7ef3cbf8d0703a3a9b4db8c797eb890d593967fc83e085866305fda712bbcfa2

Analysis

user interaction
yes
max time kernel
389s
max time network
392s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Attendance Taking user-guide-for-trainee-async.pdf
Size 433KB
Sample260930-k2j9nsbd38
SHA256 7ef3cbf8d0703a3a9b4db8c797eb890d593967fc83e085866305fda712bbcfa2
MD5 8a5f61de96879e7bc7acd713ff272aef
SHA1 8ee16b8c633a2f1d0b0b885004b2d4b994c97265
SHA512 2d467e776e9767917ca6c6e79d9126386ad381a4e65f3fe35d3cf08c08a563524293c6fc4fbe9c1387628fedac2a8e84de7ba22bef0a6ee69bd8edafed540192
SSDEEP 12288:AVNNCIXVp0msgEtkH7fqpWQCU4CAjRjAMcwxzrmXDUtr:knCc0m5EmDqpEUG1jADwFm6r
TLSH
T18294F1235D9994CDE52102B6BF1B3C2E694CB252E4C610F2355FDACB6370FE90D2B926
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
116	SnippingTool.exe
984	SnippingTool.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3228	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Pictures"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000c8a37f12ff41dd01065b5e2e0842dd0119cd504abb50dd0114000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80d43aad2469a5304598e1ab02f9417aa80000	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Pictures"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	SnippingTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Pictures"	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	chrome.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4208	chrome.exe
4208	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4040	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
988	AcroRd32.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
988	AcroRd32.exe
116	SnippingTool.exe
984	SnippingTool.exe
984	SnippingTool.exe
4040	chrome.exe
6004	chrome.exe
3868	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 2136	988	AcroRd32.exe	93
PID 2136 wrote to memory of 2512	2136	RdrCEF.exe	94
PID 2136 wrote to memory of 228	2136	RdrCEF.exe	95
PID 2136 wrote to memory of 228	2136	RdrCEF.exe	95
PID 2136 wrote to memory of 4052	2136	RdrCEF.exe	97
PID 2136 wrote to memory of 4052	2136	RdrCEF.exe	97
PID 2136 wrote to memory of 4036	2136	RdrCEF.exe	98
PID 2136 wrote to memory of 1752	2136	RdrCEF.exe	100
PID 2136 wrote to memory of 2152	2136	RdrCEF.exe	101
PID 4532 wrote to memory of 1456	4532	chrome.exe	129
PID 4532 wrote to memory of 3228	4532	chrome.exe	130
PID 4532 wrote to memory of 4860	4532	chrome.exe	131
PID 4532 wrote to memory of 4860	4532	chrome.exe	131
PID 4532 wrote to memory of 5180	4532	chrome.exe	132
PID 4532 wrote to memory of 5180	4532	chrome.exe	132
PID 4532 wrote to memory of 5336	4532	chrome.exe	134
PID 4532 wrote to memory of 5344	4532	chrome.exe	135
PID 4532 wrote to memory of 5336	4532	chrome.exe	134
PID 4532 wrote to memory of 5344	4532	chrome.exe	135
PID 4532 wrote to memory of 5432	4532	chrome.exe	136
PID 4532 wrote to memory of 5432	4532	chrome.exe	136
PID 4532 wrote to memory of 5544	4532	chrome.exe	137
PID 4532 wrote to memory of 5544	4532	chrome.exe	137
PID 4532 wrote to memory of 5804	4532	chrome.exe	138
PID 4532 wrote to memory of 6068	4532	chrome.exe	142
PID 4532 wrote to memory of 6068	4532	chrome.exe	142
