7df66d12acf1ffe806a632bc73cfaf48085383bb18eaf35dd0c3aab861552bde

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
schema_arduino_led_bouton.pdsprj.LYC-LORITZ.itamine.xml
Size 1KB
Sample260924-hv7ehs1tf1
SHA256 7df66d12acf1ffe806a632bc73cfaf48085383bb18eaf35dd0c3aab861552bde
MD5 1d4e126c3aef2c8b5503709526697132
SHA1 3111d8bfd1166e792e0e8b306f38e793cf47343e
SHA512 3a66174b537b1ea86ca7bed784362e69ab8214b27fa383fea0a43ec40dcbed0390b89cd0289343eba96dfd7d8f3bd351e3632c77530b5d4d51dd48e5c8f0c6ef
TLSH
T10B217C02C4D69E0AD12140A661F2FD9DB311F2E325DBE940B0CAF8B359720A14EC76B8
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2744	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31280115"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8016a6a6fb4bdd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b295b843b8043e4c891ba263e4e2576000000000020000000000106600000001000020000000e871a9894dd13f1f67dfd9cfd179bca5351d42464abfb6061f81e234cf9ebddc000000000e8000000002000020000000f5039f6add1f126fb54850ebbd9c6efc7916b3d335f720baade5050ed5060ae020000000b566babbdcbcf0a1ed3cacb9ff21ab1555d5d33f93fa84dd8e94f93dd114e26e400000003e8550d791f131c5c2983d07e72a4c3a77320612a809517722ee81919343b28ceb45cd876b7080b0cfca98f55337688cece6a2c0d0d9f2bfc2549c5e9af62398	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1140307652"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804bb2a6fb4bdd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6F4D72A8-B7E6-11F1-86D4-768FA1516246} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1147628937"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b295b843b8043e4c891ba263e4e2576000000000020000000000106600000001000020000000ea397a8e75c9ad4e3d7cb8785182601482854478c4f4322ac0a704eb8fa13424000000000e8000000002000020000000cf36bc2b215628817b8c59ebad9f30a6a4a55483411df069f1a91f7a1e54444920000000289135818a03869946afd7efeea355915d8b54a55d067897047cb76fddee68db4000000075a05c5966538cf3337c3b889a280b28c4b3b3ade48af5efb5b3fe5381580cabdd6d812cffcb8ea67c6b4e5b0f4bf97d5d932ceedeb42a47ca8b93550eb9e282	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31280115"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "496998551"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347071915113892"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
5824	chrome.exe
5824	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe
Token: SeShutdownPrivilege	2504	chrome.exe
Token: SeCreatePagefilePrivilege	2504	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5096	iexplore.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe
2504	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5096	iexplore.exe
5096	iexplore.exe
4580	IEXPLORE.EXE
4580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 5096	4112	MSOXMLED.EXE	87
PID 5096 wrote to memory of 4580	5096	iexplore.exe	92
PID 2504 wrote to memory of 2180	2504	chrome.exe	102
PID 2504 wrote to memory of 1136	2504	chrome.exe	103
PID 2504 wrote to memory of 1136	2504	chrome.exe	103
PID 2504 wrote to memory of 2744	2504	chrome.exe	104
PID 2504 wrote to memory of 872	2504	chrome.exe	105
PID 2504 wrote to memory of 872	2504	chrome.exe	105
PID 2504 wrote to memory of 3004	2504	chrome.exe	107
PID 2504 wrote to memory of 4916	2504	chrome.exe	108
PID 2504 wrote to memory of 3004	2504	chrome.exe	107
PID 2504 wrote to memory of 4916	2504	chrome.exe	108
PID 2504 wrote to memory of 4260	2504	chrome.exe	110
PID 2504 wrote to memory of 4260	2504	chrome.exe	110
PID 2504 wrote to memory of 2364	2504	chrome.exe	111
PID 2504 wrote to memory of 2364	2504	chrome.exe	111
PID 2504 wrote to memory of 3508	2504	chrome.exe	112
PID 2504 wrote to memory of 3524	2504	chrome.exe	114
PID 2504 wrote to memory of 3524	2504	chrome.exe	114
PID 2504 wrote to memory of 4164	2504	chrome.exe	116
PID 2504 wrote to memory of 4164	2504	chrome.exe	116
PID 2504 wrote to memory of 624	2504	chrome.exe	117
PID 2504 wrote to memory of 624	2504	chrome.exe	117
PID 2504 wrote to memory of 4604	2504	chrome.exe	118
PID 2504 wrote to memory of 4604	2504	chrome.exe	118
PID 2504 wrote to memory of 3068	2504	chrome.exe	119
PID 2504 wrote to memory of 3068	2504	chrome.exe	119
PID 2504 wrote to memory of 2396	2504	chrome.exe	120
PID 2504 wrote to memory of 2396	2504	chrome.exe	120
PID 2504 wrote to memory of 2400	2504	chrome.exe	122
PID 2504 wrote to memory of 2400	2504	chrome.exe	122
PID 2504 wrote to memory of 5328	2504	chrome.exe	129
PID 2504 wrote to memory of 5336	2504	chrome.exe	130
PID 2504 wrote to memory of 5344	2504	chrome.exe	131
PID 2504 wrote to memory of 5796	2504	chrome.exe	133
PID 2504 wrote to memory of 5796	2504	chrome.exe	133
PID 2504 wrote to memory of 6052	2504	chrome.exe	134
PID 2504 wrote to memory of 6052	2504	chrome.exe	134
PID 2504 wrote to memory of 5192	2504	chrome.exe	135
PID 2504 wrote to memory of 5192	2504	chrome.exe	135
PID 2504 wrote to memory of 5380	2504	chrome.exe	136
PID 2504 wrote to memory of 5380	2504	chrome.exe	136
PID 2504 wrote to memory of 1140	2504	chrome.exe	137
PID 2504 wrote to memory of 1140	2504	chrome.exe	137
PID 2504 wrote to memory of 5824	2504	chrome.exe	141

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\schema_arduino_led_bouton.pdsprj.LYC-LORITZ.itamine.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\schema_arduino_led_bouton.pdsprj.LYC-LORITZ.itamine.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5096 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb83ffc728,0x7ffb83ffc734,0x7ffb83ffc740
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,13172237185673431782,15304276999680175698,262144 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,17969418746587634102,9805379024599844473,524288 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,10083979251738081651,2580166600359674288,524288 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,16466443223998734908,18400107325248571667,2097152 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3396,i,15596770817452856685,5510509157665291030,2097152 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4536,i,6803240862979299232,15403167499719974455,524288 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,9290543294396336108,1132772366039621685,2097152 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,9893427505497575107,6119065580280181246,524288 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,11476679853934299319,18084126883006340114,524288 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,13295311128730696419,16388701269267308068,524288 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,7058539156688188044,11978720462400761512,524288 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5876,i,10111848098875133925,13910756555867752702,2097152 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5416,i,5552159309577159894,1780193673811649056,2097152 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5936 /prefetch:2
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5804,i,2776231944268764709,3187251756779077996,2097152 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6140,i,15847632020108874418,3969065057958908802,2097152 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,14218377071240321907,3041298825975895381,524288 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,2249482815053301037,12105411159639903501,524288 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,13174040534764731601,1007997711740755923,524288 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5816,i,10229435056686799894,1407605728023164188,2097152 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3612,i,9545629422150761378,10533289368507423192,2097152 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3100,i,5480843628232563415,12782338291355367870,2097152 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6360,i,12704430896908560869,6655402986413033383,2097152 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6700,i,16746077825100538003,12589331166297421872,2097152 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6304,i,11488840769184653010,12826212053572401179,262144 --field-trial-handle=1900,i,14910063097501452668,2960582091983454939,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5824

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 08511289c08287b60d3de6815e0cdcfd976b76b4ed1fe052982d80b6c9cc3acf
MD5 1b3bf1878b48e342615e88278c16912b
SHA1 c03506a3fb6436b214e1adf8334537e30c16e9d6
SHA512 0738abcb2be78e40a86a93c99dc4468279496d66d2351d02a564eb5d97c7b65e1aa01ac5562971f4fbbe65d56087e56b83b10335b5f724eedc942a429b2160af
TLSH
T1B0F0D414567C9D71399098DC27E816BF34B2E17F10451415B17945E40164FBADB1D035
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 434b4bfa8343b45e16a4b51a20e845a1cc3f341e8bf15f3d25b01f747f758538
MD5 567fbe1b0cc55fdc82521ad378d33b62
SHA1 ecc64fa08d5c5b894c9c3606930f370ffbe849d3
SHA512 02b413d580c8fc1980a4db617008e39c716c3fc8420808a2a3a2cbb4a7d16c3d1986ec9d30dcaff314c25acbf9b2566bc79583597e4d2b499a67e963048feec6
TLSH
T18BE0C03416F6411FF0F6F4784BD9B521865DF026142993B82EC4EB08F706A00AC12925
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f14e0d2aba6b38729c34d7d10ba1cff81d4aa10c0342f7a62b2b799817bcf538
MD5 c3fa984bc6dc80e1af2d8c0ec83a2940
SHA1 fa335e2cd9a3c8da107908055832ae8c06749900
SHA512 bf403e526ade900a112a25ee13520698ab00d914166c3b4e2d3bdcf8071d76aa1d9f252be4488811f502876c4665a6d7cf3dbffcbf1e253f836c0fe3f9001307
TLSH
T173F049B5CC30EC3718FD1B2820604B07EB9013272681454F3A3C910D8FB563B468681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 436KB
SHA256 2437d2dfbd109188146b46d079d6cbd7f3eae36f78324852e973c60b30ea8244
MD5 3ec6cf0ca8773d19aa57f49c7e0f5ef3
SHA1 5ae20e05b9d89556ef3b40cb018007ce9e1ce903
SHA512 04934a7f6916b083a416491c0ed74ba230a18158592a43436436cb1c05508a615c43ad998e98dc1d1b2a45e1f9795762dd5c139b8f8d72e8d07228ffdc67787c
SSDEEP 12288:jasW8vtgaHIkCoBvhFXbjrbJR3b6pjC7AGsJ:9HvZj5NjL6kTA
TLSH
T1899423DBEA02848A93207F9B61F6DF4D574F61E68CB484E3F31AD883A4FD35645E0285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d44ea9041f1454455e73e0bb7033ede30d259d4a5eaf1fb3f6836a216b72c460
MD5 9f7f6a15f1a506063e5d88921b85a051
SHA1 6b0233f69f3d725a4a521afcf513acfc04b4afa6
SHA512 3cf0d18c254966c9c530fdeebd0b211182e989cd651c7bd5fd9fc24c84b8da7955049af24a157efeb60ad131953c5bad64fb562c3f9a6192203d35f1bb15c814
TLSH
T14051EB0965EAA220EB5E347195D60D9CB33B0BBDADCFBD1D498A58333DA13BA0C0DC44
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 2ff8388bf38d6c4ba7e365301ecb02811c6fb2355cbb2fdf7938e38bc5846f2e
MD5 01fa825b50a6428565d902c21d60bcba
SHA1 0d4563086249a4474ba628dc3711738ed4d09708
SHA512 49ef1607d93a1a02292553f205793751dffd4ba7cb355d9a59a0b8cfa64b6c8add3abebb3326dd06e74a0a6df9b7dca67f20d98039d17e4459107eafa9986970
SSDEEP 384:DKLSV94GuZNJcJJSOHVecomPcoUYJvtCadI9IsI2I6l7P7yN627fDeAtNAXmCivm:Qa5uOXJjTU/GQ
TLSH
T1FA729FFBC3E4962D892156F4AB166E1FCE1D0924532C3C2BC4D9AF5B93E2471E20264F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 38e6226f7845f546cd3226bbebcd1c11b075c325739f69a2d4ada3455dc107e0
MD5 586c43bda79a729786ee35317f3cbb4c
SHA1 6ae2d25fd92f44e3c6f4e93d8a91e11f3b8283dd
SHA512 752bdcfea54bb4474f084e459cd25dc10294f54129d57d14bcf43d83db2082523d392d2740988141b87cedd9bb38a1b5333da0874b70f38f93e4482176369dfc
SSDEEP 192:dRYwDBBv71vAPRp2Z9IHsb+WNn1y0mz2DrmkwPVyIsnAUge:dRYwVR56X62w00M2DiJe
TLSH
T13332B42DAD20753B9CDBD32AFA25BB53D7F5102271992E84EAF8893C54EB5CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7f50ae9394335be84766b0cae05ae263b4215649ce6cfe08f1faa20bcac5e63f
MD5 99ae9c18017456c63ca9af3a34e2329b
SHA1 01f7cf656e63ebfee7dcee5c9c91aa5f70202ed9
SHA512 7a5db2c8dbbbc62c7acceca984e75a7f132b7d0e348f44023f51595abc23f5d7f0649cc69cec9c4619652f125c0d2ee5311a043444f60eaa824cd41babcc0f07
SSDEEP 192:dRwcBzwDiBv71vAPRp2aoh9IHsb+WNn+rr5O2yz2DrmkwPVyIsnAUge:dRwmzw+R56Xw2wQs2w2DiJe
TLSH
T14F42B52EAD20753B9CDBD32AF925BB57D7F5102261992E84EAF8893C14EB5CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e6278b7ef08f3e8c4f146b076d763eec0317bbc35674299e3fd7cc7aea2fc4e3
MD5 dcab8c0a53f28eda4f675fb0e2e9e16a
SHA1 99b7a963abb90a5d1b3af28f5d4970557d679859
SHA512 55a9cfbc54551a6242633a4f5b5c4d04666cc1a4af292d04236647f6073508fb6edc8d00751c03038b6ac2b28e15097243aa9c04a75ef6d253cff632468c35e5
SSDEEP 192:dRwcBhwDiBv71vAPRp2a5YJ9IHsb+WNtp+rrHqeUFz2DrmkwTVyIsnAUgE:dRwmhw+R56X+2wIOeUd2DiVE
TLSH
T12442A32EED20393B9CDBD36AF921BB57D7F5102261992E84E6F8893C14EB5CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5a09921ca37fd8d09908171c777fab8e69bb0301383efbac9f4009b444ddbb01
MD5 8190f9b3c3210344c02b3aa101afdb6a
SHA1 f395ea23837147d58a56e0e326d69b7a92dd2e48
SHA512 1a0dab965bfe612f496f766132f0b2d9d1c60834c187e3affc7ebbf4fe30c2d641ea4a406ca719abffe1b0bc4171b4a755d3b2b142a0552033d84aecbc224668
SSDEEP 192:dRwcBhwDi4v71vBsPRpSXa5YJ9IHsb+WNtp+rrHq/st2Hz2DrmkwHVyIsnAUgE:dRwmhw+k55OXSP2wIO42T2DiBE
TLSH
T1DE52932EAD20793B9CDBD26AF925BB57D7F5102261942E84E6FC893C14EB6CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 e3e8974bf163a89bf010f4dd0d461738e74f7afddd68ee877ae6c2fcf5d2ff86
MD5 e5b99b46464fac3080d3081501f9700f
SHA1 a94af22416c9248cbe88e649ea479724b9470d37
SHA512 51a7b40a6e6db50d1de654693627dd60ba2b2dc06d197bfe69d2c1ba2c70ce3f272bf8f8033d8db5c922a2ef009adf4b92ca7958b3e6506b112f2ded1fd42d68
SSDEEP 384:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLXODYj+ErU3ymHGoVt7ShzZl:cqY/7KxkXqKf/pUZNCgVLH2HfgsqTOEn
TLSH
T184520927684C9A3F0FD8CA4DDC16AF4FADF501576668092453FB9C18039A7CA214E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 9db548e15ce10325d722755c72fdef5471014d41c7ad4b7f44bda241793aa40c
MD5 20ae071cf43cbf3deb242582e9ccbb47
SHA1 96e932114c7e5047949318054a688ab812a47537
SHA512 55a517b8b3819bc8da62d235bc25fe5ec7a8d920f56a78e91104816b7a167a0ccf37533cebcbbee2207b1052950c55b16bc1a186ea3abd8add877ed459fea4fa
TLSH
T174A002A601C14217D1136A71D7C505C42360BA2403730A0594D000A4A8D0946410DE41
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 889244200318408c1fcf3010346944891c7d5e096a12f4d4c911aeb6839a46e8
MD5 93887cff3df73045b3632e2fa44879ed
SHA1 5b7ed32f8b2bca0fa585be702845b5829caf891a
SHA512 6f99888f2e9e5431fbb61db68c04f84977edacb741318756acf8ad05f33a5ed61ddb69a0f9e551a75cf8ee1afdc4c2687c117f897ea64fb167794c028ae4d3a7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 8fbd4fcb4fff11474b620b4207462c9028b1ee8a8373e2932819764b4366cbd1
MD5 531f2f91ac03448162b0d53e40eed16b
SHA1 cdd1609eb5526d23122979e74eb5679e26dd2e91
SHA512 b2df48ce995fdc481a16898446a2afdfeb2bdc2c37216ea2359ac939864faf1506c9f080e09ee5308fe5ec884f9f33d89fd1659460a9516c45ebb9019f7ef36c
TLSH
T1F2A0022491C2055ACD086BB0E76245A16692483D16524B0366A584859EAB2C4451EF00
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 508debf29b2a6f7159803c1351cf7a78d737daeaf4de4482db6d7a99bfabf159
MD5 cb007af8363963c92eef9960051fc426
SHA1 d4e337c2a1321f141922807d3cc759f381b1e9b2
SHA512 73a854fc188904491e6795beaa906829ac348e601ff95db2c35a231e603facdfc6c36a175f16ad77058e3d4e7db4e173d2dc9ceb77cc060dc8a68168a10e8fe4
SSDEEP 6144:MLvVjeoHzTsc8pfDh5V6aI9vhyI+hFD+7t56OD9ZfSApprB:MLtCMTs/pB6x0IyFSXD9ZfS4v
TLSH
T1984412367D99FC33D9F81942B04B2319CDF176DAC0DAA68984965F89F16F48C0633A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 359cc052144642596ee643d67b13116cc73ac5245c1ab1ff006bb95b40ae8765
MD5 c110b9e08c866ae318160b0ed4f01292
SHA1 921acfddcc0a775f7534ea6de129f443c7c79d81
SHA512 dd167dd7d493b15c2f88328470662d08f8b9f1e49503d473ccb5d22ba2b67d760d82d2aac9bd1a561133e753b0eafde847d8ddec6f4e0d907b7133d149b2e2e2
SSDEEP 3072:dii+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dii+hFD+7t56OD9ZfSApprr
TLSH
T1B9D31232AA91D8BBC9FC6541B157A304DE76ACED41DE7A09444A5F8EE09FC4C0673A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 e25875d09ea9c6ec9bfe8ef457a0b9bc8595c6b71a8c6a43687b69e19381a8e2
MD5 afb153e62de1041f41d0a1d876aed146
SHA1 8abb829144c7f9ad86a3e87203fc95c8b76e6d39
SHA512 d99835b778f8d0e164befe682f8a50d53b41cee5f9849614e52836422b51025caea21e47c6c01c0555b2c53c1b1d8e7f55c2b495bc1e8dc888db467f304b527c
SSDEEP 6144:MqMjeoHzTsc8pfDh5V6aI9vhyI+hFD+7t56OD9ZfSApprB:MqMCMTs/pB6x0IyFSXD9ZfS4v
TLSH
T1FD4422267E9DFC37D9FC1942B05B6229CDE176D980DAA2D540A26FC9F06F44C0633A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QXG0Z7Y9\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9de4ecd-d255-4211-aca6-6dfa8ba0e30e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2504_954284247\e9de4ecd-d255-4211-aca6-6dfa8ba0e30e.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4112-10-0x00007FFB5FF70000-0x00007FFB5FF80000-memory.dmp

Download

memory/4112-0-0x00007FFB5FF70000-0x00007FFB5FF80000-memory.dmp

Download

memory/4112-5-0x00007FFB5FF70000-0x00007FFB5FF80000-memory.dmp

Download

memory/4112-8-0x00007FFB9FEF0000-0x00007FFBA00E5000-memory.dmp

Download

memory/4112-7-0x00007FFB9FEF0000-0x00007FFBA00E5000-memory.dmp

Download

memory/4112-6-0x00007FFB9FEF0000-0x00007FFBA00E5000-memory.dmp

Download

memory/4112-1-0x00007FFB5FF70000-0x00007FFB5FF80000-memory.dmp

Download

memory/4112-9-0x00007FFB5FF70000-0x00007FFB5FF80000-memory.dmp

Download

memory/4112-2-0x00007FFB5FF70000-0x00007FFB5FF80000-memory.dmp

Download

memory/4112-11-0x00007FFB9FEF0000-0x00007FFBA00E5000-memory.dmp

Download

memory/4112-3-0x00007FFB9FF8D000-0x00007FFB9FF8E000-memory.dmp

Download

memory/4112-4-0x00007FFB5FF70000-0x00007FFB5FF80000-memory.dmp

Download