c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023

Resubmissions

20/09/2026, 22:23

260920-2a2hbatxcs5

20/09/2026, 22:19

260920-18vxraer5y5

20/09/2026, 22:12

260920-14xwjs1v3r5

Analysis

user interaction
yes
max time kernel
196s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/09/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
memesense.exe
Size 12.6MB
Sample260920-2a2hbatxcs
SHA256 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023
MD5 77f110a9f1e432ae6a85669ee6e04224
SHA1 398ff0fae1cc7a1b99019c675ba0f42f9d8d333a
SHA512 2f5261cea35e092f04079b9c04811da21320658417fceb4229baafb75bc65bdedaa0701d2cff38da31a93e5d53620b2fac37077fa7b039890e4976480e84b461
SSDEEP 196608:aZCE+RSPD4vjbbcViPLpZ0BYPCqZJZ0NVpzwkpcVSkZD0J92GjLErija9v:aZrtBVur0KP30NEeRoO2WYv
TLSH
T1D5D622D465D4A37DC8818238F5455AEAF0D46C9E1DF9CA1AFF96C4327B70A48C8B1A33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1156	memesense.exe
1156	memesense.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2860	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "250"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134344167464936363"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{23C2B241-D47C-454D-A901-E7040908BB08}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
3932	chrome.exe
3932	chrome.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
1156	memesense.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
1156	memesense.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
1156	memesense.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
1156	memesense.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
1156	memesense.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
1156	memesense.exe
5240	taskmgr.exe
5240	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1156	memesense.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe
Token: SeShutdownPrivilege	3932	chrome.exe
Token: SeCreatePagefilePrivilege	3932	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
3932	chrome.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe
5240	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6024	LogonUI.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 552	3932	chrome.exe	93
PID 3932 wrote to memory of 2480	3932	chrome.exe	94
PID 3932 wrote to memory of 2480	3932	chrome.exe	94
PID 3932 wrote to memory of 2860	3932	chrome.exe	95
PID 3932 wrote to memory of 3792	3932	chrome.exe	96
PID 3932 wrote to memory of 3792	3932	chrome.exe	96
PID 3932 wrote to memory of 4960	3932	chrome.exe	98
PID 3932 wrote to memory of 1524	3932	chrome.exe	99
PID 3932 wrote to memory of 4960	3932	chrome.exe	98
PID 3932 wrote to memory of 1524	3932	chrome.exe	99
PID 3932 wrote to memory of 3968	3932	chrome.exe	100
PID 3932 wrote to memory of 3968	3932	chrome.exe	100
PID 3932 wrote to memory of 1684	3932	chrome.exe	101
PID 3932 wrote to memory of 1684	3932	chrome.exe	101
PID 3932 wrote to memory of 4236	3932	chrome.exe	102
PID 3932 wrote to memory of 1880	3932	chrome.exe	106
PID 3932 wrote to memory of 1880	3932	chrome.exe	106
PID 3932 wrote to memory of 4512	3932	chrome.exe	107
PID 3932 wrote to memory of 4512	3932	chrome.exe	107
PID 3932 wrote to memory of 3028	3932	chrome.exe	109
PID 3932 wrote to memory of 4108	3932	chrome.exe	108
PID 3932 wrote to memory of 4108	3932	chrome.exe	108
PID 3932 wrote to memory of 5076	3932	chrome.exe	110
PID 3932 wrote to memory of 5076	3932	chrome.exe	110
PID 3932 wrote to memory of 4232	3932	chrome.exe	111
PID 3932 wrote to memory of 4232	3932	chrome.exe	111
PID 3932 wrote to memory of 5192	3932	chrome.exe	112
PID 3932 wrote to memory of 5192	3932	chrome.exe	112
PID 3932 wrote to memory of 5768	3932	chrome.exe	116
PID 3932 wrote to memory of 5768	3932	chrome.exe	116
PID 3932 wrote to memory of 5372	3932	chrome.exe	120
PID 3932 wrote to memory of 3460	3932	chrome.exe	121
PID 3932 wrote to memory of 4672	3932	chrome.exe	122

