quasar | c67ba858dfa5feab71d851b5ee432a4c7817c9c66d733e0cfdac7cb17c79ebf5

Analysis

user interaction
yes
max time kernel
298s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/09/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4.exe
Size 3.1MB
Sample260920-t49rsaythy
SHA256 c67ba858dfa5feab71d851b5ee432a4c7817c9c66d733e0cfdac7cb17c79ebf5
MD5 bf3fb951008074d01477b7d1f22811a0
SHA1 0078b25e67c05ceb549e93130e61bc6f2c8d5077
SHA512 1bafca1b263272a2f890bc8f787671381e394e73d081875a02759d171211afd1e9b2bc5c6f081709b16d87900622dcec55892c8d35e6ab8ac3364947d5d7ac49
SSDEEP 49152:zvPvE2H5aweBHPbl6T/yGaqA6/7kRJ6HbR3LoGdTITHHB72eh2NT:zvHE2H5aweBHPbl6T/DaqA6/7kRJ6Z
TLSH
T1DAE56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.11.41:51879
192.168.11.41:65338
128.116.53.33:52610
192.168.11.41:2177
192.168.11.41:137

Mutex

aa4a2ba4-5541-49d5-938d-dcc66534489c

Attributes

encryption_key
B0269B148C1775F4FBC2A4C271087C43E0AC4A02
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
RtkAudUService32
subdirectory
tr-TN

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/5920-0-0x00000000003D0000-0x00000000006F4000-memory.dmp	family_quasar
behavioral1/files/0x000700000002459c-4.dat	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
5700	Client.exe
3448	Client.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
192	raw.githubusercontent.com
190	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\tr-TN\Client.exe	4.exe
File opened for modification	C:\Windows\system32\tr-TN\Client.exe	4.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4144	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343958901707719"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4264	schtasks.exe
1688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
1804	chrome.exe
1804	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5920	4.exe
Token: SeDebugPrivilege	5700	Client.exe
Token: SeDebugPrivilege	3448	Client.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
5700	Client.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe

Suspicious use of SendNotifyMessage 35 IoCs

pid	Process
5700	Client.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe
2364	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5700	Client.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5920 wrote to memory of 4264	5920	4.exe	84
PID 5920 wrote to memory of 5700	5920	4.exe	86
PID 5700 wrote to memory of 1688	5700	Client.exe	89
PID 2364 wrote to memory of 2028	2364	chrome.exe	97
PID 2364 wrote to memory of 5572	2364	chrome.exe	98
PID 2364 wrote to memory of 5572	2364	chrome.exe	98
PID 2364 wrote to memory of 4144	2364	chrome.exe	99
PID 2364 wrote to memory of 5812	2364	chrome.exe	100
PID 2364 wrote to memory of 5812	2364	chrome.exe	100
PID 2364 wrote to memory of 1144	2364	chrome.exe	102
PID 2364 wrote to memory of 1144	2364	chrome.exe	102
PID 2364 wrote to memory of 4172	2364	chrome.exe	103
PID 2364 wrote to memory of 4172	2364	chrome.exe	103
PID 2364 wrote to memory of 1744	2364	chrome.exe	104
PID 2364 wrote to memory of 1744	2364	chrome.exe	104
PID 2364 wrote to memory of 2976	2364	chrome.exe	106
PID 2364 wrote to memory of 2976	2364	chrome.exe	106
PID 2364 wrote to memory of 928	2364	chrome.exe	109
PID 2364 wrote to memory of 2732	2364	chrome.exe	118
PID 2364 wrote to memory of 2732	2364	chrome.exe	118
PID 2364 wrote to memory of 1280	2364	chrome.exe	119
PID 2364 wrote to memory of 1280	2364	chrome.exe	119
PID 2364 wrote to memory of 2864	2364	chrome.exe	121
PID 2364 wrote to memory of 2864	2364	chrome.exe	121
PID 2364 wrote to memory of 4148	2364	chrome.exe	123
PID 2364 wrote to memory of 3784	2364	chrome.exe	124
PID 2364 wrote to memory of 3460	2364	chrome.exe	125
PID 2364 wrote to memory of 4484	2364	chrome.exe	126
PID 2364 wrote to memory of 4484	2364	chrome.exe	126
PID 2364 wrote to memory of 5788	2364	chrome.exe	127
PID 2364 wrote to memory of 5788	2364	chrome.exe	127
PID 2364 wrote to memory of 2764	2364	chrome.exe	135
PID 2364 wrote to memory of 1804	2364	chrome.exe	137
PID 2364 wrote to memory of 4108	2364	chrome.exe	139
PID 2364 wrote to memory of 5852	2364	chrome.exe	146
PID 2364 wrote to memory of 5852	2364	chrome.exe	146
PID 2364 wrote to memory of 5388	2364	chrome.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RtkAudUService32" /sc ONLOGON /tr "C:\Windows\system32\tr-TN\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4264
- C:\Windows\system32\tr-TN\Client.exe
  "C:\Windows\system32\tr-TN\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "RtkAudUService32" /sc ONLOGON /tr "C:\Windows\system32\tr-TN\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1688