PID 4532 wrote to memory of 5572	4532	chrome.exe	143
PID 4532 wrote to memory of 5572	4532	chrome.exe	143
PID 4532 wrote to memory of 5676	4532	chrome.exe	144
PID 4532 wrote to memory of 5684	4532	chrome.exe	145
PID 4532 wrote to memory of 2724	4532	chrome.exe	146
PID 4532 wrote to memory of 5588	4532	chrome.exe	150
PID 4532 wrote to memory of 5588	4532	chrome.exe	150
PID 4532 wrote to memory of 4896	4532	chrome.exe	151
PID 4532 wrote to memory of 4896	4532	chrome.exe	151
PID 4532 wrote to memory of 5564	4532	chrome.exe	152
PID 4532 wrote to memory of 5348	4532	chrome.exe	153
PID 4532 wrote to memory of 5348	4532	chrome.exe	153
PID 4532 wrote to memory of 5736	4532	chrome.exe	154
PID 4532 wrote to memory of 5736	4532	chrome.exe	154
PID 4532 wrote to memory of 4040	4532	chrome.exe	155
PID 4532 wrote to memory of 5976	4532	chrome.exe	157
PID 4532 wrote to memory of 5976	4532	chrome.exe	157
PID 4532 wrote to memory of 2700	4532	chrome.exe	158
PID 4532 wrote to memory of 2700	4532	chrome.exe	158
PID 4532 wrote to memory of 2724	4532	chrome.exe	159
PID 4532 wrote to memory of 2724	4532	chrome.exe	159
PID 4532 wrote to memory of 4048	4532	chrome.exe	160
PID 4532 wrote to memory of 4048	4532	chrome.exe	160
PID 4532 wrote to memory of 2152	4532	chrome.exe	161
PID 4532 wrote to memory of 2152	4532	chrome.exe	161
PID 4532 wrote to memory of 5500	4532	chrome.exe	162
PID 4532 wrote to memory of 5500	4532	chrome.exe	162
PID 4532 wrote to memory of 4208	4532	chrome.exe	163
PID 4532 wrote to memory of 392	4532	chrome.exe	164
PID 4532 wrote to memory of 392	4532	chrome.exe	164
PID 4532 wrote to memory of 6004	4532	chrome.exe	165
PID 4532 wrote to memory of 3868	4532	chrome.exe	167
PID 4532 wrote to memory of 5864	4532	chrome.exe	169
PID 4532 wrote to memory of 5864	4532	chrome.exe	169
PID 4532 wrote to memory of 2228	4532	chrome.exe	170
PID 4532 wrote to memory of 2228	4532	chrome.exe	170
PID 4532 wrote to memory of 5448	4532	chrome.exe	171
PID 4532 wrote to memory of 5448	4532	chrome.exe	171

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Attendance Taking user-guide-for-trainee-async.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DF403289BCF5C0FE89A2ACC46742E5DF --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2512
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CFA12E17CED1E85DD42C563EA0B525EF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CFA12E17CED1E85DD42C563EA0B525EF --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:228
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=689E838B3AF0C9881AB3583EAD421E0B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=689E838B3AF0C9881AB3583EAD421E0B --renderer-client-id=4 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4052
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0E3B5625D99647B6B2EC17F2B043B5FD --mojo-platform-channel-handle=2688 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4036
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A71D8E8A6619E067D7598AF24C3C6989 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1752