C:\Users\Admin\AppData\Local\Temp\memesense.exe
"C:\Users\Admin\AppData\Local\Temp\memesense.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffaee5bc728,0x7ffaee5bc734,0x7ffaee5bc740
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,8745042102756023294,416085863015362374,262144 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,529271064487048232,13931016700580711719,524288 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,9099887651990273327,981819934195956920,524288 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,8532963007769380203,7948204311255465299,2097152 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3492,i,8420924093717107936,17276693141935120893,2097152 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4420,i,5226973108687162288,12542646860349329731,2097152 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,1739135281250154128,18053079214482951059,2097152 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,11920306530663262941,1961277162835481386,524288 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5452,i,16711327223670503685,4118205407093824180,2097152 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3620,i,11004061306334650428,16789783928185503189,2097152 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3276,i,8667298399918646226,8546584339462466586,524288 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3156,i,4071658573758058680,209663315039741749,524288 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6116,i,3106462050233445929,10027333507168441158,2097152 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6264,i,17148824274449957000,11519946846651069565,2097152 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6456,i,16207123095428014814,7805838844009833421,2097152 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4748,i,14016273322539364010,18216215297050305268,2097152 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6728,i,17487565199867835279,4301718979549540321,524288 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,2382785388241270302,8345756496347195676,524288 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6668,i,1732348868285772633,15449612458606204198,524288 --field-trial-handle=2032,i,2567314348677353691,1286870611981264399,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:4672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1916

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5240

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1756

C:\Windows\System32\q_a57s.exe
"C:\Windows\System32\q_a57s.exe"
1⤵
PID:448

C:\Windows\System32\q_a57s.exe
"C:\Windows\System32\q_a57s.exe"
1⤵
PID:3168

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38f4055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 9c73dae858b7f41f1b353627123ecc107bcf60570538128661e547375210551e
MD5 9c82461448dce24b538b6e429677bc91
SHA1 f1a65e51d43052c5fa1d3a0f226ad92b970c0f88
SHA512 4bb3d8899218ab30d5432096be13db177f9b90c662e08c54b7713974c6ff377bbdb48a7dc82250d53000bc32148d91c60469fe5fc59c7fd3925af022eb0bf43c
TLSH
T170F02DB9D921FC3718FD0B5960A51B4AE74017672B40888F3B3D450D4FB073B46C591C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 439KB
SHA256 ff5d9d713a8bf31b67709ffbc255e83c25c9b58710e6c7b2a61dc153ea9b709b
MD5 563e697c45e1b3cb1a5be4c15499a8a6
SHA1 c1991de5764e6d3c308251e25e4e0eb49ed94c7c
SHA512 5f6ff64b87c0861036529a9ee5f6c12259eb782d690da25489d64da5cccc19c97ad96d7100b2b1a6d734331ac5295d6e68e54c2e30a130bf4b66601b840a0a9e
SSDEEP 12288:jyCd5U4NySaeystHnEuxmPsNXjPW0SuFGsYUwKQ:RTbySaeystHEu5TPW01nYAQ
TLSH
T108A4238E495BC94D9CF8505DF062044D6948E83316767AE302FE2EDB9C288B34E5D9BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000033

