D0659D92EA07E2E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 e2b20ec3b5148610c313ec61be58998242d0a93b1cdb390af81c4e9fe8905014
MD5 326bacfeac09acc0be3598a9393d284b
SHA1 9d094e4f77fa60f9caa863647e70abaa86fe7ce4
SHA512 5d80d5c20960ce07986881bc6e90a3d5e740a50d90b8731035583ad10a6326d2c106d16c509ffff74d9c93a78cde1bdc6bae891a3ec0e724668e2b7bfe7b3d37
SSDEEP 6144:CR1xTXQ0trg9XenFmUi21rSm8uUVNSlzY4:CR1xDQgrg9OFfi21b8j8zt
TLSH
T1983413D1FDF7FA72DB4C6009B09E22299EF94C82D164C7D01A3B8D065DD92EA07E2E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 282KB
SHA256 0e299404ba789e24819902ad071f21f8a6bef25f04816cf2da53d07817f7731c
MD5 16a7a6483483d18346c0fba396b98931
SHA1 c617a4eb37c466410ad224c1ea3496b383cd95f2
SHA512 ddc6d33198a4a51c130b24ccbc0e43c48f4c978e1f64a4d0e94e90e3e76aeb2604a1074c4c0ac084e60942c3d19fb2ad259234ea26cb1ae6cffbc8dfcddebb9f
SSDEEP 6144:zwmCB+BR1xTXQ0trg9XenFmUi21rSm8uUVNSlzY4:zw8R1xDQgrg9OFfi21b8j8zt
TLSH
T1055423B1BDFBFBB29B4C6115B04E2228DEF58CC2C671C7D0192BAD42185B35A4FA5D60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e5b54cc3fd36730f78bdc4b06f9996f62975e086555bc1d5d7a67df560e8f51b
MD5 ad83f1a54e7270a44f59ef20540fd080
SHA1 e16cbe0e89f719b2dcedc185d52f10d20a9dbb25
SHA512 89eb7976d6502bdaabe47ad47014d6564ce59dc35bffbe6f0c5aec225ebe43e027a74759ada5923b51e7fb4c8b7d16fc157ece4c5d6a834856d9569161289af4
SSDEEP 3072:SOFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:HFmUi21rSm8uUVNSlzY/
TLSH
T16FC3130076E3E8F2EE5930447BEE2A149D6C4D818191C6415773AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 0dec8d5488ad941304604ac8b2c4f1b28268b2c9b1e19cc53c0a515d1d39d58a
MD5 7fe39cbf6c93952125be58059fb342cc
SHA1 f511575a6c59d29c37374fcc8404d266f441c0de
SHA512 0538e5ce3590e8253778c105d462a0c0be739fa04ed105d38d8fe22d110515dc6d8b46a96b26d8935dfd81485e2d06d33f539c58d430b38eb88406e221e3a842
SSDEEP 6144:4R1xTXQ0trg9XenFmUi21rSm8uUVNSlzY4:4R1xDQgrg9OFfi21b8j8zt
TLSH
T1633413D1FDF7FA72DB4C6009B09E22299EF94C82D164C7D01A3B8D065DD92EA07E2E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 d3f7137413155665851f36dc654a0bc3ff829c715460e6afb436cdd75cdc481a
MD5 047500d41d8935da47ded512e1d61eab
SHA1 0f744424a1c40801e01e1f46d560b2b5299d5c09
SHA512 a0c7bb460c29754f0e7c84a3d65d529cdcf1083d49b70eb3fa3fe608166f37c06f410b75af3383a752c9fde1b1ea5931947b0f61c5525092ef5302ad4059be46
SSDEEP 6144:MjR1xTXQ0trg9XenFmUi21rSm8uUVNSlzY4:QR1xDQgrg9OFfi21b8j8zt
TLSH
T14F3413A1FDF6FAB2DB4D6045B05E23299EF94C83C164C7941E3B9E061C992E60BE2D50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.jar

Path C:\Users\Admin\AppData\Local\Temp\essential-installer-1789003795\installer.jar
Size 22.8MB
SHA256 d81aac95f381d271da6f47445646df5bd2fa7848e7141ba0b19a1a6ac0ee6611
MD5 49df5d7e146e47222eb84feab4b1a3aa
SHA1 fb4a147514e279e238f0ccfc555b4b03cad51946
SHA512 e3ed7a65ac8af855f557a56002b7bd93eb0290fb6e1ae94ed622ac8e0997719513545f3ca9d6803fab342a260228de58b83d316469f88d917812a983c46e2046
SSDEEP 393216:aGjX3lbomevyhfK0gnMUkrUOzUw+ixi3crQ5ly2TfG2F5/PQXks7XKFvjH566:a4NgvIfpgFIUO4v3cr+EkGXKVjZX
TLSH
T1D0371222EDD9A939E633027661C20663753F13CCE447C06A18FC3AD7C5B681A6F9676C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glfw.dll

Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.3.3-snapshot\x64\glfw.dll
Size 484KB
SHA256 affa7e54eb0dedce4a5721c327c1a16035edbbd039cd402e08107d6d2d55eb1a
MD5 8cabdbe3d67546771b02af5d42073cfe
SHA1 2e19147110b9872a52814956bab151a7aa80ce58
SHA512 b7f46feef779e5772fc7711fda601fdda6ee4bf41d4fb87735a0b8fdc5fdbbdab23ba1760989e15d66cf9ba65409933cbce858eda169d04f13f401198245ad1f
SSDEEP 6144:QHi9k9IQYWWS4JJbzxazY4czAHxOoThkaQo3:QHivQYWX0bzxazY4/3
TLSH
T100B4B61967B2060EDF2B4433C6CFF9219477B04C3FDBA59E7E9019E47E25BA140A9B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwjgl.dll

Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.3.3-snapshot\x64\lwjgl.dll
Size 468KB
SHA256 a39adf52947fafd954c2a86ce031abb8c59825f7ee50337ac8c41e4280abe82d
MD5 d8ea3886d9f59b514bfa5b24ab69c0ab
SHA1 2bf57942dff5360889f0e89c58d5acdc54e5f1ea
SHA512 ba8af0415c7b0454dd8bdccf78ed59da3bb5cc5f631dd060d3cd0eaf74d8f55d7531248b6b8a995ba5b672dc0386d3fa198e8c761f2e1cc0304da0dc029bf29e
SSDEEP 6144:p997Xkbij3eAMVXiDiA36PFpIiThjnC/smb72NI:p997Xkbij37MVy+A3+J4bS+
TLSH
T132A4D931DE12C68CDCEB723960531001EA7778651B1216CB27ABDA5BB11ABF093F6F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mitmproxy-ca-cert.cer

Path C:\Users\Admin\Downloads\exodus\exodus\mitmproxy\mitmproxy-ca-cert.cer
Size 1KB
SHA256 e7279534f73cd781fcf877305d2694ad884fe8d66286dc6accdf70bb11cea04e
MD5 4922fef019bfe604bce4826d898b4208
SHA1 e9a8b25c1a0e87d7965b561398649c948e2a48f6
SHA512 cca52947c6ca535b119e8f1b38d186d1e693fbf4da12cc0756dd0ae35a84e34a705072ea8d5070dc1588ae16c97557a108482be82ab73bce34bdb45688f0bc84
TLSH
T1422174758FA0789454C7812514FA6CE3C9791713B66FB42218F389AA520D62B065C85D
MD5 SHA1 SHA512 TLSH

Submit Download

start_avax_logger.bat

Path C:\Users\Admin\Downloads\exodus\start_avax_logger.bat
Size 748B
SHA256 32b34ce65fcf7605db7f3818aed63c34604171381590124d3978e84365553d8c
MD5 e340e94977e9a66e5a82bb3d7f82825e
SHA1 c76ec99c8f68a5b631697ff8b4fafe491be96c1d
SHA512 2162c90b814f015ebbf13270b7c3aa6ae481ddbcf5fbcefe6769c82ca43f98bd05a809400cf977df53a9696f12a3be5caf2e4944d16a9ec88c96a24fe2f9e9cf
TLSH
T1DE017DA17101D53A8ABA454F9D7E3751B0183C4B43119D6CA60B517C04057DEBABF061
MD5 SHA1 SHA512 TLSH

Submit Download

start_dot_logger.bat

Path C:\Users\Admin\Downloads\exodus\start_dot_logger.bat
Size 1017B
SHA256 50a6357e5bf3c495ea82e3207b138f7abcd952d54b14edf0945fb31b0df87687
MD5 ca8f9237ce8cb472e08a2ee3fd30d5f4
SHA1 44f84f62f2f9a72aa3dc9bddd016a6accbb49d52
SHA512 aaeb39c51adba61179eb73637a8206dbb9e6c4dc074cb84164a3aaa040c1242183e62f6759fb5428b0242215812935eb76eb1d6752b385b6ffe3d812e37d460a
TLSH
T1DE11AB9736A4D0348579035C8DBDD2A9F00520E790525C8DB49FA0301F213C335AD956
MD5 SHA1 SHA512 TLSH

Submit Download

start_trezor_mapped.bat

Path C:\Users\Admin\Downloads\exodus\start_trezor_mapped.bat
Size 149B
SHA256 f0f640037e122cdfb60273b079ec22986619fc332c4b1c1c61596407446cd6b0
MD5 1151ef80644c478f3659f72f8a98f0c8
SHA1 20eeb0b79d35991269cde99b8833f3074c2fb791
SHA512 240c4fc445e59f880f13bde9f1ec21863106e48ab2e6dc00b7099ae9e8496397209872b8aaf1a60c32815981f35a2adaace09453cfcbc5cac3a6bc4ce562822a
TLSH
T128C08C0EAC14908225520184D3596879F20F8BFA618228682160E22D390A9D6604C586
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1396-13-0x00000244E3550000-0x00000244E37C0000-memory.dmp

Download

memory/1396-2-0x00000244E3550000-0x00000244E37C0000-memory.dmp

Download

memory/1396-12-0x00000244E1D70000-0x00000244E1D71000-memory.dmp

Download

memory/3320-18-0x000002166A580000-0x000002166A7F0000-memory.dmp

Download

memory/3320-30-0x000002166A560000-0x000002166A561000-memory.dmp

Download

memory/3320-74-0x000002166A580000-0x000002166A7F0000-memory.dmp

Download

memory/3320-73-0x000002166A560000-0x000002166A561000-memory.dmp

Download

memory/4844-83-0x00000171639B0000-0x00000171639B1000-memory.dmp

Download

memory/4844-77-0x00000171639B0000-0x00000171639B1000-memory.dmp

Download

memory/4844-76-0x00000171639B0000-0x00000171639B1000-memory.dmp

Download

memory/4844-75-0x00000171639B0000-0x00000171639B1000-memory.dmp

Download

memory/4844-84-0x00000171639B0000-0x00000171639B1000-memory.dmp

Download

memory/4844-85-0x00000171639B0000-0x00000171639B1000-memory.dmp

Download

memory/4844-86-0x00000171639B0000-0x00000171639B1000-memory.dmp

Download

memory/4844-87-0x00000171639B0000-0x00000171639B1000-memory.dmp

Download

memory/4844-81-0x00000171639B0000-0x00000171639B1000-memory.dmp

Download

memory/4844-82-0x00000171639B0000-0x00000171639B1000-memory.dmp

Download