C:\Windows\system32\tr-TN\Client.exe
C:\Windows\system32\tr-TN\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa407ec728,0x7ffa407ec734,0x7ffa407ec740
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,1224588720562592093,12993314169824801525,262144 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,15396093545856740576,5176088616294968893,524288 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,1307272278001061202,18421990377751968384,524288 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3088,i,4246140857627734741,5793007749149420460,2097152 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,9837891117812746408,6985153518350488759,2097152 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,808392912463407051,6741743526776633189,2097152 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,18091659340612591794,8107201836421196266,2097152 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,15517317128808069556,1723234397613446282,524288 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5940,i,15975219476383943245,17573555625414003869,2097152 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3372,i,1612922856524424967,11120612654117132110,2097152 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5992,i,951735085041249931,15595143942838044619,2097152 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,8369648018506512509,16460300890542239657,524288 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,12226303403494505001,8553490150713638182,524288 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3332 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3352,i,2214848990794691968,15278320676291944584,524288 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3364,i,3916168484514927993,11794723104010353969,2097152 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4780,i,7165504590156845380,12021688120138427025,2097152 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3404,i,11916901742156147869,7423164737463383816,524288 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6132,i,16372799508496048133,8762989223922879497,262144 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,5418441419428913157,4013078167051737978,524288 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1272,i,13510593628036254501,13562534325712228851,524288 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3308 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,15130182775923809177,8386674942234086824,524288 --field-trial-handle=1920,i,5034701248165393391,10738609944441264219,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1128 /prefetch:8
  2⤵
  PID:5388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 cc9f214818a83da0dedfd3907f3569fbcd8ac083185d706a8f22b7319a2cf3ae
MD5 c574c6ed3794d82d373d4d6d19d712b8
SHA1 65906ba711099091e3f6fc44f1a92bfd2ee30f6b
SHA512 04a6524e55c3743932d948b3defc489748ed54f90e0e7fadc8afcdc4d92f9df4debb196672b559bb15ee57f9be977cf2bc83b14682b49a8683b39aa48434cdf8
TLSH
T173F02DB5D921FC7B18FD1B2D10649F47E755135B3640845F3A3D420D8FB5A3B459581C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 434KB
SHA256 5bb71d8a0a9a495e906a9f0900959afebe5b965d0b859faefed720ce82714866
MD5 89d1fd278e1087460a0038d763caf03d
SHA1 a808ef32f98f87647bf0005e3d05786baea61432
SHA512 99e8fdee6fd946f72ce8e82c59da0abc301e6cca3c2162630c548a42f83ae69857cdbfbdd6db58dd0cd173e9bcf940d48093a3a9887f212d3147fd4718cebf9d
SSDEEP 12288:jojYY6WzJdySaeystHnEux6483s68ogQRePlF:joj6WOSaeystHEuY488viev
TLSH
T1A09423E9268F196474D6759FD2901AACED70702332F82FC304A6278AF53DDB35F8491A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 84KB
SHA256 7a3632460da5edb23e591f6967ff02ca67bcbd22b00edaf8a7b5c3dd75d46d61
MD5 343b8baacbdeacf4b3a2f4d16a169b35
SHA1 e9f4a0eb2d1069ace59620b69243766fbc1d5bfb
SHA512 19fd3f5b8f9e2bfc2f7066b467b70ad4648019ac20aa4502785c9df851420e0f324d0d4d2894c90643ee8bc2921be46a63c2becbe4e4dff22b16b6a257b57b59
SSDEEP 1536:KZ9mREHZNqrmu6ZKIUNS4eHLcy/N4LzwxBe69U2SKZwfH:u0RE5NSmu6BU8prcmS+c6O2/Zwv
TLSH
T1B6831279B89DD350B1EEF4F720AA87E1C1444E3E5026E345137A2FD346862277D5CB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 7afe1e26ee8646a2ddf01962558e671f758a228e6455343c88a86efb0118558c
MD5 7e126213518761d95fec4b4924635535
SHA1 636eea3972a0c7f9a8d93b7d4071b477f1ec235c
SHA512 bc1d1d75bb5688e65a47792cc74f814f687cea714517bd2e6425c8f91f2c9646505092bbcf163e81ab1cdc75a5db6beadffc8127fadb04ef19b67b5cee0878ff
SSDEEP 96:Kvv4kqIVY/rrbzq2OdoCfRA5MC+qkBw0Q:0tUrXq2Od7Z1CzT
TLSH
T1FB813DDD8BC2027CEB953BB228D1C5217EB0873CAE231E4CD18388792DA1BB104BDC18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 02fac00747d77117d152a9de6f477198297160124c3f1daf9e1795dc9ba8be22
MD5 46f10963e49448c1db2eb4bc5938d4ba
SHA1 88152f849c20a59a29910f86c0b259394cc2323c
SHA512 618f3968d276002babb9a649e231985ece162e89af949f982223bc2b33b1c3def532e646027c0ee8e9a78c229dbfe3934d9388344e80b363d5f67911caa1649f
SSDEEP 3:MsEllllkEthXllkl2zECll3wplt:/M/xT02zhU
TLSH
T11544044C7FC31705C50030304051C7F003F0DD145D135743355554175CC5DD00C0101C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 58e303e0c5dbfc47df798854403a9f6291c87089ed83c998dd13902e377335bc
MD5 9384696542c940fc8e2675e91560b784
SHA1 4c2b483e9b6d83b89796c0af47ba1cc746547c64
SHA512 756758c49e8be1dafcd19e7af05b61ec0361168bda9305916b5e8a00da3b597791b5edf553267e373e7bc9da4e512988c387f917ad9cef6a877bae521b983e4a
SSDEEP 192:DilY84nhpUJeJJmbHDCNapGcGP1naP9uU7AovTSfPrAIlBIgVInrI3K37GNPrFBC:DilY84nhpUJeJJmbHDCNapGcGP1naFuQ
TLSH
T1A732E0F7C3E9C62DC90155F4AB196F1ECE2A0A24432C3C67C8D5EE5B93E2871D251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 40257e15a626f9ebe1640fe621589807477ef09ec6c0b9267ce8819700eb2957
MD5 02ceff4acc95f90734b19893e92f93d7
SHA1 06984cf5e075de6ef0faf7fd90f7627596766b1c
SHA512 3fc81ec57065591b3434f4421a568e4dfd657d8086af9711a03ba4311a0832034775102e15f5904d0df90b9ea892e6723b4d0e64d91c03944778299b679aa592
SSDEEP 192:DilY84nhpUJeJJmTCNapGcGP1naP9zoU7AovTSfPrAIlBIgVInrI3K37GNPrFBoL:DilY84nhpUJeJJmTCNapGcGP1naFzoUP
TLSH
T11312CEF7C3D9C62DC94156F49B15AF1ECE2A0A24432C3C26C8E9EE5B93E2871D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 3f17165aa8d410bc11bcac07ea7e72738ac520c25c3a9d46d0287766499b44f5
MD5 ba627628fb99f13394709baa3dd57c97
SHA1 bc1786bd126721cad5243ba2e7cc3e09ff17cb0e
SHA512 74dc50d3a15380008879b349175508916857f2c562e226a882807a801e24dd786d3aad3321768bffdddda02de01f5235cbed92b33a400ef5e1ef35bec8b84e27
TLSH
T190317BA38AB97567506E59A71D00BC0929BDAC3511637CF1CF97C27CB0855F74B12063
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ae12623eef0690d0a7153e332634d3fed1b9c9389a7dfdbf3027396230ae2c9f
MD5 25d9bad41395cadbdc06d013733b52bb
SHA1 3247f63b501f8a0695a48f5cb80d3a38f0737c18
SHA512 978daf22ed13ef6f3b37c8f56dcae9bec6293b0490bbf76cedd5a4e43066ffc74f6a268345c6719fdb2b204ce50e017d10cdf324a92c7b8a3d2592421e5ee32f
SSDEEP 192:4RdwcBhltQkHCXTRv7GhAPRp2DR1996Hsb+WNn5/4VTe+eCe1qX8VyIsnAUgraJ:4RdwmhlOBC8XW9swlKe+FIe
TLSH
T16D52B52EB9107A3B5CDBD369FA617B57D3F6102624942E84E6FC893C10E7ACC261B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b16781321d8dd10290d69de87cf5e93759783e2976b4db81020eb348728a80d1
MD5 de254d686bc1503966f93b149ce61853
SHA1 144f05a7b5e65f9846c880e8d933daa2cc9aa764
SHA512 8b9f573795b3b7418cc4b648d70ebd50235aea98ce33a0febb1bbb1f893b618c23a9f52fb9a3a617d581b3fc8af8310ae9efcd0376b07d46b12f0bdb4ff5f62d
SSDEEP 192:4RdYltQkHCXTpv7GhAPRp2C96Hsb+WNn5/0weCe1qXcVyIsnAUgtaJ:4RdYlOpC8Xtswl0wFo8
TLSH
T1D442B52EBD10753B5CD7D36AFA617B53D3F6102624942E84EAF8893C11E7ADC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 196a3dd9419c93eaa2a4142b0e316b8bf3f624a00229515813de91e89fca5420
MD5 742113fed0eeb72b4097bed6f41f8758
SHA1 6cff68034a071034463363e5b31b1d8fe8cad614
SHA512 7654d92433b198d73719769cda6936eb82cb06fe9cca6df8660916d5e03e93ed9f47ea9ffed773562e35f424a5eb71f678c09ba76134e6ccf9b87b0ddf21c5bc
SSDEEP 192:4RdwcBzltQkHCXTpv7GhAPRp2DtX96Hsb+WNn5/4qA2JeCe1qXcVyIsnAUgtaJ:4RdwmzlOpC8Xoswle2JFo8
TLSH
T19042B52EBD10763B4CD7D36AFA617B57D3F6102624982E84E6F8893C10E7ADC261B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b84a9d3046e0984b5d882b07fa0f0a5c1c81901465e65879d19c99ef1221849b
MD5 f8b1bd0e351e8d240b344f1bc80b9ef8
SHA1 cc2291b500444909a48bf57f2a81c43b4572b83d
SHA512 aff340973532764466c2154cf31e4eeb905a42da9706aedc5b06da04810bd204b285e73274b2992b67d75c92d839f8a92196c2f26e7ca81d974fd8f9481701a1
SSDEEP 192:4RdwcBhzpQkHCXT2v7Gh7PRpXZB0Qb96Hsb+WNdm5/v5ac/FzYpeCe1qXmVyIsnB:4RdwmhzCCClXDswykGYpFOe
TLSH
T1C662A52EB9102A7B9CD7D269F951BB16D3F1202624D42E84E6FD8D3C10E7ADC261B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c30a251473bbf5998e459e7782acd6af816b37dee5d2d55f352587dda2e973c7
MD5 1b775cfd48685ec6105267cdd4d732c8
SHA1 20885a5c196cfa4be81e7aec31b19ba40e7e0a05
SHA512 c56e42cff3c3d707c4291bbf5176c27d7e3d473ccc2b1cd0dee4fe252421a3da98696cccb4369e9f527cff85e069704b511a4593ccf6ee8897c1c2eacdde0d82
SSDEEP 192:4RdwcBhltQkHCXTVv7GhAPRp2Dob96Hsb+WNn5/4FzY2eCe1qX8VyIsnAUgraJ:4RdwmhlOlC8X/swluY2FIe
TLSH
T13852B52EB9107A3B5CD7D36AFA617B57D3F6102624942E84E6FC893C11E7ACC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2d6865ae3135592b7be98ae2710c35a633c4cf1355ed44f29819f470f5f021bf
MD5 56f7e186f6035c026061a71ac2f55b91
SHA1 280b99b552055f41a6fabbb9ddfc7f92a3394f5b
SHA512 ab3ca30348a99a7b57dc4a70a03b69d734f4c382c28448aa10ce8f9db87970ba267e3ddd4d87e567e14168ca35afa7b3c02a996509141a470607769e6808c0d0
SSDEEP 192:4RdwcBhcpQkHCXT2v7Gh7PRpXZB0Qb96Hsb+WNdm5/vdSMFzYVeCe1qXmVyIsnAq:4RdwmhcCCClXDswy0aYVFOe
TLSH
T18662A52EB9102A7B9CD7D269F951BB57D3F1202624D42E84EAFC8D3C10E7ADC261B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 72d372ffed4fb0f2b64dac95fabd0e9ac90f964dc1c67022f9a0192d747729fe
MD5 5ba59929f71ca664a07e38de48e43243
SHA1 adbdbf16141c6285c343cad03351bce9635dc9a2
SHA512 1c39b64d83cb1741bad0ac17119ead6f905d5309523d3918969acf8a8435c8667b6d8fff8c0004282a95a6397984a9bda96567c196e9042f23908845345ec6da
SSDEEP 192:4RdwcBhlpQkHCXT2v7Gh7PRpXZB0Qb96Hsb+WNdm5/vqon+FzY59eCe1qXmVyIsB:4RdwmhlCCClXDswyiG8Y59FOe
TLSH
T14B52A52EB9103A7B5CD7D369F951BB57D3F2202624942E84EAFC893C10E7ADC261B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b7e6f37eda856172f101d046a65605ac50b6ae55a9706b942f027787de43f25d
MD5 8388ea8391a07f877b33228be82a1149
SHA1 862517afe3da35daecaca7be4c218394cac67401
SHA512 4edb24f61cc96a66ff6ee262f1815d984e839737b0da9f8bf8fb18bdd32247d14e9ef3dba50d9bfa01f5fc183012aca1b3b0cca2f2e2c89b8ff645dc778ac875
SSDEEP 192:4RdwcBh1pQkHCXT2v7Gh7PRpXZB0Qb96Hsb+WNdm5/v0y+FzYqeCe1qXmVyIsnAq:4Rdwmh1CCClXDswyz8YqFOe
TLSH
T1D252B52EB9103A7B5CD7D369F951BB17D3F2202624942E84EAFC893C11E7ADC261B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4e6c20cef442244750b1c99528c68035fd2d790737ffd6b0a16cde602a8155b9
MD5 5adbd0c152237e34eab2d475e1c91829
SHA1 da47d525f719f543d78ee255313254c61990fb6a
SHA512 253635e52c1377b171b7f2c1bfba574b31e2f648df1cf5b6bfd9d4305bfaa128b8b9d7af591a2b29e9d3f4ac64f7cf33907fe6a6cc0fff71967507b6dd43969e
TLSH
T1FBB01205A0412301C00503B01558905836A48F3CD112178659E01D818835571A017148
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595903.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595903.TMP
Size 96B
SHA256 ffef976292f12134df564a03b096a7e40b846593adc770f9d306aff15e12c201
MD5 5b9bc39b5f0d553cd610fa3c677860c9
SHA1 363714c223a9e0cf9fc5cd6ad40f5171a92bf4a7
SHA512 59f3ea2bf386d06767e44c88353480abff17783e98b0c5898f165a2acaa9d03290b303a97a7c74ba2f75423d88e13a795abac2d1223d27c7fb1e70664a97f033
TLSH
T1EFB00255C542B213D04203B025E595DC7560EF3AC607261292E09A76ED6667155356B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 cd3d57d586c4cb01af2b43617007309fa5a96d52fec103e67ee1fadb0e152e04
MD5 4d97d5530c7ab8b4392bb5258a2ad616
SHA1 6bef43700ace9986db7fb936c8545b04d2acb3bd
SHA512 9acc3f2ab111b6f26501e1a263c2b6d5ac494f0deca4dfb1a9e29ac7a75f54a8c25f61f3470a13fef869ce1fcda1b027900f8bd7eb2ca7ba7b5c22f20c5ef92b
TLSH
T14DB022F000032C03CB030BF222E0028033B3BEB02F838C0B02E00020C080BC003AB083
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 186a4e5c6aad087fbe119a2af6a6d7b1c6ad51afc3b9af5a028540d9e9e0cea7
MD5 85ad300dabb5eedecbec8b48b65630c3
SHA1 1829fa04b839a7a12c8aeb1534d9081712f0da92
SHA512 5134201f3380aa6bd3b5357c5538bcd8d916a577206b663e0ca44aa301f11e71db63b15fa174228c4a5b343a08871828cc8aa49ad1f930627c56dc401d8b06e5
SSDEEP 6144:tuMcnNmiwZK2V5L2LhSdY+hFD+7t56OD9ZfSAppro:EMcQipeVNeyFSXD9ZfS4u
TLSH
T1C24412373AD2DCAB4CBC5148F151D300CDB299E240A76E674A8A5FCDE29F64D0B92D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 4686de07f4eabcc0972b74aa75c12214a9ac7f0368841da6929f815dcb69ec86
MD5 213b4355b2dc1f4ee0accf53f87fc0d1
SHA1 e436aa0a60659fc574baa1be1eec0d31af7d63e1
SHA512 8dab044a44932ffb844ab7a482a894e483ff292705774940a288861bd61177c206df61a65aa2c78c3b1bf73938f187ec60207aab3c795dbdff0e7e70b6375a0d
SSDEEP 3072:UH+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UH+hFD+7t56OD9ZfSApprB
TLSH
T1CAD31232AA91D8BBC9BC6141B157A300DD76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 b78793532f46f6c8a228323c5b78964474116a0f07d926a3a0b435fef98e848d
MD5 b6ab0008842dbed0f2ef35f5374d865f
SHA1 5be3b7de59d43448cb8925d0a0de162c3113b4e4
SHA512 921027b0a695291a57a8bca4763839b681d0ce28f51ed154981448c95b4571989a0c6ef8a35d4b7985d8b8f5f3c1e0dbb5bc86af0ff69be4335158ccce874057
SSDEEP 6144:EjMcnNmiwZK2V5L2LhSdY+hFD+7t56OD9ZfSAppro:sMcQipeVNeyFSXD9ZfS4u
TLSH
T1C74412173ED2DC6B8CBC5148F195E301DD629CE100A72EB3468A5FCEE19B65D0792D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 3100d65937708a266ea5c2a4de2fd7fc4cde78d39643ab3fcff869dd2544c8d8
MD5 c6641fdf62ff8a04c1aad44a889dee6a
SHA1 cdf4364da9cfb0dd7a1fb2fc55df47fe73a27abe
SHA512 00371a1c27870784078aa99264f4c8708ac976073ea56c8ba2bcb0d6033f1798a2857afeef12dae998cdc8e4ddb1d0a38ca5022bdd4b4f058f713a4bc6885a76
SSDEEP 6144:t+McnNmiwZK2V5L2LhSdY+hFD+7t56OD9ZfSAppro:gMcQipeVNeyFSXD9ZfS4u
TLSH
T14B4412373AD2DCAB4CBC5148F151D300CDB29DE340A76D674A8A5ECDE29F64D0B62D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 ff6f81022071db8636ee6f9f7d9d0cf669eac850eec057233781ec4586e84010
MD5 cef271bddd0873c9c5160454b6a11851
SHA1 2408809df2882c822e99f55478c3410a398d4073
SHA512 acfd1dbadc5bbf5bda9280392da5257ac063f05dd82f997bb37fcdf7981ee718367c819bae0a7d8f7b4b2518b29c53063739eeb29b007acd534ed3447159a418
SSDEEP 6144:9jMcnNmiwZK2V5L2LhSdY+hFD+7t56OD9ZfSAppro:5McQipeVNeyFSXD9ZfS4u
TLSH
T1844412173ED2DC6B8CBC5148F195E301DD629CE100A72EB3468A5FCEE19B65D0792D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 0a4831185c705b70614d98a03b91d60ef36649b85c275550dab82371c74c1cd5
MD5 b47614dad88c636242fbec9073bdea8b
SHA1 f53a0fcd50d064e71ec99dcf56c5b88feab46ffa
SHA512 0656ea06eecfd5402908e609420448afdf8ca57f2a9f9a6cab385c64e95f5d63d369ba54ac800f9d1dd10073b95cb65a30ef31adc73a2c1db8bacbfa2310ebbf
SSDEEP 6144:9+McnNmiwZK2V5L2LhSdY+hFD+7t56OD9ZfSAppro:wMcQipeVNeyFSXD9ZfS4u
TLSH
T1824412373AD2DCAB4CBC5144F151E300CDB2ADE340A76D67468A5ECDE29F64D0B62D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32-256-zipped.zip

Path C:\Users\Admin\Downloads\32-256-zipped.zip
Size 250KB
SHA256 dbbfc2e4ff312cc2a699fb34a980e9efebd9bb8b768a221e6582953315211436
MD5 91608a46012480a4a3ed8a50dc2e3bb2
SHA1 3d9ab0b3b673a689fbe37e2ed1e03ecf2c76b79d
SHA512 24b64fc72119ce27bec773d8a3c900e5b43fa21eca1d35691e3c47ed0dbc9525b63d52a42523e8dcfc3ed83eb3d26ef5d5a90a8b286f0d328fd65f142af65cc1
SSDEEP 192:Srrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr8:SM
TLSH
T1DC44123697D00624A830827DC2FE3D91A2181EF1F90EDD167EE5710BFD9E19869A94CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32-256^7.zip

Path C:\Users\Admin\Downloads\32-256^7.zip
Size 265KB
SHA256 21a6f6a45ee9ed386e8a441699cfd482ee1ea1c04b5d54e9c764bd5b9f48715d
MD5 78bd28f13ea5b5a8812a1475b38530db
SHA1 62d640485744193fa638c0cbae7ff91e21861a5c
SHA512 366e755be8501501f30fe6a2cd247ef6f23f845962c334d0797cc09dfb5028671057d05517aff4ecbeced8d1dd7d9a2feee64e7d8da8d17fb26ba6f48e50c5e6
SSDEEP 192:irrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrn:VBX7JbxL3PgK+
TLSH
T15C4423625BC466259834467CEAFE3C6562651CF2F91CCC037EE8320BFC9E24666A54CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64x4096-Z.zip

Path C:\Users\Admin\Downloads\64x4096-Z.zip
Size 369KB
SHA256 003d8875ba3cf813d7bc96143ec50aca33a802b61cce073d4161ad8f49719df0
MD5 7ab3b1d10737441b9c292fb0c20f29f0
SHA1 9cf965256a238f174cf8242c59e5e87889988173
SHA512 99b4d93703a4013af8949e57a62177c54d692c35f89b422da5e6ba1cc281b37fb064e3e70fb93648b3a9e73ba589b84d408479edee8f9e39bfd57e33991c7f6c
SSDEEP 384:o6SyT7CxXuxk/zblNBLsyFTU69bRU695EYAaiWra92hb/ouxus6/ouxV/zblNBu4:oqT7St3k
TLSH
T1A784CD58B1679C2BF73A85BB74286BF153A82024FF041E121F6071D54A9EF3E7C5AC91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.exe

Path C:\Windows\System32\tr-TN\Client.exe
Size 3.1MB
SHA256 c67ba858dfa5feab71d851b5ee432a4c7817c9c66d733e0cfdac7cb17c79ebf5
MD5 bf3fb951008074d01477b7d1f22811a0
SHA1 0078b25e67c05ceb549e93130e61bc6f2c8d5077
SHA512 1bafca1b263272a2f890bc8f787671381e394e73d081875a02759d171211afd1e9b2bc5c6f081709b16d87900622dcec55892c8d35e6ab8ac3364947d5d7ac49
SSDEEP 49152:zvPvE2H5aweBHPbl6T/yGaqA6/7kRJ6HbR3LoGdTITHHB72eh2NT:zvHE2H5aweBHPbl6T/DaqA6/7kRJ6Z
TLSH
T1DAE56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5700-46-0x000000001F080000-0x000000001F5A8000-memory.dmp

Download

memory/5700-11-0x000000001E990000-0x000000001EA42000-memory.dmp

Download

memory/5700-10-0x000000001E880000-0x000000001E8D0000-memory.dmp

Download

memory/5700-7-0x0000000002F90000-0x0000000002FA0000-memory.dmp

Download

memory/5700-53-0x0000000002F90000-0x0000000002FA0000-memory.dmp

Download

memory/5920-0-0x00000000003D0000-0x00000000006F4000-memory.dmp

Download

memory/5920-1-0x0000000002750000-0x0000000002760000-memory.dmp

Download