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000033
Size 55KB
SHA256 5fbbcc4519ff8b59c4f9b46eb1b7f7a8acad116c5371736da48b94c02e890db8
MD5 c0cb0e9c8f3bcc8abe4bbc698f90e0d0
SHA1 69464d505ee3ce08b8f4936070a46cf16fea127e
SHA512 6c7036f93a9787d27178488918dbb0da7946c92cf49d5d4374f5c5957ded5134af3e2eb07703bc7ea5c88f43cdfedb1b359189e605cbfd093d06e6bc186acfab
SSDEEP 1536:80ec87W9V+SXJEkCIodRfKGR0DhjFxc/UMeDssBLXlH:pCuSkgRVRQciDssBL1H
TLSH
T1A2430265000DC27B4BB96E075410237D7D35B5733580C5F9512C283EA3B6656BE2A1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 06d959e9ff428bb02bfb14f21f341eb5584f9dddb0b2201e38ddd9b961f9e199
MD5 f8ced89bb1701613b81cb1ccde41921a
SHA1 9f3d2af0aa23028b75ddd59bf420c7eb7fced267
SHA512 ffe1d2d3c32a61236b574ec4a6166a31fd155fdbfc7a589185e9039d7f56f5e76f5513f4ef37be3e13b2fdf2fa85582415fa9d35cc7bcf7b25073e76e950540a
TLSH
T1E941C9D676092CA1FFA135F36CD64AE1004E46BEA2E25A1E4EB046F4678603F361041B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 6fd058beb607d45fd56e945759e479feac7ad2ba9e4ac179400fc703065f9a25
MD5 b442e5b82f0a14232d52edd3906a1116
SHA1 0cd97a1a06c4badd11a7aada214722af8f386565
SHA512 136df4527230015da346c7939395a39a3db505c86f4b8d64339af71510190adae0f8da95c739b18db91896681b6b772ba1e057a726646981b2939e784ed683a3
SSDEEP 192:DbHrdM80pEaEL0jtJXaICi1hbHPLPNraPQmvqlfP0NPPLI6IcIGd1cjJfR:DbHrdM80pEaEL0jtJXaICi1hbHPLPNr1
TLSH
T122127EF7C3D8C62DC81156F49B16AF1ECE2A0A18532C3C26C8D8EE5B93E2471D25579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 065b722b305c7ac8768c62606086bf6062c17a3bfba02470a9dc31b37e28d0de
MD5 b6d43ed1f346618f6442abb2655c99c3
SHA1 a52e4a9efcdb6a9d22f089aa37f4ea739201415f
SHA512 42ccc1bac6f620bf2312a900f736d01d8085e0460b99375972278533849bba2d6ab7a851ae529269943884bb22c67c6905bad13ebb015b93269c12938c5549fd
TLSH
T18A117BAF96BE746710AA8DB71F46BC4554BF9C7102515CF8CEA7C26CA4814F30F224D2
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3e10c2d3e0cf7111f8bc494cfe33aeda36e962dc5e3c2e6e9f0b342d8ac1694c
MD5 716d6894ac399a5c24ef1da06965f53b
SHA1 469119168797819b8d678da0e883c0da9d2bdc9d
SHA512 f7770adda129caa32e4c15347c7c10f03a00e7778075a8dc964735a31c8497a6882a9105b3b7899498b4bc26ef8800ada99e942f6105e21a4dcaff06c3a044bd
SSDEEP 192:FRt2t5ce3v7spAPRp2o6Q9THsb+WNnNC0wsckwM5mVyIsnAUgtaJ:FRt2ffYUXf9wk0Es48
TLSH
T1B842942DBE20793B5CEBC22AEA657B53D7F6103170941E44EAF9892C25DB5DC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5c279de7113dcd96dd10a43b3bc65c4b12a0e6b1dfaa325ceefc261259155580
MD5 2127e3e569b0106279030cd3c8e61eea
SHA1 11af04815f3b5c5fe98f889116658bb03f394a7f
SHA512 4aee6201b664d9a1683a9d3c282f6f4f5d7c7528c15a93c06a2327a1b4e34ec123f37711eb4408edaed38edadb6d2b009d4229ecac845749faabd479a41fe35a
SSDEEP 192:bRRcBz2t5cf3v7shAPRp2o7HU9THsb+WNkN89BQJ2fsckwM5mVyIsnAUgtaJ:bRRmz2IfY8X09wpy29s48
TLSH
T10352B62EBE20793B5CEBC22AF9257B56D7F6103160941E84EAF9893C24DB5DC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d203f3bf15824d64c8283c41910b1ffd9e4ef4848378d0d0f0cdab3dc5ad07bb
MD5 fdf31ec1895c72aa4d911de082d79bd7
SHA1 e5128029eeafda7b57c90b3adfff30aa6f7e9c67
SHA512 23c830ed09f0d7953c0e0ba798b5f6b1cff501fe24b9cc313aafddb0e9701286b0957694a4cb6b77e1fb02b58c78a0571371ef9d5ca9011f50d3051ff4c8129b
TLSH
T1A6B0129584415741C19602F021A1148835949F2AAA19134141F42D05D8391A1906B199
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f870.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f870.TMP
Size 96B
SHA256 4a85b0a652d8a43ebded9048555c4b8d6d55b0e80f114b255d3af726e9c56d5c
MD5 d0803a55b13a848584afd4e33ed77409
SHA1 63b8d3a90cbacdaff71af224e3898a4abf3cbde8