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=00CD32DA75FBFD35B9F4E7F14A2AD4E9 --mojo-platform-channel-handle=1972 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:4840

C:\Windows\system32\SnippingTool.exe
"C:\Windows\system32\SnippingTool.exe"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
PID:116

C:\Windows\system32\SnippingTool.exe
"C:\Windows\system32\SnippingTool.exe"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff913d6c728,0x7ff913d6c734,0x7ff913d6c740
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1520,i,4912326410646996149,14394707852731662570,524288 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,14873678757818340790,5095755704598899280,262144 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,15570310006554147047,4914419354634535075,524288 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,15378862448155988750,1331865986450986013,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,16441319324580790740,6078527120501138150,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,2465806600800873539,17814885341276570701,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,3848726221071612706,13066651245047191152,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,8616119931609448393,10295247481895906794,524288 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6076,i,935869287540212728,3687578290528448971,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3516,i,13128846092558338638,7527059426530927647,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3572,i,17748322412477118046,14756150872870096319,524288 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3244 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3632,i,3291713234288058223,8569676099641328346,524288 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3312,i,9493495280870564824,1534239329703202127,524288 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3308 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6004,i,12065383529198834084,2105067054264982851,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4524,i,12336443306422783063,14899520898203690534,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,6902285149335300219,10982125996868143748,524288 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3592,i,15811034671375829267,3706648357979708527,524288 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1208 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3604,i,10547658668973404880,18275862642104932810,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,13535100727686338867,13783870671614977389,524288 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5896,i,6026334166812821857,11018719289920515667,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5824,i,16614499384799544858,14867054786908052580,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3572,i,3403564423500064429,13456725440477075432,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4888,i,15833715323636325130,13721064161135660745,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5784,i,7944475125509658498,1597969972005878468,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5884,i,9488495006451296977,2010132731073716716,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6336,i,8545695128229274296,12712175323443442669,262144 