4c8377e183fab939706361b6261cc7de9ab8d57e9650a3209a54395b8a0b8c10

Analysis

user interaction
yes
max time kernel
1048s
max time network
518s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
04c8e95f40ec42dbaff98c89d620c64b.pdf
Size 68KB
Sample260924-nr75jacf97
SHA256 4c8377e183fab939706361b6261cc7de9ab8d57e9650a3209a54395b8a0b8c10
MD5 b1d8e7281985c22fb985941137cca8f1
SHA1 381c8b77fb25700ae4b94311703f1c2af4423f83
SHA512 87f10ec7ed94e808f97c3320e443407cebe1977027785f269e0508aa07bf1de9e877174115809d77c46952fade64e335818041c5823169c8cb51c45ceba198d6
SSDEEP 768:Qfx5caoQ8hi67/wVbJfaFexnlm2MzABvOBNTgdu1tKulPkdSC5IHhWg4Z4F2kxD7:KniQ8hFSJyFaMzAmTg01kuBkMCNw
TLSH
T10163E86889899CCCE0A6EBD3BF36B5C6AB0DF31359C851D630AEC7438342F176997512
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

adware microsoft discovery phishing spyware

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
211	2800	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2800	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347236113612228"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5196	chrome.exe
5196	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe
Token: SeShutdownPrivilege	5464	chrome.exe
Token: SeCreatePagefilePrivilege	5464	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3412	AcroRd32.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe
5464	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe
3412	AcroRd32.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 5048	3412	AcroRd32.exe	93
PID 5048 wrote to memory of 5648	5048	RdrCEF.exe	94
PID 5048 wrote to memory of 3004	5048	RdrCEF.exe	95
PID 5048 wrote to memory of 3004	5048	RdrCEF.exe	95
PID 5048 wrote to memory of 2188	5048	RdrCEF.exe	97
PID 5048 wrote to memory of 3448	5048	RdrCEF.exe	98
PID 5048 wrote to memory of 3448	5048	RdrCEF.exe	98
PID 5048 wrote to memory of 2464	5048	RdrCEF.exe	99
PID 5048 wrote to memory of 3116	5048	RdrCEF.exe	101
PID 5464 wrote to memory of 364	5464	chrome.exe	118
PID 5464 wrote to memory of 2800	5464	chrome.exe	119
PID 5464 wrote to memory of 5224	5464	chrome.exe	120
PID 5464 wrote to memory of 5224	5464	chrome.exe	120
PID 5464 wrote to memory of 1028	5464	chrome.exe	121
PID 5464 wrote to memory of 1028	5464	chrome.exe	121
PID 5464 wrote to memory of 2672	5464	chrome.exe	123
PID 5464 wrote to memory of 2672	5464	chrome.exe	123
PID 5464 wrote to memory of 4052	5464	chrome.exe	124
PID 5464 wrote to memory of 4052	5464	chrome.exe	124
PID 5464 wrote to memory of 3920	5464	chrome.exe	125
PID 5464 wrote to memory of 3920	5464	chrome.exe	125
PID 5464 wrote to memory of 4656	5464	chrome.exe	127
PID 5464 wrote to memory of 4656	5464	chrome.exe	127
PID 5464 wrote to memory of 3080	5464	chrome.exe	128
PID 5464 wrote to memory of 4696	5464	chrome.exe	130
PID 5464 wrote to memory of 4696	5464	chrome.exe	130
PID 5464 wrote to memory of 5644	5464	chrome.exe	131
PID 5464 wrote to memory of 5644	5464	chrome.exe	131
PID 5464 wrote to memory of 4200	5464	chrome.exe	132
PID 5464 wrote to memory of 4200	5464	chrome.exe	132
PID 5464 wrote to memory of 1816	5464	chrome.exe	133
PID 5464 wrote to memory of 1816	5464	chrome.exe	133
PID 5464 wrote to memory of 5008	5464	chrome.exe	134
PID 5464 wrote to memory of 5008	5464	chrome.exe	134
PID 5464 wrote to memory of 2248	5464	chrome.exe	135
PID 5464 wrote to memory of 2248	5464	chrome.exe	135
PID 5464 wrote to memory of 5304	5464	chrome.exe	137
PID 5464 wrote to memory of 5304	5464	chrome.exe	137
PID 5464 wrote to memory of 3456	5464	chrome.exe	138
PID 5464 wrote to memory of 5196	5464	chrome.exe	139
PID 5464 wrote to memory of 5540	5464	chrome.exe	140
PID 5464 wrote to memory of 1128	5464	chrome.exe	142
PID 5464 wrote to memory of 1128	5464	chrome.exe	142
PID 5464 wrote to memory of 3644	5464	chrome.exe	143
PID 5464 wrote to memory of 3644	5464	chrome.exe	143
PID 5464 wrote to memory of 4832	5464	chrome.exe	144
PID 5464 wrote to memory of 4832	5464	chrome.exe	144
PID 5464 wrote to memory of 1912	5464	chrome.exe	145
PID 5464 wrote to memory of 1912	5464	chrome.exe	145
PID 5464 wrote to memory of 5196	5464	chrome.exe	147
PID 5464 wrote to memory of 852	5464	chrome.exe	148
PID 5464 wrote to memory of 852	5464	chrome.exe	148
PID 5464 wrote to memory of 4700	5464	chrome.exe	149
PID 5464 wrote to memory of 4700	5464	chrome.exe	149
PID 5464 wrote to memory of 3652	5464	chrome.exe	150
PID 5464 wrote to memory of 3652	5464	chrome.exe	150

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\04c8e95f40ec42dbaff98c89d620c64b.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=37DF536E9709695E082BD0B8B2D6C9C9 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5648
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F6FFEAB53101CC93BE1D4CE5CE836A8B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F6FFEAB53101CC93BE1D4CE5CE836A8B --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3004
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FF3FC21A483202688872AA1DDF0ECE6D --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2188
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9DD4D5B1EE748D1978A648D80DDB0500 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9DD4D5B1EE748D1978A648D80DDB0500 --renderer-client-id=5 --mojo-platform-channel-handle=1816 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3448
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EE110EEEEECAEEAF21A4F73328E9F0D5 --mojo-platform-channel-handle=2692 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2464
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=76A20B4840FEDBA91089E23BAEFD96D9 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8e5bdc728,0x7ff8e5bdc734,0x7ff8e5bdc740
  2⤵
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,17312124880527687977,2096983924828825242,524288 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,5767750236185909140,6349219946296884573,262144 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,4887459040999042965,10798289905859938506,524288 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,12726563382351576211,11423654590121085736,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,13168883884298420988,242544127558662248,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3184,i,1276408920014293823,12302693235008930530,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4772,i,9084295936230108896,9776491939684731306,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,2228407557514817913,10052495402128099357,524288 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5608,i,11066474656310943511,8043444511113988028,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3380,i,17120844031450234932,1603531882865419457,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5940,i,6861289688045068270,8074082528840311991,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5988,i,14297063950266215215,2137583576222505598,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6124,i,1431044437695831254,1005566599501189539,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6344,i,1747355823193898768,5060561089595682964,524288 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6020,i,4782278023644999628,10395932520685771931,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,16544466946612387040,17978770931974864335,524288 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6168,i,15345269760113885915,7574590963204494801,524288 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,6041735998532840893,6685875526315030116,524288 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6136,i,12544231183122115679,6453205552808783050,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4572,i,6442913671516067503,8897286881969570916,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5868,i,2256022333097441258,2328365478229465860,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4560,i,8666028098838245899,6140806250699912708,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5740,i,8621004346023716411,13089150496847212141,262144 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4532,i,7790261410909037124,2892761573864117090,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6736,i,10356728959595660671,8711356706735430311,2097152 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1144 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3244,i,10050343565970336519,6601200988648364870,524288 --field-trial-handle=2156,i,13440490945959431241,15009636758882441376,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:3652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 79eaac79f5544e5240c2c3521bae8d364585172b1f97fedae9722bfc78ec71e2
MD5 6c5a2a50563f7159314a338d394d274a
SHA1 d8e116da40d52355d055464661a5ed5e9a76c8b6
SHA512 638395f262a385e830d6910f118459c0e0a8165efb047e02f3d0a9942ca2db904aeffed5b0cded52750bbebcdb31daea3116cfeb9ceadf7f9fb2b3d73504f2f3
SSDEEP 384:yeFdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:k+eUZsLQCZsL3hUS4
TLSH
T14253CADB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 863cd9b8169e501c5d79d526c6acef6f193f5260373a027d7361a6d73ea7e3fb
MD5 d7f9245a33792cef0c453aa6af485273
SHA1 31ffdd445b2bafd6cb8c04ca13281d7ef35918e5
SHA512 fd97b32e75cc52fc19ae681c84b7095cd38e68b0b651db71be09f46e53757cb57f6c4aad6a40a5b03105116b944b5d3bcaf879c0e12462dc5e2dd4188383aadc
SSDEEP 24:TLyx/XYKQvGJF7urs3D7tAdbtABStAActAAvtA+BFtA3stA5mtA3Ut6:Tel2GL7ms3SduBdATA6A0Tnp
TLSH
T17D420A9E4F69227DD4BC967AA8D20022777D252D7E7200E395246D60D1DA284AE43FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 2405da26a0cfe0dea81fddb21719416d999e482cbf52c6b2418a05550c4b5819
MD5 7e921b00aadacb542203196358b08e06
SHA1 130a547534c81a23bf9aef2aac326dd48a47856e
SHA512 f03b896ecfe90d8d6bab0363f5ff12004ea840fe88da97f3ea5798de48008db8702aa88d696e188886ff856edb1f6cf292f9d981187558e9066ba160ac4fa01a
TLSH
T1BBF02DE5D821AC3718FE172931A58B4BFB64232B2780494F3B3C411C8FB153B4A9595C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005a
Size 304KB
SHA256 d8c0aeb8763f74fe4d6ae86d94c74ac4001c01b557ea79466d2c499d294f0ac3
MD5 6b42a5343b56ad9c138cfccadf432cdb
SHA1 ba470887c13d7078369e699f0823f1fa369e5a66
SHA512 14685ab6b43e0f3a5ca2bed76093f79a9ebec6481036d63d024711e53454d9bb4aacfe0a4ef433d22d487b9dd803c2d88cbdbd0cc3ddbee34c5d70afb8b5b8f9
SSDEEP 6144:v1TFebhldBCUuzSx4h2UrFmq7levD+C6j3eA0K4P8iy5+DlY1rIA:SJgikxIOovk3yK4P8QDlkrr
TLSH
T19864233CE36E9767B8495B010FD2F23D5C4A268359ED04478724DDE0C7DB66B328AA29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 217e1e017d98687f4c2efb35e98b5a98a29002f3605c24653e96cb32bda15219
MD5 f45a265adaf69ba682c27561a4bb9d59
SHA1 d88707d830661dff4b0f80e755e6210b1964e584
SHA512 ee7d5f0f3ad4949e28668d232b417904c89cd46ff28a745b468beffee9b3f6759ffa8288a7cd865342cb6f940360ae746916a6c708bea2c5329f1b7b2c7d65cd
TLSH
T1EA81E904ED983120EBFC72BD38E70F847272765F8D1B6ECA249B5E3428933951205E23
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4a1e6b85e9ee13e51840ee164387d9ead37268a33525c00cbb25a474f2fd3517
MD5 b990d65447d41c09965cfff8136572cc
SHA1 d6bcb6809232fc11f0a87caea91e8580958ed41b
SHA512 4dee20c80859dc0205aadaf4cb6876c563e3adc203ef3e1664c2ffa7dbb0d99ae7f3e5d5da8f77a410a9e8273257c1d66b3d8ead48d4247ed7f3dca882520294
TLSH
T16E71E804ED583120EBFC72BE34E61F857272765F4D1B6EC9249B5E3429973951201F63
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xbox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.xbox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 7cf6ed1ca92f9f50d10673b493e884dab64a604d6608703cd8ff7f99d038bb85
MD5 c73384ce8077e4adf8c68c0adf0b9584
SHA1 9de4c5bad0f7b9571d3b18897b282ed67ff82e59
SHA512 24b0e4f54b60f1b8416c3a3fbf746833dd745ac3e403c26e29ace48bc1f09a52303aa0dce210b467505c7ee56e0edf2f0670aece38de899a20a672653ffecc86
SSDEEP 192:DTBh1itqJJ5Jj+wyTf5PKq8iEdE4SZqY1aPsvqfPiNPiNQqfLU6UKhBZ0pZ/+ZQI:DTBh1itqJJ5Jj+wyTf5PKq8iEdE4SZqr
TLSH
T16E32EDF783B4862EDA21A6F4DA15AF1FCE690515032C3866C5D4BE1B93F24B1E28174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 b42a2ba2c5dba7d7566238c64ceb9e944a6a3ab739af7759acf16f1f81657fba
MD5 c0c96c8e38f3d33897d566cef4b6faf6
SHA1 ae6965f32beca5355139e2df98abb43c20661bb6
SHA512 3954ef0dc396453c4cca6598548c835fe2204b1ef3c6ce119078c82c2a4a9de6f52aeade30f91e6d88c11e5cc6ae628a05490041e2ce553b75e4e729ed96addf
SSDEEP 384:D4Aa2itfZJ2JAJvrAD5fXKq8F9mgcE4aP1Y1aUBfFNOHQqfLU6UKhBZ0pl/zlQU9:yEeMA396/FFj2g5P
TLSH
T1D652BDF7C3E4862ECA21A6F4DA15AF1FCE590914431C3C5AC5D8BE1B93E24B1E28174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 828e28aed423fe002d1e8ee3069df0227be594a0965c3b25a12d32a7ab99e46a
MD5 bb0aed19b2899936196e9435c99b8211
SHA1 a707688a0e67a68a25b1697ff5c38ed3854546ca
SHA512 f1020b289c9bd1b413b555dbf4f7f8b9cfc59da3f9f104d8928261fa74e32d3ddb1c36ff9088c61b2271d72a127954a1139f8e9eb51ba1bc8b4c01cdad2cd45e
SSDEEP 192:D4Aa2itfZJ2JAJvrADXKq8F9mgcE4aP1Y1aPsvZfPdNPWHQqfLU6UKhNHZ0pl/z4:D4Aa2itfZJ2JAJvrADXKq8F9mgcE4aP/
TLSH
T1D532BCF7C3E4862EC921A6F4DA15AF1BCE6D0914431C3D5AC5D8BE1B93E24B1E28174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 931ff19d698798781b967a0684fe857328bf7bd5eb37a4080e22cd36cc21819c
MD5 f8d48283fe133e48acf2b16a8b2c7166
SHA1 1f84ffcd19a6ee562af0308f33b27980e64868a5
SHA512 f04b16503cc137c749273b85add0490ecb724408762aac36d91ded83c860caab5f8adb972045e960b6e965b8bc1f7c4372e92ff7edbd90ce956354ff07a48c54
TLSH
T113618FD792BF747B913D45BB1E49BC0625F5A8310152A4FDDB63826CA4854F7072203A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c130726c3c890f202a15e3bd27c0462692b524b79668997ba2ae2517f85b4ade
MD5 2fd6c456207d11cbca31c20f98444cb5
SHA1 815e9c9987273249c640630d89a1fb8f6a9961de
SHA512 198bad1f463b8d24640237152d4910317a38ae62ac512406d4cfb1fae9207931304c59773e489d896a6e5d5fe0945bb2ec2e52002ce9edaeb343cca5354bfdf5
SSDEEP 192:yRdvZcHSoEHX1MTFv78pAPRp2b9THsb+WNnj7deG2Vkkw6+VyIsnAUgtaJ:yRdvCHSo5T14UXwJw/deTKa28
TLSH
T16F42B42DED10753B4CDBD22AFA627B53D7FA102160942E84EAFC8A7C25D75CC621742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 16c0563035d9294c26d796658f5dab1e45e1d7a2b90bf060f58decda48fb1c37
MD5 f0304fd04da4246fbee58c5a44a29d28
SHA1 646d47e01ab489f25db2d3ceb53d2724ed672f05
SHA512 eaf9eac225f9e7bc09eb937b8f6434c777154de2a547ee8feabdecf6e589f653138ce5c6fe8923ef32864d0d615ef95b5cbcba67f2d6e72b191a2820acd8f338
SSDEEP 192:yRBcBzvZcHSoEHX1MT6v78pAPRp2YnY9THsb+WNnNhz7D2eu2Vkkw6+VyIsnAUg8:yRBmzvCHSo5TW4UXSJwjb2eLKa28
TLSH
T1D442C52EED10753B4CDBD22AFA62BB67D7F6102160942E84E6FC8A7C24D75CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a4933c29547e0e4e98270d29723e40e368aae589cbbbf07ef0e9e70fe10113f0
MD5 438648e1f4c0077b679260158cff8b5b
SHA1 5f9a6c4510f4a0def73d9f696861938a62778c4a
SHA512 3671431181740ef9a63417b37bb54e220d5f88998cc1b17d7434f568f691925a7c999419969d6326e715876bcef468bb601922b180067d6f1350d0df66bcf658
SSDEEP 192:yRBcBzvbcHSoEHX1MT6v78pZPRp1HLnXed9THsb+WN4DSNhzp9eeU2Vkkws+VyI6:yRBmzvgHSo5TW4fXsJwTXeepKM2e
TLSH
T14E52951EED20753B5CEBD22AF961BB67D7F6102160942E84E6FC8A3C15D76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 893fcda5203140ea2a450c5617e3dcef731923b0b0acb251c03701f32c497eb5
MD5 bb4fa9abed10515311532d4fd96902c5
SHA1 44cd21e0c67a0040663bb7cb5b5df9c77bf30e05
SHA512 e1f3d921de1d6327719cf0e922ea60428e0e87c49c08e9c6060e804e63ae01add0ef872e8866b904cd34d98fd7d9c245c11fd7cc36cb91306084e043258db6ae
SSDEEP 192:yRBcBzvZcHSoEHX1MTz7v78pAPRp2HLnXed9THsb+WN4DSNhzp9eei2Vkkwa+Vyr:yRBmzvCHSo5TzD4UXtJwTXeePK62e
TLSH
T1D752A51EED20753B4CEBD22AF9617B67D7F6102160942E84EAFC8A3C15D76CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8ecf1fca7e26c9e456d0793ed0a8428ad9a987f5f66de2c1ec6c19f8e99d794e
MD5 d5502beda2a0e0449f3c7bb94a3cd598
SHA1 2c1c253fcceb070b28adc0e6ca7acbbb1d1b2394
SHA512 e2593fbde82d076c1ee3bc180b868412535393c4e3c0e871855b18abb5657ffdea6333876646226ebe3e6c3f00b14324850fcfa1b424c42832bc779fe027a56f
SSDEEP 192:yRBcBzvbcHSoEHX1MTgv78pZPRp1HLnXgd9THsb+WN263DSNhUiaamwep9eek2Vq:yRBmzvgHSo5T84fXCJw8Q8+eeZKMhe
TLSH
T1D362941EAD20653B4CEBD23AF965BB6BD7F6102160D01E84EAFC8A3D14D76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5048f099a4b112d79910e202dae305a7a687c48e77b2bc7f665032070a07fca5
MD5 8c2eeb590fe660fae10c5feca56615b0
SHA1 127d8049886ed817e518422716c7d5fce1c477b7
SHA512 a32df9a2017fdb02376529fab53fa953ffb1a4f84d55f450cae02b7c682bb9f83bd1b8691f59b9c4e228768954a1867e928a3c586dee1b8319e8a705b6762039
SSDEEP 192:yRBcBzvbcHSoEHX1MTwv78pZPRp1HLnXgd9THsb+WN23DSNhUiaamwep9eeL2Vky:yRBmzvgHSo5Ts4fXCJwNQ8+eeaKM2e
TLSH
T10362941EAD20753B4CEAD23AF965BB6BD7F6102160941E84EAFC8A3D14D76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4b098608925d099cb2fbd183a6be096e5b70cdf8826fc6d8fded0292f6446a0d
MD5 3de99e9a4a02293704d3cf87de4f97d1
SHA1 98d986b1b45cd1c23543b9af790952c24da2b673
SHA512 5b049371c6ac076cf85ba128ec9df697f325dfbe464839d3438a2a8c5099e113b6937edae1a55543855394eb8b0edc78719b296694fb8e4abba0e89790b37550
SSDEEP 192:yRBcBzvbcHSoEHX1MTvv78pZPRp1HLnXed9THsb+WN4DSNhUFzh/c/p9eeFS2Vky:yRBmzvgHSo5Tn4fXsJwTYF/EeeFfKM2e
TLSH
T1DE62951EAD20753B9CEBD22AF965BB67D7F6202160D41E84E6FC8A3C14D76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
MD5 c8926c13ed1e541a9ebca052800d518d
SHA1 3522a9925410a3faf9a73cb924c1c1fb4dbffb5b
SHA512 0cc7f70f08f90753f1713955142d2f28c2b7b8284eb83bb86dea581036af8c57e30edda3af83eb81e1295de946e3c6812dc7f1671fca9c13e29cb035d90943a4
SSDEEP 384:j5j3S7KxkXqKf/pUZNCgVLH2HfgslA/7pLuLceS9YXOD32+ErU3tJHGT7LAE:jJ3S7KxkXqKf/pUZNCgVLH2HfgsC/7pO
TLSH
T1E772FA67BC4C9A3B4F94C68CDC267F4FADB5024B61ED886443FA582603D5ACB05062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 51b949a5e3970257a60681f08ace6ba495660d5f6e91026e2b81105f2c906521
MD5 1841c7f4ad6f6e4366c0bbe3d62f9fe1
SHA1 61b009b645a3fd9c51b01ee7c10f1ce1d228b305
SHA512 df9e24b59567d8f9a88ac9d774c526bf7b61f41662fd5c92bc149781d9c7abb96d6d022247ba53eda8ace61553d9dab452a149d159e088922d32810d896bcbae
TLSH
T1CDC01206D147A302C06203B02D719C5C3B616F78D2120348C2F01D4BFC75230C02B11E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b9a8869bedbc684f9026df092a9c6e3cc23a071feee0008e53bfcbd364211c84
MD5 6f2e77dd5a0152a87dd38b057b53bdc7
SHA1 ddabf6c63923e02246fb3fc2c90ad9f2be72ddb8
SHA512 c8013858360360e6c92fb261150c9eb0d44c61ca7b594e2b9d5769b0f5ed8b73640c7f7949b44cedb304f8ff90e3b5dc384d947bea20edd56a976343570fabf4
TLSH
T10BB0120680422311C40107F11150E0683770AF38D91213854AE00D118C311504227518
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a87b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a87b.TMP
Size 96B
SHA256 06d56e5c8a46bb016e7d5b763ee6aea09116d331c8c904c072d4acd4c8d6a588
MD5 ccaa7992890138e40203ee37787b188d
SHA1 88c73568810a41a38a67adde378aaf5c00dfd1a8
SHA512 beee33a29e0d630dc3d5fe7e133fa95831d7c75ef13fc622511b4b99491fdecf2b291eb327ee92d91b52de3dc68d749df884828f2de60d7bfc2af11fc94a9ab0
TLSH
T178B02222C0022202C00303B038E280CC3020EF3ACB030202B3E00E23EC2C2200222820
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 69ef379e865e232e5d910b7224c5e36a4e6b1ee0da59a9e9196fa2fd41a4255d
MD5 c915a61e2f4f343878e7705807d0d1e6
SHA1 8419ed5f25d7c599333c7fb298f8cc31e6ac0fbc
SHA512 97342fd2e463df58a61496199e44bdeb4c7ff0d0cdfd71abfd752daca95c5fdfe62beff4118229bfd4315b772417f22ff81272c423345ba3e36752b61eb77a4f
TLSH
T1B3A002D4C6430243CC0543B4E79166C427507A1477C74B5550A845488D945464203A82
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 95b542a81363ea59a937a52f727f272be07bab01d283f7c2a3fd5b5b72c8f6a1
MD5 b80d1b8781635c1661c0f658fa6d6e39
SHA1 1a26ea7fcac16aabe75d420857634c7b5ce7b644
SHA512 f7e3f529f479ec61ac9a7e448efb25cbec96e7dfa10d4a521520a3950d05883c98db8546554734342b996d04281d8ef2ba6ad226c5086a027f0f19b68f049995
SSDEEP 3:MsEllllkEthXllkl2zEjl0B:/M/xT02zx
TLSH
T1BE4404057FD04555C550347C5015C75403F0F41405375FC33C51DC135CCDD445C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 69249c2089ff4140c3576a90a82e248abda5a36ba036e0537a6022117875a573
MD5 9b1bb8816ad324f221c7f731331d5bc7
SHA1 a3331ba753d35144d3755b5243f62484f489505d
SHA512 ffc1869a449cce72d53fd377504e49ced39df17dedd97b6e1ea7191cb10be6f98009f2844e571d14de930b7a100dfac44d1f76dfd6bad63c0449efa36616306a
SSDEEP 6144:MqtEVjEfs8LCnlRisuNqchDU3BpZ+hFD+7t56OD9ZfSApprU:oNEUnnPisBiDU3nZyFSXD9ZfS4u
TLSH
T19C4413336F25ACA78AAC141564037300CEB75AE502DE668D5C837E86F66FE4C0F6B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 ea22cb73ef24ac01e151d92ce640398d1d0a61876f38c424716e67ab18fddf63
MD5 dc354ca5fc994d13ecae22b412ea65a3
SHA1 a99d25c7e13a45f0f2af6740f201c6b2b11b0fea
SHA512 4122a0b5710e3c473cbec488bd5a62f937a5e41e6be1b905aac457957d75b6cc40aeaa59006860c82b11d756226d22ca3510aaaabbeec018f0bcb6da6a51b70a
SSDEEP 6144:utEVjEfs8LCnlRisuNqchDU3BpZ+hFD+7t56OD9ZfSApprU:9NEUnnPisBiDU3nZyFSXD9ZfS4u
TLSH
T1024423236F65AC9786AC14516843A700CE7759E501DF26894C837E86F67FE8C0FBAC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 82c1114cf290eae6a06bd760b0e96c84cbc86f747d85dd3b5f63fd466cc70c39
MD5 21c1195cac7cf364aaac64c6fa23a42f
SHA1 b10f1d17b4aa5fddaede380d632d324c43eca0c8
SHA512 339244a7dbb2189d8db8cd2056de5f7fb99ae7812b6cb9020c627dded820e62a66e652f7b2338bdcf2d9caeab21dbab952286998e21822cb12c387156e298ba6
SSDEEP 6144:sqtEVjEfs8LCnlRisuNqchDU3BpZ+hFD+7t56OD9ZfSApprU:INEUnnPisBiDU3nZyFSXD9ZfS4u
TLSH
T1044413336F25ACA78AAC141564437300CEB75AE502DE668D5C837E86F66FE4C0F6B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 acc8b92534ae3635e303e53fa4af576c02ba81639e9638dd01067c44d77dfa37
MD5 c5bf3114d836cce0a42df6bb8f29680a
SHA1 3d98b41e7d720ca328bf1c487e0cf5111fd35afa
SHA512 c84ca98a9d1e81b4029061fbb236cf88d789567745e7df7b71249b04ea67233ff5c8bbb8134a32666733de6ac1f2ac193dfe5f036a482be995fd033bb7bde3b4
SSDEEP 3072:K+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:K+hFD+7t56OD9ZfSAppry
TLSH
T122D31232AA91C8BBC9BC6541B257A304DE766CED41DE3A09444A5F8EE09FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 b87218b10533584e87cb945ade738622f0af139563460e2e5d20050424046558
MD5 cad90a71818c1e9e5bd67eb108138f7d
SHA1 3227f4f3aed590136f5dd2bb21147a31f326623d
SHA512 80b2416226b45704287c8b6af66d37c79fcb18625c65667fe696fdb873c88a69a0073ba97a3af5da7e479998af62356d786350d5d0d7e81ecadf92ded7e68808
SSDEEP 6144:K0tEVjEfs8LCnlRisuNqchDU3BpZ+hFD+7t56OD9ZfSApprU:4NEUnnPisBiDU3nZyFSXD9ZfS4u
TLSH
T1B84413336F25ACA78AAC141564437300CEB75AE502DE668D5C837E86F66FE4C0F6B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download