SHA512 00c7c630783fc4ee3d7cc5707b07cc59150c5f1babddb8e0e3fc22cf87f10878f440ada4b4aea00efbb7c5db276eb632704e46d1aca338ad7c526b1ee2c68e95
TLSH
T13CB0026AD1026212C14203F076D5A9D87560DF29C6535A16A2E01A6FDC6B6B1E53AA60
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 e88b2f6bbff2c04bcb6c7e3cb19fc04e8ed991f26431ad1a2b1d01d936faea7a
MD5 d3635c5c6ab7485cf17ce9f9e876cd27
SHA1 1744f889068fb38d7190280c50da5bdc5b1ec06b
SHA512 341298e3ba9464909b053c038bdaa8c7eb7408713a10f3fefac05acee3f93ae4e5729e36d80594e526f08ec06124524ca390f72bb902c4fe06c9fa25b2958984
TLSH
T195B011E800802C82EA2002B008EAA0803220AE28AA8B0082AAA000C8C0222038202000
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 4565fd560b126567565a6e5398c20938f8847456ed2a96d0559a2d1e5c928eda
MD5 8b63f0c3da3a1538ff0b58a823ce9228
SHA1 9e31d70cc02ee953536ba2cbcdc43d0eb5960aa1
SHA512 994ae2ab038cc484110977208244028545e9d039f6949f937fcd0cc9d7c96585b9829f735e27733ac6060a67919f5f66a4df06e83b37ebbdbb92fb6ab8b82849
SSDEEP 6144:tqMcnNmiwZK2V5L2LhSdZ+hFD+7t56OD9ZfSApprJ:tqMcQipeVNPyFSXD9ZfS4f
TLSH
T1324422173ED2DC6B4CBC5408F166A301DD639DE140A32EA3468A9FCEE29F65D0B52D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 1a19a0587206ba30f50b5e702aa43599857983e03ad73a09ac04d239c6bf547c
MD5 b50fb1124e27608cb8b6eebec08c4f2e
SHA1 aca80c6bdd8977223d09c09deb8716712cfd5940
SHA512 eaa0531d9eb735c179beb0f52f437ec01da71cc0c24d8220da20346398f8db0af4c62c377043783f9460f87040a655404659f7713bb78772c05f924e32ec2f61
SSDEEP 3072:I+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:I+hFD+7t56OD9ZfSAppr2
TLSH
T112D31232AA91D8BBC9BC6541B157A304DE726CED81DE3A09444A5F8EE09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 ce395ee8c87927711dc2378b798555178fbca17caeb6d5da71aae6008f48a9e1
MD5 1025a27cb051e7c0f17f3864c2aa39d9
SHA1 bc4ab02889f6aaf1b0eada18a5b2ee9660268efa
SHA512 89206509a75df65f0d24fdcdafa7d0dfbc4e1d6afeb5e155f9ec885ab65d9f1bff6d11ce37c1ec071e32d4d35572dc9baf132c1cb65c470108498d2adf0bffda
SSDEEP 6144:2qMcnNmiwZK2V5L2LhSdZ+hFD+7t56OD9ZfSApprJ:2qMcQipeVNPyFSXD9ZfS4f
TLSH
T10F4422173ED2DC6B4CBC5408F166A301DD629DE140A32EA3468A9FCEE29F65D0B52D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 601fa7f6ec9e79db7811d02eb83a3853913f8f2938d685e56e4693f978724606
MD5 2c416085f33135cb12f20423ef4c6586
SHA1 7f1ddb6e1a6b247d5ddd7c8f51a4afb25cf594a4
SHA512 d3c7a0477bfc783441a9b53e32a3f6f978017394a5485f0a6eece24a9931a4c4c5fcb9120edec096e99ca272bc4439aae9214f01477324d667f531eeaf5594dd
SSDEEP 6144:uqMcnNmiwZK2V5L2LhSdZ+hFD+7t56OD9ZfSApprJ:uqMcQipeVNPyFSXD9ZfS4f
TLSH
T1784422173ED2DC6B4CBC5408F166A301DD639DE140A32EA3468A9FCEE29B65D0B52D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 4ecce594fb3a0dc319eb794577c4b5058b4a6e1dd3e20dad04a3b57a991c6f2a
MD5 34a1ce6117c94399f44d4dfa51a3c86a
SHA1 6767f120e56c55344921c6e9e5542da39f56250d
SHA512 24a94cd0fecdddeb504c85b7bfafffc6e6b20a9fc5298a17acca2c0daaf8f1a3e2f7330a0bd990f921e8ece18c7b72b440bf2fae5486e57190dc0d00d513cc14
SSDEEP 6144:zOMcnNmiwZK2V5L2LhSdZ+hFD+7t56OD9ZfSApprJ:zOMcQipeVNPyFSXD9ZfS4f
TLSH
T1124422173ED2DC6B4CBC5408F166E301DD629DE140A32EA3468A9FCEE29F65D0B52D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 a46d86c8e751922490921750004461a5087fd170df216a059bbf0947122b23d7
MD5 720224af24d8ef7c35307138f01b29ae
SHA1 8cbdb77050145c245028a2bcb8bf2bdea647245a
SHA512 3145e1e69a51950aa032e78ac8afab11b6052f0cfd0895333ad51e65032d717b972c4deb4f4e7cb3a13949358739ade2e4c0d9072170df3618ccdf88e348e4f2
SSDEEP 3:MsEllllkEthXllkl2zEklMCTl:/M/xT02znMCT
TLSH
T10C4404C47FC10405C51030354053C3500774D41C75315743345104135CD5D500C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1156-50-0x0000000140000000-0x0000000141760000-memory.dmp