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6324,i,2324602487988354050,8698660879205210605,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6692,i,2376370726599006585,13459232933669831678,524288 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4504,i,11280105069500536397,16092789152618210021,524288 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3600,i,12303998717688298471,833730793656582855,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7048,i,6634537216381968096,5861374097548879926,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7052,i,6441284874432298046,390753206579456603,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,15128687545034617884,4385558984809234701,524288 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6312,i,8707522476347531983,421154752861823503,2097152 --field-trial-handle=2104,i,1957911171058777988,15656389683611058618,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:1560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 d61bcf0efd9a35109551b149bed13c5086f3a6be25f3127d0fb4ac3e9104384d
MD5 e3c24e03f5455c8370670a6362b6f8f7
SHA1 2161dd8479b40a63c7cea7c41dd2e328888c026c
SHA512 961d6cfaa871fcc9db93a034c74e99558d04f592ee67608ecde77206d5fdafd1bb4de281f373eeb7395a0a5e169c6a71249536e0b3f72b657ff36126b36261a8
SSDEEP 384:yeCdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:Z+eUZsLQCZsL3hUS4
TLSH
T1B753CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 165b5d8a783a6a9a39e380e3501426d1db422c12a092a64837429f417897450f
MD5 df02e20e806bd573a91bf8a40551765d
SHA1 2c0da74748be7b6b03a017aeaf0a6279e70181cf
SHA512 8393477b2064a987cc9a07c158a5f5c93b7ef555c4f81dc797ba8c2e8460680a5c14e3e89ff1006ab49c07378d3f0d82854aec4164f8202a93f319d8231ffab6
TLSH
T176F02DB9C921EC3718FD0B5920A5074AEB5113672A81499F3F3D450C8FB063B469682C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Size 21KB
SHA256 bed514a326972fc0947503666e200e60295a7aaa789818138ecd4b41c3f359f4
MD5 5b3463c6a60e81bb4d17c13c1505db8f
SHA1 317df981ef3a0c242e40fa964368c0d3b75d8623
SHA512 3979438111bcc157cdf40c9091dd24503f5262a1cb494b904ee07a1b8b0124733a402dc800e5687ed7605f131a59009ca1ab85f56f17eff152e98bb47257a274
SSDEEP 384:2S7YCn02R1hBPf/Ezj3hnGuiXIc8lkE8127B2qViOIiw2aBhr46BgD:17YC02R1H/i1GuiY4D1bqViOIZRBhrns
TLSH
T14CA2E18345D8077B4D214902E119B8AB9F27F1F7CF76E90BD04BA96C44E463EFC41562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 275KB
SHA256 705f685000dbb51c878dac6d96342742575d0fddefc84de521d1b39a5c53dc5d
MD5 01d1b731f8bc4029252e4fdd6ff38d50
SHA1 83534b415163f80c682e3a0f315f7800b6fce7f4
SHA512 bfc6b60a473b327f31525126b8a5e9a42061c161247779f2a8f50c2aff6f360531acd67c0aabda931effdf5460ddce8304eece7093e66f2728f633799928ea08
SSDEEP 6144:HG0rBmVN/rmBDBVYToYPOXl07MrTTOe1Rp:odrkDrYToYGO7MrTTO8Rp
TLSH
T1E25423A5AD2B784F44996AE854F01939010E324EC17F2583E9C7FAF0D3E6327095B9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 53ef9a8fa9865df06654adafb5a8ca0822629cef1255ae8cc47c619fd7a88844
MD5 b1a43cd403e6a2c37a6df94524ebdd83
SHA1 1e764182c6cb976fb5e583d25d72dfd79c893691
SHA512 50a76ccff3eab667f5fe035f4ce748309980094df197c4b2215db238bee79fd1a1dd4f4626432699bfa838d117091e7e5febde6e6485d848ee8c2e4e19e202af
TLSH
T11571309950CFDC08CFF05E72748A0C2531393AA9969E0B0E664CBA7D7F67A603152BD2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9c4dbe90eeb19ba845a45d76d367f2a2450b60b7d49f48d7cddabd0efc4fae11
MD5 35987a2e6ca4845d2b997996cfb65f65
SHA1 12e3770f16cf156cb4e31633e6180458e12ce065
SHA512 b22c453e7a3b1fadc69b1e05725252bf81e9697fb2f85a65a096991542d69cdfcf856e0836b9bd979b6df99e2822e920ebc2a685de6cb863baa6ca1dd94f7883
TLSH
T1DE813F9910CFDC18CFF05E71748A0C2131393BA9969F0B0F624CBABC3F63A612142B96
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 1ec372c91be6117439ade3bf3202123d46838b7a6ed61f958859d51dafe31c90
MD5 734024281991f3576e361c42382e230c
SHA1 d72252094d565fff2e6373019691befb7cbf1619
SHA512 9b882abee4375b05fcbeff6b414ea7dcfd732dd36a76f51d359896f944f2d6d32bf38d48cbb3f0d669e33e63b2fb2b69d8b5a7447ffeedf3e057be1723b134f0
SSDEEP 192:DPnCHrDJpGpnJfJUUwu2X2a/KOaPsJIZ31FfPlNPPvupfPOpE:DPnCHrDJpGpnJfJUUwu2X2a/KOa8IZlY
TLSH
T18F02ADB7C3D8C62DC81156F49B21AF1ECE2E0A18432D3C66C8D9EE5B93E2871D25535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 3d04ff74b4e1d3e6189aa29ec0712c8ebb940e4bbd07d752fc99dbd0a882b987
MD5 bf474c37577e6a0f33f91844e8cfac63
SHA1 e485664b4acd0f956bb150029d85d8439d7e5e58
SHA512 b3d94b6f1188b090ed72a2248407c6a017fb060cd06444b89d44c6beb940d35be8482ccc296c32163969e824426be176982be64fb6c952f6c161f6c759e9c0b6
SSDEEP 384:DPnCHrDJpGpnJfJUn9YIs0qv+IA0vekrAy10wu2eKOaAui+hzVUBzuAuhs176aFi:TVXzWmSjlMmwNb
TLSH
T1AFA27DF7C7E8862DC81156F49B157F1ACE1D092843293C26C9E9EE4BA3E24B1E25174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 fc935237c9010c0df960daf3c6ce5ca1b183841ce453dbc984438a81140a812e
MD5 97b3d95322d927fcf2c8e54948df6545
SHA1 8a6d06d84ca8654b9a12f469970e1ff7a0267029
SHA512 d99510594c3ed44614844f44e39451645c1b2b14ecb85e611d664fb904861575e650e47a5d57697b89da64ec597d557d11b24886606c815741cac1aae33a6ed5
SSDEEP 384:DPnCHrDJpGpnJfJUn9YIs0qvJwu2X2a/KOaAui+hzVUBzuAuhs176aFXjI9hXnf6:TVnzWmSjbHcho
TLSH
T182728DF7C3E8862DC81156F49B157F1ACE1D0928432D3C66C9E9EE4BA3E24B1E25464F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 70f2098d024c572491ab9f2a75e1a514d187be1d187c3544f644db0c6abd321c
MD5 d5bc7d44eb868a9e6751820645ee118a
SHA1 cb44a1fb71076dbacaeb2250586f0577f3827d84
SHA512 39abf0f3f24ddc67bb76348b9fdeac9396c1b9df5f8489040caf1e4e64cd519cc8b9443532d79b95db26e6a51420fec261be0713a290751a76bc0fc63e589072
SSDEEP 192:nqRJQY6XJ4dUIMv7+hAPRp2h1F9THsb+WNnF64s72Z/2GqkwHA+VyIsnAUgtaJ:nqRJRgJIYa8XU9wkz2Z21nD8
TLSH
T14442952EBE50797B5CEAC62AF912BB97D7F6103160841E84EAFC893C14D75DC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 26be8088e79b0da314e141324e9bfc2a5fc1b097ab04125ba61c52f321acb6f7
MD5 8bd2877adf0e4ccb3754c3c8fd718837
SHA1 2c251a87e621414211c97723616ba08f675982c1
SHA512 3eda2a094c97d39bda95b52c3a60e92dc04832a36e2818c92d54e8517813177843f7c16c93bc0afd4642e452d45d06a39431ed6328ee5648faad422f19a62964
SSDEEP 192:nqR1cBzQY6XJ4dUIMv7+hAPRp2hRc9THsb+WNnF64zwee/2GqkwHAJVyIsnAUgrK:nqR1mzRgJIYa8Xd9wkre421nOe
TLSH
T1AF52A42EBE50797B5CEAC62AF912BB96D7F6103160841E84EAFC893C14E75DC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5e8a11c862552eda801fc185c403298488562cc313a52342c71530bf63317703
MD5 309d3461ff426955657f3e77edbefe9e
SHA1 8866017a6dd94a472fe38d6586d5eae18aa09f99
SHA512 d6287df6794df1c3fe39f7048d98874e82827e9337c0bbfbca6b0bc43d448474db39a005cee5f8009057de82addea5a85903d4651b509d45add72ef69334941b
SSDEEP 192:nqR1cBhQY6XJ4dUIzv7+hAPRp2h359THsb+WNnF64+NYD/2GqkwHAJVyIsnAUgrK:nqR1mhRgJILa8Xi9wkvYL21nOe
TLSH
T14A52B52EFE50797B5CEAC62AF912BB96D7F5103160842E84EAFC893C14E75DC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 931067a4b0bf7b8a8b6c0687613e86553e461afb37254f1a9bd290591fa3a97f
MD5 b780ccaaae1b21b9e3466fbde38d4511
SHA1 43c70bf44b681f4203f8a2b2823ad4c193727066
SHA512 754549054964f5e46d279ab991aec05548ab61178393e91d5d5311757fa4f9abc98028f2be7dd9c248e813eeadc93f55cc094ebbafa594929b0ab3d6cbfcc6dd
SSDEEP 192:nqR1cBhQY6XJ4dUIKv7IhMPRpBhFACj9THsb+WN1LF64GFEN/2GqkwHAnVyIsnAq:nqR1mhRgJIGUAXeE9wajE921n6e
TLSH
T1CE52C52EFE50797B5CEAC62AF951BB96D7F1103160841E88EAFC893C14E75DC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 77217d21af99c8ed199ecf659941b0110b84bb0ad686a410cef6a3b7387b8337
MD5 fad0ce5d3a68136d876ad2ac227f98cc
SHA1 a8951b1029d6f8a1f26d8fe942d7c18779657025
SHA512 6627cf20a91e082a549b3bdca863339d3fe2f9c9b6ec6290577b917ea46dc241b3377428fe6da19cc438ab21fac5af117ad1c5c59c2367a86e8418a81e598c83
SSDEEP 192:nqR1cBhQY6XJ4dUpKv7IhMPRpBhTWPd9THsb+WNRK/FF68dIx+acO/gnc/2GqkwH:nqR1mhRgJpGUAXO9wDXFn/gn221nCe
TLSH
T19D62C62AF960797B8CEBC22AF951B79BD7F1203161841E44E6FD893C14E76DC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 82b40732ef08fe80093ede33ebf7bf672581a4dbf38dbee470adb5cb505dc6ac
MD5 1de5d4135c5e91ba4d925731bc46f9ed
SHA1 010ebaeb36aee34eb0e4fb2feb153e4dbd3b66fa
SHA512 c97ebc1124ca44ef6f1bfcf3c7c4b11e4a744b6ba9d7c66e8fdd2afa09a33da97d5df254dc9d65b1fed6d3a406a7a2bba24aadab64b625e6f3faa2c617ac3ceb
SSDEEP 192:8R1cBhQY6XJ4dUVhKv7IIMPRpBhTWdKd9THsb+WNRK/FXHYiV86dIx+acO/X+O2e:8R1mhRgJVhGU9XN9wIEtFn/X2N21nCe
TLSH
T14F62C72AF960797B4CEBC22AF951B79AD7F2103165841E48EAFD892C14EB6DC3207417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 603bb6811a5edcf79621ea1fe96b619ca18c5f60bce63895af1b55dc1822f39b
MD5 047c2c844561a1fa1931a09c8a50886f
SHA1 fb3ce4491e6d7e338a464ee8525115938958de9a
SHA512 d1fec52199442910a1a7ea27210536f8f88362c785698c6768288f3df51c248abc47bc95e7ab122bc92d96315c54892db47ddce601bae1a3301f1f5f98430c32
SSDEEP 192:8R1cBhQY6XJ4dUVhWv7IIMPRpBhTWdKd9THsb+WNRK/FXHYiV86dIx+acO/X+O2e:8R1mhRgJVhiU9XN9wIEtFn/X2N21nCe
TLSH
T12562C72AF960797B4CEBC22AF951B79AD7F2103165841E48EAFD892C14EB6DC3207417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 de51d481a7dd1a6b02acccd0395deb99f216bca7333d0ce97c66d8fc79ce1a07
MD5 3d8b700616024fc381b763048482a9f1
SHA1 1903cfc537e274bb1662514f4e0968452f0f3a8c
SHA512 24757d25c0495231a7bd6a98cffc067e3c395efd720c4962e857ead4796d0a459f8b29cdac27c937c1708ee1320b4232192037759224042c5d6110ec48ee1673
TLSH
T13BB02220C3022222C00203B0308282C830A0EF38C3030A02A2E03A22EC3823000380A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e10a121d3497a7e5901e66e6704826f8037fcabc24785cdef11ddffb0fc31f4e
MD5 506cf5e7b19c63e5fc52fd414a0311c9
SHA1 1b5795cddd6baee14621a67670b9fa496fff784d
SHA512 3f1f5e486e3af19ffb29ac75fd2626a1964267dc8ca44cd11d350f4f7e088ac0a151ca2a6cab6fbb93c44b35c12f0de320c67a25fb37084421eacae8fbe56f75
TLSH
T136B0120580815342C04307B021615488355CAF10FA06230181F00E01D8351B1801B054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 7d9fab0109f976cc365d44761a91746a09c65ac12d0c8136ebd514b3a328de11
MD5 c951f52820edea15a4e69b7b6603ced5
SHA1 e8599558a6e8312b82e4ee2a7974534d9ddba026
SHA512 35d448b81e55d4bd3b5ea7240da4ee4c31b61340c386e26190d313bc8916ebb910e8ca9dd84b043c6b25d8d190f9f202c60913dedfbd37a16bad9a054b1190e5
TLSH
T1F0B0124840C91912E4100A702AC2004032512C001242444161A43035A41975A0240C00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 0e48fd73d1d65112deb01cb1411ee1046e74ae272db9bab116bf3dba946ab930
MD5 a4717648780c9c20192a2b75e30ac5e6
SHA1 def81b411659e7061650e8cafabbf5f07b12c6d1
SHA512 03a21a903c7d19080f0ddb21c95e3db2072f4c5fc64e9f8a6695e8703ae6b8312533fdada1b646ebc5c7aa6f78c5a418d9c95a5e4a5aa895a5c87ea8edd072fe
TLSH
T196B0125944DD5D01EC144A706BC561401318582016074703A840340498094D74440701
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 cecf4e5f335a2c70bb8ef3275175879090701f874948a07a82e483bbf8dd007e
MD5 a9f40d50fc688f202b4d78adaed08526
SHA1 9dcf4395fa9b9b49dde3f77ce8d08547d74ef831
SHA512 a79adfa2940c94364888c5269efc1220712a89c66eea5085c585f21c04219b193f56d3b414ec412bed455ee3213c8bb3c3cbb22c6bc02fa71c4dc629ab75f4d3
SSDEEP 3072:e+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:e+hFD+7t56OD9ZfSAppr2
TLSH
T148D31232AA91D8BBC9BC6541B157A304DE726CED81DE3A0944495F8EE09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 9d9d237e886ee51d8285f22a3a29450f66cd9aa5e07fb7eab0a54dc13b1a1080
MD5 70ae7e51716d623300ae5d6ff63e641a
SHA1 5b890bc7e282cfc0681d39ec4c63c590eb81a9ae
SHA512 ddb34d8247aaa3915dcadd24c120f182db82ff92db68354505150acdb1b233a429862995c0e6d0a18adb166d3b7cfddd86c6828ce44ae5076a7d0482ac59970c
SSDEEP 6144:ZhoZ9uxmHvG9+ai0lq8whIYVTw+hFD+7t56OD9ZfSAppr8:Z6K8+9++3wS6wyFSXD9ZfS4m
TLSH
T1464423377A9ACDB3C6BD710270577B28DEA19DE994C9724AC45987CEC01FE8C0563A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 a978427e18c7dc7b4af43408e346e66ae6620b82abbe53b0e26dd91350a5ec97
MD5 9aee23a96145259012f0f833f474ed1a
SHA1 faa744924a4cce909e0bbe301b84adf2c9e8e319
SHA512 457a25cba8ca8063b44cedff152023c4757589c619b6da8d8adbb31bbc6f01ad5d1610a2f75351b47b9692173fc0a7816c28246a02eb290d239ec096a92b5d83
SSDEEP 6144:rXoZ9uxmHvG9+ai0lq8whIYVTw+hFD+7t56OD9ZfSAppr8:sK8+9++3wS6wyFSXD9ZfS4m
TLSH
T1EC4423377A96CDB3C6BD750270177B18DEE19DEE9889724DC459878AC01EE8C0963E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 b4272d74087482ba8be4c7902131bb7d27804cee2a13c7ef719682bb153ac001
MD5 e9589586717103f066023311095b16d6
SHA1 944cd628857ab2313c09d63c4a16d1162ae6d405
SHA512 fe7d599289fda77eda7e80f35db56011e1f866c531e55fdcb68e90e4e0e40d78ca494366f1b298be65f318aa989a93cb5b8776e85ed68182fe975186fbe5d2ea
SSDEEP 6144:ohoZ9uxmHvG9+ai0lq8whIYVTw+hFD+7t56OD9ZfSAppr8:o6K8+9++3wS6wyFSXD9ZfS4m
TLSH
T1DF4423377A9ACDB3C6BD710270577B28DEA19DE994C9724AC45987CEC01FE8C0563A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 4793ca08667e2d50ad7cece10a2bb7192ef19df16ca7aa64919e8bd14cfc6153
MD5 6fdc97b07d988428ab80f1c96e753dc2
SHA1 a41aff881c7adaa067940dd8cb9f69e1e7486b36
SHA512 97c7f9441ed9043bea1d4b0d7b729afe9d79dca3153fa0360073af5ec2cf29ee76f256ca5420c6e3a655affdfe1062fd6f2f070c564500fbcd10841d29dfce12
SSDEEP 6144:aXoZ9uxmHvG9+ai0lq8whIYVTw+hFD+7t56OD9ZfSAppr8:bK8+9++3wS6wyFSXD9ZfS4m
TLSH
T1664423377A96CDB3C6BD750270177B18DEE19DEE9889724DC459878AC01EE8C0963E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 7939bb70c5377ab8ab4b70f6f32ab27ececed569ad4dc2d32881ebddd4e5e128
MD5 a108f9375796110e83d834ab0d077782
SHA1 daa1dcab494c87389e98c738d0645daf24ce58d1
SHA512 02438722d0dbfec15ddf79ad003a45348feedf6c9c7afbd188807cd46c084c87cb778ecf7d3f5296fa0a54c17a4b696e66404ba699cf68058b21e274d23960fe
SSDEEP 6144:fXoZ9uxmHvG9+ai0lq8whIYVTw+hFD+7t56OD9ZfSAppr8:QK8+9++3wS6wyFSXD9ZfS4m
TLSH
T1874423377A96CDB3C6BD750270177B18DEE19DEE9889724DC459878AC01EE8C0963E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 d51473c0b81cef1dd0ecef97f5049509b465da7271200e9c59a304de42b2eac6
MD5 c3b6ef95c86ffa5a8da731b107c4a964
SHA1 d60e55c24b63586f83d719b648aa23e533b719df
SHA512 1da4b4dc802693ea870d03efd7cba64ce57c9f872585657e85852db38c107686777c591066d07041d35b45f898537703e8742e09f8c8b15abfcfd4e66641a6a8
SSDEEP 6144:fXoZ9uxmHvG9+ai0lq8whIYVTw+hFD+7t56OD9ZfSAppr8:QK8+9++3wS6wyFSXD9ZfS4m
TLSH
T17C4423377A96CDB3C6BD750270177B18DEE19DEE9889724DC459878AC01EE8C0963E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 23e4ce68647df9631c88bc051914b2fa1510163e55014a9642ae69231f563da2
MD5 7bbc0d7fdb42e2df4a2d6075be2e81da
SHA1 55e98d04a29f71e5b457144fd5f8cd96726e35c3
SHA512 51b281069a6484ea1e635401f552281592ebe527338706d6bd1f2a4e469d095d1f3ffd04faf8cbfdb262fcdea25c977377c0fa1361c91d382b3d10e7a4893b0f
SSDEEP 6144:TXoZ9uxmHvG9+ai0lq8whIYVTw+hFD+7t56OD9ZfSAppr8:0K8+9++3wS6wyFSXD9ZfS4m
TLSH
T1224423377A96CDB3C6B9750270577B18DEE19DEE9889720DC459878AC01EE8C0963E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Size 28KB
SHA256 4e5fe3988b924118928de8175ddb168ef7d98dbad789e57aa4e36b210ae809b0
MD5 2be2cd63fc070f303d455393a8af101b
SHA1 4526c709e4e554c5facce6a74ab341904c0b688b
SHA512 47263caa2c947ec856fe400f17cfbca1773f7068487b197b9165b7ba57468f11e495942fb0f5d2298fde7dc66b40861bb7a75c5f7e82c8a71bc671a5a077b86a
SSDEEP 48:k+XlSLWH/yvx6KEfWrXvJGzz/XfmLRcBKvdees743gzCzUY8D+LFD2ky5VuxNp1j:flPHIsfBPXuLm+eesU3ghY8D+PyC6/LK
TLSH
T1D6D239667D34DA51C84A207C2DAFCFEEAE29FDC5CD1440173AF2FBAF88B48068410118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QR.PNG

Path C:\Users\Admin\Desktop\QR.PNG
Size 22KB
SHA256 c4338601d10c2abe6682837e88fbecd5feec15ca97aac12d67c262f5441cc963
MD5 a4c148f12be1aef2975ef31e022eeb65
SHA1 b829cfb949b76f80cc7c8253892eba1a3982ac4d
SHA512 f6682f195c710205a91e304e554fede804a9c55cbaf8de25df04852bd26c90944061f455364daa7428a94ca3c3a6bd2772c0314acc877daa6a37d6b0648d1feb
SSDEEP 384:xRIxNA0yTc+zRlW5SSr1x6e/muyz2vNuIYtD7h6iAjUJGerXFWal1iD2Dj2mxKmu:b3TcWRlax6fz+YtD7gi3AWLjVomu
TLSH
T168A2E010FD56E935D9AF232C9E6D97503008C07BB9ED086C8D9DD6D78EB29C3BAA1190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download