Download

memory/1156-0-0x0000000140188000-0x0000000140ABB000-memory.dmp

Download

memory/1156-49-0x0000000140188000-0x0000000140ABB000-memory.dmp

Download

memory/1156-7-0x0000000140000000-0x0000000141760000-memory.dmp

Download

memory/1156-6-0x0000000140000000-0x0000000141760000-memory.dmp

Download

memory/1156-2-0x00007FFB0B120000-0x00007FFB0B122000-memory.dmp

Download

memory/1156-1-0x00007FFB0B110000-0x00007FFB0B112000-memory.dmp

Download

memory/1156-575-0x0000000140000000-0x0000000141760000-memory.dmp

Download

memory/1156-574-0x0000000140188000-0x0000000140ABB000-memory.dmp

Download

memory/5240-560-0x00000209DF4D0000-0x00000209DF4D1000-memory.dmp

Download

memory/5240-566-0x00000209DF4D0000-0x00000209DF4D1000-memory.dmp

Download

memory/5240-571-0x00000209DF4D0000-0x00000209DF4D1000-memory.dmp

Download

memory/5240-570-0x00000209DF4D0000-0x00000209DF4D1000-memory.dmp

Download

memory/5240-569-0x00000209DF4D0000-0x00000209DF4D1000-memory.dmp

Download

memory/5240-568-0x00000209DF4D0000-0x00000209DF4D1000-memory.dmp

Download

memory/5240-567-0x00000209DF4D0000-0x00000209DF4D1000-memory.dmp

Download

memory/5240-565-0x00000209DF4D0000-0x00000209DF4D1000-memory.dmp

Download

memory/5240-561-0x00000209DF4D0000-0x00000209DF4D1000-memory.dmp

Download

memory/5240-559-0x00000209DF4D0000-0x00000209DF4D1000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads