b474d0b32ce45b5938174a484e37e62cd2bb309fee472b13cec7f8576432e20e

Analysis

user interaction
yes
max time kernel
628s
max time network
630s
platform
windows11-21h2_x64
resource
win11-20260911-fr
resource tags

arch:x64arch:x86image:win11-20260911-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
30/09/2026, 09:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 326KB
Sample260930-l1fqjayapb
SHA256 b474d0b32ce45b5938174a484e37e62cd2bb309fee472b13cec7f8576432e20e
MD5 5beb7bd07da9cb5775adc41859378dba
SHA1 10f709c0f5f85baba13898c030f378d06e1dd5bb
SHA512 ab5a8912770828fc781374c91b17a7c3a6d881ab233658c61f587ce43d27fb7650d0e01ddde7b1e77d639c6790d4fcd8ca0682f262b5cc9f00d798070a2644d6
SSDEEP 3072:SYtgAkHnjzxQ6KSAiTMHU88aW+LN7uxRLlzglKKf22/k:jgAkHnjzxQBSA3088CN78BKf22/k
TLSH
T1B0642C25E5D2607F682B8033F17F3318B73FA483A101C969BA1CC5E5AFD19862177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
262	1856	chrome.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	adwcleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	adwcleaner.exe

Executes dropped EXE 7 IoCs

pid	Process
3180	OrderAndChaos.exe
5796	OrderAndChaos.exe
484	OrderAndChaos.exe
2096	OrderAndChaos.exe
4880	OrderAndChaos.exe
3916	OrderAndChaos.exe
1504	adwcleaner.exe

Loads dropped DLL 30 IoCs

pid	Process
3180	OrderAndChaos.exe
3180	OrderAndChaos.exe
3180	OrderAndChaos.exe
3180	OrderAndChaos.exe
3180	OrderAndChaos.exe
5796	OrderAndChaos.exe
5796	OrderAndChaos.exe
5796	OrderAndChaos.exe
5796	OrderAndChaos.exe
5796	OrderAndChaos.exe
484	OrderAndChaos.exe
484	OrderAndChaos.exe
484	OrderAndChaos.exe
484	OrderAndChaos.exe
484	OrderAndChaos.exe
2096	OrderAndChaos.exe
2096	OrderAndChaos.exe
2096	OrderAndChaos.exe
2096	OrderAndChaos.exe
2096	OrderAndChaos.exe
4880	OrderAndChaos.exe
4880	OrderAndChaos.exe
4880	OrderAndChaos.exe
4880	OrderAndChaos.exe
4880	OrderAndChaos.exe
3916	OrderAndChaos.exe
3916	OrderAndChaos.exe
3916	OrderAndChaos.exe
3916	OrderAndChaos.exe
3916	OrderAndChaos.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dll\uxtheme.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\sspicli.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\ncryptsslp.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\sspicli.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\DLL\dpapi.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\DLL\dpapi.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\dbghelp.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dbgcore.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\libopenal-1.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\mskeyprotect.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\ole32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\webio.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\sechost.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\DXCore.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\cryptbase.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\msctf.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\msvcp_win.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\oleaut32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\gdi32full.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\fwpuclnt.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\msctf.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\DLL\dbgcore.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\webio.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\uxtheme.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\schannel.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\ncrypt.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\IconCodecService.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\libssl-3-x64.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\glu32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\ws2_32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\CLBCatQ.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\msctf.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\winmm.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\msvcrt.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\sspicli.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\msvcrt.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\ws2_32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\Kernel.Appcore.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\iphlpapi.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\DLL\dpapi.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\shlwapi.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\libcrypto-3-x64.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\opengl32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\fwpuclnt.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\msctf.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\shlwapi.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\libwinpthread-1.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\cryptbase.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\uxtheme.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dbgcore.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\msvcrt.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\ncrypt.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\winmm.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\DLL\cryptbase.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\dll\glu32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\zlib1.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\IconCodecService.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\libopenal-1.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\msvcrt.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\symbols\dll\gdi32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\system32\CoreMessaging.pdb	OrderAndChaos.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1504-1128-0x0000000000890000-0x00000000021ED000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\IconCodecService.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\CLBCatQ.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\glu32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\webio.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\DLL\dbgcore.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\DLL\schannel.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\bcrypt.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\sechost.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\shell32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\msvcp_win.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\cryptbase.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\webio.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\CLBCatQ.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\opengl32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\mswsock.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\ole32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\Kernel.Appcore.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\CoreMessaging.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\Kernel.Appcore.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\ws2_32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\comctl32v582.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\gdi32full.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\ws2_32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\crypt32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\ole32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\exe\OrderAndChaos.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\dnsapi.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\gdi32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\fwpuclnt.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\DLL\dpapi.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\dbghelp.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\advapi32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\mswsock.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\zlib1.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\winmm.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\webio.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\IconCodecService.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\crypt32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\glu32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\CoreMessaging.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\mskeyprotect.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\Kernel.Appcore.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\libcrypto-3-x64.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\dnsapi.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\CoreUIComponents.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\shlwapi.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\bcrypt.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\comctl32v582.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\ncryptsslp.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\mskeyprotect.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\winmm.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\bcryptprimitives.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\msctf.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\libssl-3-x64.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\DLL\winnsi.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\libssl-3-x64.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\ntasn1.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\ncrypt.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\dll\bcryptprimitives.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\oleaut32.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\iphlpapi.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\msvcrt.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\symbols\DLL\dbgcore.pdb	OrderAndChaos.exe
File opened for modification	C:\Windows\dll\IconCodecService.pdb	OrderAndChaos.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\adwcleaner.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OrderAndChaos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OrderAndChaos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	adwcleaner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OrderAndChaos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OrderAndChaos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OrderAndChaos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OrderAndChaos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OrderAndChaos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OrderAndChaos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OrderAndChaos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	adwcleaner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OrderAndChaos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OrderAndChaos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OrderAndChaos.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adwcleaner.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1856	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings	chrome.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\adwcleaner.exe:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1504	adwcleaner.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
5608	chrome.exe
5608	chrome.exe
4852	OrderAndChaos.exe
4852	OrderAndChaos.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
3180	OrderAndChaos.exe
3180	OrderAndChaos.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5124	taskmgr.exe
1504	adwcleaner.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe
Token: SeShutdownPrivilege	4164	chrome.exe
Token: SeCreatePagefilePrivilege	4164	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
4164	chrome.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe
5124	taskmgr.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 5176	4164	chrome.exe	81
PID 4164 wrote to memory of 1856	4164	chrome.exe	82
PID 4164 wrote to memory of 5884	4164	chrome.exe	83
PID 4164 wrote to memory of 5884	4164	chrome.exe	83
PID 4164 wrote to memory of 4892	4164	chrome.exe	87
PID 4164 wrote to memory of 4892	4164	chrome.exe	87
PID 4164 wrote to memory of 2308	4164	chrome.exe	85
PID 4164 wrote to memory of 2308	4164	chrome.exe	85
PID 4164 wrote to memory of 2204	4164	chrome.exe	86
PID 4164 wrote to memory of 2204	4164	chrome.exe	86
PID 4164 wrote to memory of 4848	4164	chrome.exe	89
PID 4164 wrote to memory of 4848	4164	chrome.exe	89
PID 4164 wrote to memory of 3792	4164	chrome.exe	90
PID 4164 wrote to memory of 3792	4164	chrome.exe	90
PID 4164 wrote to memory of 6072	4164	chrome.exe	91
PID 4164 wrote to memory of 6072	4164	chrome.exe	91
PID 4164 wrote to memory of 2508	4164	chrome.exe	94
PID 4164 wrote to memory of 2772	4164	chrome.exe	95
PID 4164 wrote to memory of 5580	4164	chrome.exe	96
PID 4164 wrote to memory of 5248	4164	chrome.exe	99
PID 4164 wrote to memory of 5248	4164	chrome.exe	99
PID 4164 wrote to memory of 2408	4164	chrome.exe	100
PID 4164 wrote to memory of 5608	4164	chrome.exe	104
PID 4164 wrote to memory of 5508	4164	chrome.exe	105
PID 4164 wrote to memory of 5508	4164	chrome.exe	105
PID 4164 wrote to memory of 4052	4164	chrome.exe	106
PID 4164 wrote to memory of 3700	4164	chrome.exe	108
PID 4164 wrote to memory of 3700	4164	chrome.exe	108
PID 4164 wrote to memory of 5132	4164	chrome.exe	117
PID 4164 wrote to memory of 5132	4164	chrome.exe	117
PID 4164 wrote to memory of 2200	4164	chrome.exe	118
PID 4164 wrote to memory of 2200	4164	chrome.exe	118
PID 4164 wrote to memory of 3912	4164	chrome.exe	119
PID 4164 wrote to memory of 3912	4164	chrome.exe	119
PID 1732 wrote to memory of 1524	1732	OACLauncher.exe	120
PID 1732 wrote to memory of 3180	1732	OACLauncher.exe	123
PID 4164 wrote to memory of 4072	4164	chrome.exe	124
PID 4164 wrote to memory of 4072	4164	chrome.exe	124
PID 4164 wrote to memory of 5480	4164	chrome.exe	125
PID 4164 wrote to memory of 5480	4164	chrome.exe	125
PID 4164 wrote to memory of 984	4164	chrome.exe	126
PID 4164 wrote to memory of 984	4164	chrome.exe	126
PID 5012 wrote to memory of 5796	5012	OACLauncher.exe	131
PID 4492 wrote to memory of 484	4492	OACLauncher.exe	133
PID 4636 wrote to memory of 2096	4636	OACLauncher.exe	135
PID 5524 wrote to memory of 4880	5524	OACLauncher.exe	137
PID 560 wrote to memory of 3916	560	OACLauncher.exe	140
PID 4164 wrote to memory of 836	4164	chrome.exe	141
PID 4164 wrote to memory of 836	4164	chrome.exe	141
PID 4164 wrote to memory of 6104	4164	chrome.exe	142
PID 4164 wrote to memory of 6104	4164	chrome.exe	142
PID 4164 wrote to memory of 4500	4164	chrome.exe	143
PID 4164 wrote to memory of 4500	4164	chrome.exe	143
PID 4164 wrote to memory of 3084	4164	chrome.exe	144
PID 4164 wrote to memory of 3084	4164	chrome.exe	144
PID 4164 wrote to memory of 2776	4164	chrome.exe	145
PID 4164 wrote to memory of 2776	4164	chrome.exe	145
PID 4164 wrote to memory of 3436	4164	chrome.exe	146
PID 4164 wrote to memory of 1504	4164	chrome.exe	147

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc00cbc728,0x7ffc00cbc734,0x7ffc00cbc740
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1908,i,16078105913734202333,17681754291969666362,524288 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,6522455491435623811,2570656078188164267,262144 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,1081559615908583763,16487392786852951817,524288 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2700 /prefetch:13
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,4756819184635080501,3910414355801696211,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,9221871494479952107,11346469797681531081,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4604,i,12368269333286090290,16256425898338934997,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,4818371125849600372,8277091179290267417,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5412,i,17354580266037176168,12248122206620793580,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4284,i,7918181246975149688,10055716109610993290,524288 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,3051090740740330404,15404090519725736960,524288 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,15358041609368757231,15688658784917904211,524288 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6204,i,6101347107213398348,6789508502360328764,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6516,i,17537230429136314150,2656290097080450701,524288 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5356,i,16540638511679191920,17955984484778919423,262144 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5568 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5584,i,17922471311645227855,13728710397018461625,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,16403084689686091163,17716004658910038162,524288 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1008 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,14413043578376204061,16319807276366647219,524288 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5288 /prefetch:14
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6524,i,2136508604409928139,7783615423505697347,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4728,i,5140551795612219665,14645596592150756788,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4624,i,10740252650927226687,16140071569076905548,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5068,i,4220015791664533872,14465470016159319935,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6788,i,10664592027583561566,11930931799949878633,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6856,i,1465814386133470726,3092131234223478766,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7072,i,8762014125686773167,1441335523167545374,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=1492,i,4399952656442061104,16890073571903363646,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4696,i,164677808153369814,2597914643156516846,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6872,i,16977305462331716449,3668936208294040806,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6864,i,7346922835466506218,14435020578023211882,2097152 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7308,i,6249548752262788189,13333979369982372006,524288 --field-trial-handle=2040,i,7596830758383507112,5945896277939352048,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7436 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3436
- C:\Users\Admin\Downloads\adwcleaner.exe
  "C:\Users\Admin\Downloads\adwcleaner.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3552

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5844

C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe
"C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4852

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:5124

C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OACLauncher.exe
"C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OACLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SYSTEM32\tar.exe
  tar.exe -xf "C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_update.zip" -C "C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_launcher_extract"
  2⤵
  PID:1524
- C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe
  "C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3180

C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OACLauncher.exe
"C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OACLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe
  "C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:5796

C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OACLauncher.exe
"C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OACLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe
  "C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:484

C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OACLauncher.exe
"C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OACLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe
  "C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:2096

C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OACLauncher.exe
"C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OACLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe
  "C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:4880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:5880

C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OACLauncher.exe
"C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OACLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe
  "C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\OrderAndChaos.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  PID:3916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 33a1b6ee4d8692a981821822d6eb620fb698df8241fbf000084fbf7bc35f7337
MD5 97c437beba28292447a7d8832fc026fc
SHA1 28aae928dd9e11ae08337a730dff565386d13f0f
SHA512 4035a70268025fec741ed5492c35bc67ba0534025bbd952a238a023acedd1967f4b6f686caea116143e74d158210a7c8fe10a70bf4447d8daea9ef477c5095d1
TLSH
T149F028B5CD21EC3719FC171D60650B47EB50136B2B81C88F3A3D810C8FB0A3B469686C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003f
Size 51KB
SHA256 b3ade78460aa887eff8e3d880d7f30bffe1baa6db7101ed3d5bafcc260d08454
MD5 9b172f0b44edd14e920331c76312ea78
SHA1 8f7eab637b92f232b2c7d9d0bc1e2de7f9006b8a
SHA512 15b41243a2bf002df996fa874f58bd638c2f6ec42ba7dba78296e5dcccd3b56470fabf73943a7385f9ca74af61c7bda69ae96315a6b639eaac5663370c2df657
SSDEEP 1536:hNVpRFjaDYn42Uavg/6695cz3qA2XzMsWu9lmQh2H5t:h9Deeu/ruzq9XzV1nQ
TLSH
T1E73302E1F7194D1479687F0B2F8A48DF9CBCAD00B0C2DE8C964B71AD154C6878B9CC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000043
Size 27KB
SHA256 378085b2b8c0ac4bb3b9b0c7ee1cc0ea856a158875be4d3e0d2a234114599043
MD5 ef2e1bb8ed2bd995b1801e1f3d3d2f6b
SHA1 e92408f3a6093e73ddd7ae80bbec218c9d6f7c70
SHA512 9449d0b4c963e36219897d5ee629e2809b45d207e8bcd0182339fb816b5211f99f10589450732e39c13ce15d9e6f0001c6f7a541179cf093a6fa834f1edbf49f
SSDEEP 768:gTBE8PQqZELS1R3fOuFYKNZPXSBfj5moBT+6CjID:gW0QwLR3GuFYKNdXS19LdYQ
TLSH
T121C2E1B3542B8118EE44C3D39D9BCDB0F2D099A1040764686D8DEA3ADBD398FE7476E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 844bd00eebd209b664e873b2aa79208b975639a607f65fb5b458911778114784
MD5 3d07be4024a1637b084c53c7b9630b5b
SHA1 0602fa514a479dc4609af715356362eee43e2afd
SHA512 2fc9ed800f5bf34a931809fa54bd9344782dc1781c20cb1a53f96292957c5c25de12cf0cd5b8c7b68252733460d77bec21120c2b143f99422caa560adf70ba9b
TLSH
T14851766879AB4091EF60E77DE0F108F0B4B0768823675E17609814787CF33EC9B69A85
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 e3b5f351873755592c7bf0dae66b041f72d9e026a4193cd566940dc33c7a277a
MD5 02edc4d2b3906fecc386916cb9fe7fc7
SHA1 0df26d417e716d1a750b3f6b02c3a14feec6b384
SHA512 990ccada30c1f0f64d63188a2e7b708bdfd9f324a3dafac01e68464d9d108526fd56559b81eae77682bfdfb04b5c3ba1e4b3e2debb1d44c03ee0a1be0b72f8c9
TLSH
T164C02B1101430041E370CDF1D2C7006030342C2533065981C0F1C448BD2358D431A080
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 250e614d1ecf7128d5a2e91d9c1e03d4c8974c9ea68bd14e3cec9ca2686ddbf3
MD5 f9b80c34c113d195814543ead79ea2ef
SHA1 42eefd857a311646d8d23c477644cca4ed4a2576
SHA512 7c26576e3232fe57f2bee743bd8de918ba1e18685f9f9d9b9763b78c704ea4c494b9550e69857bed12e3f36510e43bd02bbff1e5f9a87dc84632c2fa01bcab25
SSDEEP 384:D8oFPeUvZq43mtdnEqJ2JAWsRnnUES6JRaZF1XZmRWMZ+QApZKqfLeER67Sii4RB:OYxpeHqGA7sX
TLSH
T16B729DB7C3D8862DC81162F49B257E1BCD2E0919532C3C6689E9FE5B63E14B2D25134F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2cdcb627bff9500c650ce386c1ff97b14fe3fc05fdc1fdd81b7ad9c2c3444dd2
MD5 6986d19dd9077db9588e0dee6715489b
SHA1 d75ef0316bd175a0885204a3c0f362e0ce6296f7
SHA512 d90beca2b99356bd35a1d4416004d7dbb2e77d782b8abb719b4fca930b8a1e567e7041a7bf7810d46d1ab4e8c4fea996474e3c940cba96ca345a8ed8dd4b65ab
SSDEEP 192:D1WbyelCJR5un7ZoU1XZMQWMZ+QApZIqfL+ER67SsudK:D1WbyelCJR5un7ZoU1XZMQWMZ+QApZID
TLSH
T108E188BBC3E8877E881152F49B256E1ACD59151B432C3C528DF9AE1F63E19B1D20168F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 1ea08172fdce842e7874346f35c5ded021fb4e4a4e838baa36c5bf972c01019a
MD5 05b23fc5bbe7dc7ef77604d290dd194a
SHA1 e9cb69bd8dcfd06b1666f01469e95dd46894284f
SHA512 8f65db232440cbcb6bc5eb612e5f350d1ff0d1a51ca5f366a6133e424dd5518ec7f88a60b12b2be853ed11fa3194727f475c0454353fed926f364a770820a118
SSDEEP 384:D8oFPeUwZq43mtdnEqJ2JAWsRnnUESXYJRaZF1XZmRWMZ+QApZKqfLeER67SiJ4F:rY7peHqhA7sZ
TLSH
T19D72AEB7C3D8862DC81162F49B297E1BCD2D0929532C3C6689E9FE5B63E1472E25134F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 dc0cb9dba6920a7e24eee8c908ddeccf8fd3de3ecb0c02c72bd0358c8820fbe0
MD5 63ecacab1bb9d5f5b82b696522f6dd15
SHA1 1b8c526328fdf464cb15e0c7bf588d100da2e673
SHA512 4ce80583093e31dd60d15c8826b89e1c39628d9b77b48228a8e446b74892b602e93ae567724f650effc5ac4403eb92dacc3fce4a9b47763bb8654004e280631c
TLSH
T17E219CAB827FB867206D496B0D45BC0968BFA832164254F4EE67917CB0C54F35B12867
MD5 SHA1 SHA512 TLSH

Submit Download

b6b1d421-eeff-4348-8871-e9fdb9452a51.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b6b1d421-eeff-4348-8871-e9fdb9452a51.tmp
Size 6KB
SHA256 437b6f3372f7559d672fe4a2eb226e9da0d3814e78efd45afb6386c7b6c215f9
MD5 ac3c7b05e9251f2363b210aa8b4abda2
SHA1 b95ec4ae6fa3e15ed3bbc9a717b9eb7a913eb7da
SHA512 e6b556793e1a26903b4ceeb429d9b9bca21bf2a9c14643d49c0424ac528a42e8d7243b860e4c71869b19464fcc2b1f1fd19be523fa4aba8ad29473d6ee0d4ecf
SSDEEP 192:D1WbyekJR5un7ZoU1XZMQWMZ+QApZIqfLJ+ER67Sl:D1WbyekJR5un7ZoU1XZMQWMZ+QApZIq3
TLSH
T1C7D199BBC3E8877E881152F49B256E1ACD19151B432C3C528DF9AE0F63F19B1E20128F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ce63ceb6653f753e2e71caed9b661408f809042918cafe67440f22434af1dc51
MD5 e9b0aac3c8b577d3d78418685058ff20
SHA1 c7593c5de4ef7cd16b626def19f25243e0e34a81
SHA512 827d357c886a938872aac26f42a7d0502e4b4a20f8a40b7a1ff2d636ab8f50113d33fea30e8585b48eebbecb127892fe338a9e08b8e5a3a6f852b6ad8c726930
SSDEEP 192:NR8RHEBbv7qNvAPRp2b19fHsb+WNn31PzN284eUQlsFVyIsnAUg5U:NR8RYjm6XmdwFP528Cz5U
TLSH
T1D932A52DAE24757B5DEBC219FA657B97D3F6102120942E84EAFC8C3C24E79CC221745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 94e172e1774f7e526ed99f1d6bbf2e366deb9849c14dabd1a6a16b51c0225d7b
MD5 2d7b89f8627df55f4e48f38607b9b9fc
SHA1 27fd9f87171f7f89d5aaf72a4a2e86b9e520d0e5
SHA512 6f86b25d37503e0e99b6162c6118a8dc5f1c80f81a1faaa86085c5ab43cad9e7d6b1d6702051faafd57b50a45b32f515dff7104db66ab96493f00ecf1b568b2e
SSDEEP 192:NR8RHEBBv7qNvkPRp4b19fHsb+WNn313Gz2wN284eUQlDFVyIsnAUgQU:NR8RYRmOXwdwFo2U28hzQU
TLSH
T14A42D82DAD24797B5CE7D219F9667B97E3F6102120902E88E6FC8D3C20E79CD221745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e0f6277ec91d8c659b94c274dcda35521fa951de819a2cb2fba84c934fa34c05
MD5 ff9a79b59d07b4c33fe75ec9ee4ae163
SHA1 8554fc642311d934fa3f327c03f5550ed92a7a3f
SHA512 b04e0d28ec3d70bf992a17a027d4ecf3dff929cd99b0660e5ac7f65c4cd4bc8c96e91e2f0fd47e757a12aadff74f59bde2f011a6426ae615a5faaba367c5270b
SSDEEP 192:NR8RHEBbv7qNvkPRp4b19fHsb+WNn313Gz2wN284eUQlDFVyIsnAUgQU:NR8RYjmOXwdwFo2U28hzQU
TLSH
T13D42D82DAD24797B5CE7D219F9667B97E3F6102120902E88E6FC8D3C20E79CD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 81e85d8f61186eadeba9c170bd4ea32cb7f78e521e26640a0173a8662c6eb0c7
MD5 68033b2d4f628be47ccd7290d64ca6dc
SHA1 117e8a1027798811de0236087bd8e4e8ba2d7f40
SHA512 eb32a5122323474b02a295b5c831124e70cc65dca742e5e73a487f42d35a7cec769e073e40e12c1f2b5f4d16ad7ac7c9162e6b8315847a1304494ae25131a612
SSDEEP 192:DRccBzRHEYBv7qNvkPRp4UK9Ah9fHsb+WNrYugyrkGz+5OY9N284eUQlDFVyIsn3:DRcmzRjRmOXtdwJ1rhRYX28hzQf
TLSH
T12452D92EAD24397B5DE7D219F9657B9BE3F6102160902E88E6FC8C3C20E79CD2217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 064ba2ea536b8ef219de60289a5781f685735516bd2195dd29499038f60cdc72
MD5 9b850878564363f86a410c617dd94d27
SHA1 556fb868e0581bbd2dc0cda63cab1e1ad83fc3a3
SHA512 5093b94d9b0cac61295e61b0f1cc66a712aca43d110d72e2138739edad0cd7942076ad1ac59f3c9b008395e68f02729ebc461cf4c10e264bf148d4e67204309d
SSDEEP 192:DRccBzRHEY0v7qNvkPRp4BqK9Ah9fHsb+WNrYugyrkGz+5OA3mso4N284eUQlDFs:DRcmzRjwmOXNdwJ1rhRAFos28hzQf
TLSH
T10C52D92AA964397B4DE7D219F966B79BE3F6102160C02E88E6FC8C3C10D79CD3217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 04ece09555f2adf1ab947509b8fc308d521ec54fe52ac87b2350adbea943a7bf
MD5 877bc76d15428ff1e937a881a9a5d3a9
SHA1 f6edbe383e9f5524bead563a324a11b92fadb0bb
SHA512 c69420c14d23e79176f9c61f76d8c214505c106e07b5a71ddb516aa0c360537f94b4742f05e5b3552b21aa15dc5b7a626eff4e6f669583c06973a9d53539be29
SSDEEP 192:KRccBzRHEH0v7qNvkPRp4Bqf9Z8h9fHsb+WNL5MS/Gz+nV/KmsoTN284eUQlDFV5:KRcmzRcwmOXQdwzAwkoZ28hzQg
TLSH
T1AF52B86AA964397B4DE7C219F9657797D3F6102160C42E88EAFC8C3C10D79CD3217847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9c09d71111347abcc4efd113da1943cf2b80627a3f2cd0cdf621560744333d6a
MD5 44af75db912f0fbf2045dcfc3dca31e4
SHA1 0c1a7cf48d078671587825ca7d2722f5864cfc67
SHA512 dbab6da6dd8c5f8e11ac0561805a129b70e568560273f2aabfca877e219c5189c1efc0ddfd7595dbe22a167c0ceed3a82ea57502557851251b45157848b88285
SSDEEP 192:KRccBztHEH0v7qNvkPRp4Bqf9Z8h9fHsb+WNL5MS/Gz+nV/KmsoTN284eUQlDFV5:KRcmztcwmOXQdwzAwkoZ28hzQg
TLSH
T1AF52B86AA964397B4DE7C219F9657797D3F6102160C42E88EAFC8D3C10D79CD3217847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a387921c174b79af7798ba9f09bb0d1dfb6ac2517369c9469db483fcde315928
MD5 1699a30b6d610be0f7cd26b78e8b6822
SHA1 ac6ba31b3e91cc82b176659db432adc4979a7682
SHA512 041cfcb11243f21345685f6c03157a94d5c3bf624893935e4e7837257b312d5c7e5618d05b22c6502aa529a192d7758fdf9963ae773c94084a5fb212b3caeb59
SSDEEP 192:KRVcBztHEH0v7qNvkPRp4Bqf9Z8h9fHsb+WNL5MS/Gz+nV/KmsoTN284eUQlDFV5:KRVmztcwmOXQdwzAwkoZ28hzQg
TLSH
T11D52B86AA964397B4DE7C219F9657797D3F6102160C42E88EAFC8D3C10D79CD3217847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6c362d2cb091fd08d2fcd5c052ad9b81556b218f5b9167ad842663e8cd6debab
MD5 04a934a6a50aeec1a60b2c92accda506
SHA1 3b57287c3841fde53305323fc456a9d4aca2eb43
SHA512 5c752d05ef26afb48e6d915745fe6ed707fee74d3986eace116fc86d6b028b90327cf756b41018971248006b7f95f0472bf45dcc947777b1a90142b34623e02f
SSDEEP 192:DR8RHEYBv7qNvkPRp4UR9k9fHsb+WNnugyrkGz+Ru2BN284eUQlDFVyIsnAUgQU:DR8RjRmOX8dwu1rhN2b28hzQU
TLSH
T15142D82EAD24797B5DE7D21AF9657B97E3F6002120902E88E6FC8C3C20E79CD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4f79334ae9f4b4f1e90d14ddb35fa84003253fc4afd691518dc9e041bddc2e35
MD5 829f4aa595d8736ca794f762cb82a3f5
SHA1 4cc6e422d383ff034bc4f8a4ca46e8cfe06bf115
SHA512 427d7234df8dda8944a7269d65fe4da4bc33186b170fd4007c30d17cebe258c66777e8d3e63e5b62f5ca6173fad7d4e7e8e8f5616c44a588a244ea37fe6e8082
SSDEEP 192:DRccBzRHEYuv7qNvkPRp4BqK9Ah9fHsb+WNrYugyrkGz+5OA3uV2UN284eUQlDFs:DRcmzRjKmOXNdwJ1rhRAU2I28hzQf
TLSH
T11352D92AA964397B4DE7C219F965B79BE3F6102160C02D88E6FC8D3C10D7ACD3217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ecae8e5147b5cc3ecb3701ac8701334e78e6c2b98e3596ac8f810b081c0c88db
MD5 de249ed5dd91d4e83062530e2e2c2741
SHA1 6d950287b2b27f70e0be49d7a7a3612b580e8586
SHA512 a32780a4fa2e2e45c50339a2c011c1afbfc02644744893c1b42611a9dad2187d9589b4c140a238235f2da250b6ee97f27243510637ace10bf69cd253bf9ede31
SSDEEP 192:DRccBzRHEY8v7qNvkPRp4BqK9Ah9fHsb+WNrYugyrkGz+5OA3ns2PN284eUQlDFs:DRcmzRjomOXNdwJ1rhRA82l28hzQf
TLSH
T18052E92AB964797B5DE7C21AF965B79BE3F6102160C42D88E6FC8C3C10E79CD2217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3b98f11936823515aa25e125b1bd696019ba726681450bde1a28fe23438874f0
MD5 97385f6d29ab87561d999b013d39dd8e
SHA1 7e3e68bd1327989787163c9039854b4f6fdc9298
SHA512 c4f0cd9e8671a0f4b1a1f109ed1847d7d5f1b321bdb4d5a5e86d5a607864981671c10317dd2c253a752fc3c30529386be5f0a2bfec1edf8cef722c774b3f950a
SSDEEP 192:DRccBzRHEYev7qNvkPRp4BqK9Ah9fHsb+WNrYugyrkGz+5OA3uV2UN284eUQlDFs:DRcmzRjamOXNdwJ1rhRAU2I28hzQf
TLSH
T1B252D92AA964397B4DE7C219F965B79BE3F6102160C02D88E6FC8D3C10D7ACD3217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5bceed560225a62a52aefd075d58862c6e43412cc51afce1a21472deb60443e2
MD5 46f85a509ccf7b2390fbc6b31d1490e2
SHA1 ebf700ab9f23e5344092ceaad8430e731b29c41c
SHA512 cfedaa18a21e30f814b65a6abfc518d4730f92230627d6e9069c043e84c9b43be6f72e3f7a1f87c643fb1618da90aef8328eb556239d21992174c92c3dcfe43e
SSDEEP 192:NRpRHEBbv7qNvkPRp4b19fHsb+WNn313Gz2wN284eUQlDFVyIsnAUg2U:NRpRYjmOXwdwFo2U28hz2U
TLSH
T1A142C72DAD24797B5CE7C219F9657B97E3F6102120902E88E6FC8D3C24E79CD221745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 53d25e7c3ea69d3cdf0681df3f9c271793c3508b4c84d47c23025278938fd305
MD5 81b166d3bfa6aef36626b9c71e6b3719
SHA1 7ec4e0984809a4553bcd0fdf73b41fe8dc9ff29c
SHA512 99feb2650bc8ee05b690c0e1f487f5dadf05b0898e66f39f3fb9ec9ed8438d16b636dc4f6cc96fe200cc75f70d88ccc03a35bf6bf0b2fb645224172d9960b9ec
SSDEEP 192:NRpRHEBbv7qNvkPRp4b19fHsb+WNn313Gz2wN284eUQlDFVyIsnAUgQU:NRpRYjmOXwdwFo2U28hzQU
TLSH
T19642D72DAD24797B5CE7D219F9667B97E3F6102120902E88E6FC8D3C20E79CD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2717a859ae83f2b806ff336b91ac2fa72a16876bc5577e9a0c56674a3948d114
MD5 05f2e2830c264d12dd1a9cb528855e7b
SHA1 501512cfe58dde682f586cacfae19c85c57c5594
SHA512 28d55e91bd38dc2e6eb8d7cf04d37b567cdc9724aaffdf25c71fc089a6e1197c541578041db183eac84945d6ebb950fa83bab9f6965d873a13df8465da8d43ad
SSDEEP 192:DRccBzRHEYtv7qNvkPRp4BqK9Ah9fHsb+WNrYugyrkGz+5OA3uV2UN284eUQlDFs:DRcmzRjNmOXNdwJ1rhRAU2I28hzQf
TLSH
T16A52EA2AA964397B4DE7C219F965B79BE3F6102160C02D88E6FC8D3C20D7ACD3217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ce44e02afe86df7a21ea9718fd170471cdc2bea9403a35efc034d1c83145badf
MD5 ec24d354b1958d9abbb50f147d4a5ad6
SHA1 db4f9d9ad6cf79be54f593524fd64fc42dd6ebab
SHA512 7f260f5fe288e7ed9a4a06d408837544578dcc26c74856e8510baa49b3f3d89a0ed0cdba8fb9f68da5389b64e4cc5f2cfe49d729347e96c7d68a71bd0e749694
SSDEEP 192:DRVcBzRHEY0v7qNvkPRp4BqK9Ah9fHsb+WNrYugyrkGz+5OA3mso4N284eUQlDFs:DRVmzRjwmOXNdwJ1rhRAFos28hzQf
TLSH
T1B152D92AA964397B4DE7D219F966B79BE3F6102160C02E88E6FC8C3C10D79CD3217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1b44fc8322268a318f9526cb2611236b31cc0d9b0df567c97c03a20d804704d2
MD5 872a61b08c591872108fc609357b938a
SHA1 91f2688d6d6a398f6318bfeea53652c5f11cf4e7
SHA512 ee9d916160b55af90a2e4459732e595bfd0e8f159c34491afd11254efbce8355d4776730e8e53f6c8e73fc1d6cc78bf334b2109a9bb8d555c09f2b1c00e1dfad
SSDEEP 192:NR8RHEBEv7qNvkPRp4b19fHsb+WNn313Gz2wN284eUQlDFVyIsnAUgQU:NR8RYgmOXwdwFo2U28hzQU
TLSH
T10042D82DAD24797B5CE7D219F9667B97E3F6102120902E88E6FC8D3C20E79CD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 af51fb0ae8803abe5790ebf20a4c144dc7d85243f85047970c274a3b960d1fdb
MD5 4fb61615a4055cd23aebf69d6ce1fe2a
SHA1 6df2d62bc3eae0fcee468107a32e30a9e65eed01
SHA512 b8db56abd749868be45570cc33bf4c0b3f77520457fc0adf202b2e209fb97b08b953d3a5eb2cf7227fb0df7192737a91a8b02ad9013da53b128adf4492801b62
SSDEEP 192:NR8RHEBnv7qNvkPRp4b19fHsb+WNn313Gz2wN284eUQlDFVyIsnAUgQU:NR8RYvmOXwdwFo2U28hzQU
TLSH
T1B642D82DAD24797B5CE7D219F9667B97E3F6102120902E88E6FC8D3C20E79CD2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 570370b72ba0ada930209c9bc771014eecca1954004f266db03ad4763626ca39
MD5 cf07285652f03067c979d0e2864db0f2
SHA1 475015f1be2bc3e0deccb6f1c50140907c2a88fe
SHA512 54de3a7c208fb772755ec8197e7dfd280a7055d0e32431bd2d5fb352244b2fb8957ce774c223c8898b626803eb117178af7683f30dc0a92573782053531df26e
SSDEEP 192:eSt4K6gu7KxkXqK4I40pUZNCgVLHrKHfFKslExKEXzKD/fK+ErUkKN9CzNFKx6AT:Dtjnu7KxkXqKf/pUZNCgVLH2HfgslFEq
TLSH
T1E532EA27A48DAA3F4FD8D509DC166F4F6CB5429672780D2496FF9C0803A57CE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 168KB
SHA256 c91fa901c927059e34cb523ead34a612cf015f1744abb60099a37c7fd9c38779
MD5 19a9df38dd117fb128427654edb88404
SHA1 d911e233ba43ea2566be39250e1f0a8dcdc7289e
SHA512 f6f2c7ba61dc47834587f20dc690136cca04849fb28e73af12bba01608299e69ad5b204b5ea679cc5a483e28155020260c613b062c8089cb9f4a612d4d3d9066
SSDEEP 3072:I2egbeWM9sRxPCa1Yk7iIJAkpBSRuXp1KUfC1KKTP:IcbeW4IJwRuXWdk8P
TLSH
T1EAF33457D1F89963AF6B4443E8857E82B32C3047F619DAA1F987BFE0101E62A70F5835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 221KB
SHA256 1a919bf7c028437890f6108e9b40d2bb0d3c8a121bffe9c7b98331abb42180fc
MD5 d9a933011c6220cb79c62122c8bbae72
SHA1 135956615e3f9c4564125a31732a2ff10676d4ce
SHA512 a8aed1ebe24946569c8946ef5c9794fd016093424a54ce931d5e5380d6d91759e9728f794be815450de4199a7cb5da183c9795ad0c0709ef1ced3737814793c9
SSDEEP 3072:InS4M9eaGk/GcZRCteYUmCcW0sq7OQCZdKGKrfdZLMaR:IkJ4eR6UmCuK7KG2fw
TLSH
T19E24F78ABB2117FBDE3A6BB94017BE5453220140EAE3C4C6154E67D8152C193BEBFB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 cc12744041814f7f8f8103e50b307ee864258b25b506a404feb53733673feaa2
MD5 976c9b7bc84348ad87fe4cf2dfc25dfd
SHA1 b26692447c68499841e85dc7a913301e8d49b010
SHA512 ac77ef6c6931d98922344ccf60191da5d1defe6eed7ef826242f8cf35d67d32589566589a788b29f63901577d76db16c532f3b8f4574a0b9327b86c0e1583ed7
TLSH
T122B01220C04E2601C9C04970720A10942710CEB18291160283F0F6EA98430F0A31D500
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 7ec91227770d0d47c10f6228541e5cae26addc0f57320d0798b123d4f4394000
MD5 fc1667e1d9f51c4cfe1a31a83c62dd3e
SHA1 42ab65c2988712cd22bbeeaeec9bf0a7393ae657
SHA512 17795f7a95f28bbd4ac41b7c825f6ddc54451c01facb95f8826b8e880596bf43062ee5cffb810559bb6520360be7fccef74451dafe8104c30aa8c5b31dd0a626
TLSH
T14FB024F0003C5D13D50403F051C040D037347F103F03CC1340F150155411340051040F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 54d7e7063f51afa28ad0a4e1006a1de1d89e4139ba6c36c734bbf4b20515a379
MD5 08082538979aa079a6ad715ac0f2250b
SHA1 c4ba88d7eca3855acf914720abdb3fd21718d0b8
SHA512 b84ecfc0831c32ff1ee08264d87dfb1846fc122eb67a47a70bba63f8f9703c940db7229b9bd058d2ddeac3bf2d471029f3b6dbb40541fd51d89895b0c0b7a124
SSDEEP 3072:mLZhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:mLZxmX/B5UgKf2ne1utLV
TLSH
T152D312BF9CDDDFD363A2B026A95A1B6BC9F67BC96160EA4081F41084005F1FD83D9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 75268fc28a8428a458fffe22ef1600649b0d5a4eecce70c1beb3fc6bd2c7ce35
MD5 9687d62bb44259d477f77e303ed287c7
SHA1 3d612c345bfeddde2d867162c289218c03744d18
SHA512 9bf985bbbeeee4394a24ed520e5ab49db31c8b6f676702837ddaf79c7a57154006d18dbb037a45c63bdef49367b0ed2f00b1aa1d2e603e69cad7d26012ca480e
SSDEEP 3072:mLMhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:mLMxmX/B5UgKf2ne1utLV
TLSH
T121D312BF9CDDDFD363A2B026A9591B6BC9F67BC96160EA4081F41184009F1FD83D9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 3de4cbe82532a2c5933ae31c2a125dce79f565fc38ab6b0505b9d4c776537fae
MD5 b0e989eb51b9e37aaf39fd469a664b00
SHA1 eefdeac9d7f31938a1ef391dcab4a72e16c09eec
SHA512 a1941262be166f74f0d6bd4f3f1ea262cf35f48629c937bd4af59d129c0d7afe605332cb3ae652e9dd6005787e3a15e4e633d039977a0014b80f5b10484fa0fe
SSDEEP 3072:aLyhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:aLyxmX/B5UgKf2ne1utLV
TLSH
T186D312BF9DDDDFD363A2B026A9991B6BC9F67BC96160EA4080F41184009F1FD83D5A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 ef33e6e0840a46e88de3cdca03b9f4ddb9f4d98163f0a0afd2d93f0e12e5a5d6
MD5 18ffeef161049fc84cffeb14cf163227
SHA1 1534fcf97ece1d7a9087c8f88412b34a51d91684
SHA512 8383d03f371d4079e0f4dd3fbd8ee7336071b131fbfe595fa90e2b93bd1cee194b1c3faa45dbd89814784cad800284f4df78f95891346b986d57e9d5cd120699
SSDEEP 3072:aLbhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:aLbxmX/B5UgKf2ne1utLV
TLSH
T109D312BF9CDDDFD363A2B026A9991B6BC9F67BC96160EA4080F41184009F1FD83D5A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 5d05cec3a040c5ac38ced7a3e043fe6f023fe565a30a410f037675c23cb65dd7
MD5 0658195553f2331454b300b080ecdd86
SHA1 3f0573fed8e49203e935b001e83684959c98647d
SHA512 8d0499bf0b56e20f9c66c2a5e338b6e867e1e7255afc2cf212e3298507e134adc6ffd6c721b7d72e69e9c0708117b9c81163419bfb7423ed6f77b252bbb6ea0b
SSDEEP 3072:FLZhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:FLZxmX/B5UgKf2ne1utLV
TLSH
T1FFD302BB9DDDDFE36361B026A9A91B6EC9F67FC8A060EA4040F41084005F1FD8399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 39d32235fd547c110a8a7e909e6224ccf011e0390b13a507a6fa5239e689e02e
MD5 465e2bdd55f21f96af53eb9f6ca43f9a
SHA1 c51ca201b66c95c72a9becfde2287b069e1f2223
SHA512 c2b964a27fe83ce965c245de9206d5c3ae7a886afe1de196a023b0d648ec8af81a371a261b0290c1bab46ab903dda3cd3d5cbbee3da00d6394d178ee203629be
SSDEEP 3072:FLZshgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:FLZsxmX/B5UgKf2ne1utLV
TLSH
T182D312BB9DDDEFE36391B026A9691B5BC9F67FC85160EA4081F41184009F1FD83D9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 e74eca1e2a7d218f244cd9c6c5a86a9aaf87c6d97c2503653a8b74689c6479d9
MD5 119631f1a5a5b523eb486f8c600add9f
SHA1 f2046f13db2c17013cf9abcf9ed0fecafc02c036
SHA512 0d95039f766aab2bb9fe7b2ba27905f08e35538dcd717ebd412e61110e5f4773a8cdabfbbceb2e4984957088dc30ba99f23d8a421cb34133ec6ba027558ea91d
SSDEEP 3072:mLZshgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:mLZsxmX/B5UgKf2ne1utLV
TLSH
T1DCD312BB9DDDEFE36391B026A9691B6BC9F67FC85160EA4081F41184009F1FD83D9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 26f724bf248fddd8cb08df9763bdda46764593af0c3936c2f6c7c64e25ed5307
MD5 539c0515c1efaea53d32501e893e1020
SHA1 a3c01be744de3406a2cd281a4eb7c416faf65964
SHA512 a9adfac9e3b5c2a0030fa6e7ee6bd76b2815ec0135dc2eeda09a83af704b972d19d4edf82d69dcaa89dd114cffdca0a273aecf1b0ee553f89cf3140e07c32303
SSDEEP 3072:mL7hgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:mL7xmX/B5UgKf2ne1utLV
TLSH
T172D302BF9DDDDFE363A2B026A9991B6BC9F67FC85160DA4081F41184009F1FD8399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 a592d5a2db5a06fbb25e9dbaa081265bab7713d1693fdfe0c6ee029b8ac1254a
MD5 c87ae40eaf40bffce525e5f71e7973dc
SHA1 ef4576e37628d8913a4400ed9d925e14a1e98c35
SHA512 8bea3aa20739f06288f22a9cc0e5c55473cce465db62cce2bb146d7e7f997ffe4427ede31a609e6f32418d4785ae1222a83ed76cdbcd8ca1de561b1197d301e8
SSDEEP 3072:aLMhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:aLMxmX/B5UgKf2ne1utLV
TLSH
T136D312BF9CDDDFD363A2B026A9991B6BC9F67BC96060EA4081F41184009F1FD83D5A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OAC_Win64_bundled_1.3.0.132.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132.zip:Zone.Identifier
Size 294B
SHA256 e8c37feeca0a1c9a12d1beffde8ed04159ee6b3d5e716cc591cb6bf4c1357408
MD5 50f78f599c5ddd8b471502fc26094f9f
SHA1 420449f8c706a2f720d3296519aa95e77485527f
SHA512 c29071328861c22bea47020ba8b587efb483ff01b64015c87f1854c251edef1b23edcc54b6e279015a7124cccf6370cfe08115263b09be436f594a20c1482beb
TLSH
T17BE07D93C9B581D88D1922ECF86FC868A10B2E228E4181ECEDA556A6D01409063B0C07
MD5 SHA1 SHA512 TLSH

Submit Download

_oac_http_tmp.txt

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_http_tmp.txt
Size 67B
SHA256 a096b5ce44a2f4063ffea9eea1010a419aa262e0cf38cc035574cae64fe9111c
MD5 4509fe5b69c49333f980511a064510f7
SHA1 ff030445aa82160c46b3cd64ed6c987f592ffa10
SHA512 953b24329523ce5bd7bb89bdc2449e2d3afdd6292f299c585d99a46a640a87821df91114fa75a6c77efd641c2ed666e6400f9a29887a60bfbfa009ac5c660ffd
TLSH
T102A0028D5298D7325DC4EED180C36D600AE041719CB2A5B865F37F2314725C8CDA404C
MD5 SHA1 SHA512 TLSH

Submit Download

OACConfigEditor.exe

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_launcher_extract\OACConfigEditor.exe
Size 1.2MB
SHA256 f36e30c1b239728a2a15475b127efc944e442015582b4bf655d59af7914e4d72
MD5 2bffc8d84ec574f3a2656df7cc0eec90
SHA1 b4302782e5a93ab00d7e5ecbea6e6f2423d01d7d
SHA512 00a6fa5925379079e8c3c1668a0e907e511194ee0e78b9c68c2bd7d6bd0703c72bb44c037b63ad3265b996b5a63a2be12d9e52411bbfe910f34aae26f888cc2f
SSDEEP 24576:t0/T1yEhoEvOtBz4iaexI404D6038djYliDY44H6zGhkIVD6l3x:t0/kEhoEmvz4iaexITVexHmwvVDg3x
TLSH
T129554C5BE66344ECC92EC13487B3D772BE70B42942347D6E1AA4DB322F21D509B6E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OACLauncher.exe

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_launcher_extract\OACLauncher.exe
Size 1.2MB
SHA256 21e9c5227e89ea3d5a3af7088ebe1e220b31bbb048a5681981a531cce54d5306
MD5 ec979b6c1f660d4c9a3897a677e10c79
SHA1 8389251b3d9d5888a16364524c8ce466c5c5cf0c
SHA512 b3debde783c11cbd17ed922053557e35480bc1102826c199a5f58e98cd31670f199dae89bb30146648d08a7b62a46678af6c3f8c857a7d0a8279ad56432d98c6
SSDEEP 24576:+TnZ1XbTBNbm48qJyscwzEfFsRERhfzivgqqv5Z144H6zGhkXCU6Gk4:+TnZ1XBNbDNJyscwzEfFs2YsRTHmw0Cw
TLSH
T12F455C5BE67344ECC92EC13487B69772BE70B42942347D6E1AA4DB322F21D508B6F724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OrderAndChaos.exe

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_launcher_extract\OrderAndChaos.exe
Size 13.2MB
SHA256 2a6984c0087fe04a5306cef6e378e999280ebfba2b1475e6256548cb9e0e286b
MD5 e0ff25979a2acc1a22791e935bb5f66a
SHA1 90569890fe63d3d49f17571919aeeddbf5887ba5
SHA512 89fb177130ad037f4aedf8937bd9b67406025a2ede4b33e42dfb8d463b9a33a6418ae99aa27fcf01925a95c0e252695016ebfaf8096a20f7a03d80dc049a82fc
SSDEEP 98304:KqQDI1yZIR0JGu8z3AX8CcoDJpptEl4S1Cvum+xGw7ayvAz1wUu0eUEWaxHOCT3y:zRNU0FnfkEwMl9BoRBdUv/A
TLSH
T1DDD66C1BE2A350ECC56BD1304357E673A971B82901347E7F56A0DB312F61E609F6EB28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client_version.txt

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_launcher_extract\client_version.txt
Size 10B
SHA256 8dc5c5524b63b33faf56493697a259d15a30e8d5683b6a2fa4be6b4c7361ab6f
MD5 f439843959085751737c2ec39f6fb15c
SHA1 de50886dcca8afc816e356e40a8b2b352687afc5
SHA512 aa2fa694babeae6232febcfa35fd00af5238ab4cbeab7076c1e545d129a14acbc57e1f0f737bdbf8a42003e52259cda9f9ba15040f63b4a66a95e16f77fd2019
MD5 SHA1 SHA512

Submit Download

keybinds.conf

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_launcher_extract\keybinds.conf
Size 1KB
SHA256 ee161b7d371cc7772b57539e09175ecdee5c10f31302a650c1df948ae07592cc
MD5 d766a5019410057572adac05f8b09d75
SHA1 1bca190595b892eedfa2d257edfc8c2bcccb1fad
SHA512 4405e78c99bcf72d8c9300320e44d5f8419ef4e9cec7f63073f3382d44bad8be10abc669e418a9c83643baee6a7bce12ff9b97d6d445689f147f47a559ac2e9d
TLSH
T15A31226DD186F8A7675B5B62BEF1C4E1DD3B4A20E14F6D81EE6F4C0CF608050C22607A
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_launcher_extract\libcrypto-3-x64.dll
Size 5.6MB
SHA256 9af6d67fabf469c3db33d516751aab924bbc1f655e44d3a560040798f039b101
MD5 0439d49f27327f27874607fc102fe659
SHA1 9fd61d6e1b211fe32e9dd72310558f29577d7949
SHA512 99fce3a1e0e5017d0f05381e640a2c3fe095229d946a0a4cc31dc226e6c8fef54e091b1c275b8ae261bb0e76d101eee5d0b5f61be84232d9c22280aae4d88368
SSDEEP 98304:7V6gT0LYZiQTGAUXYyejHNu/L3DHc1abHcY+QBfg1CPwDvt3uFOxCXiZAI+:oFtHrbV7Bg1CPwDvt3uFOxC3
TLSH
T11A464B6BE07B10ADCA6BD1B0C267AF737931B81403747D7E2A54DBB02F61E5017AAB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_launcher_extract\libgcc_s_seh-1.dll
Size 756KB
SHA256 306983c483d96a6d08a2df044e360f0962e21dac021baf8311d3c0cb3b2c9def
MD5 04902b32e8405ca1eb9957e96c258d79
SHA1 8d1378e269935aa2855b151257004defad112d80
SHA512 ad08ff1a256b8acb7981e2a371c050f66fdb2d9796b2343774ea9f03c17da84333623e6363e8f3068883f281fc725b6e5a9f0b741d8281359c77007f2d8fc481
SSDEEP 6144:S/7z2YwTz9A8UN8HImZEPJ2XT3U9ayJKlmGOmR+bSaATzYr8Ciosn4+9acSUQggD:XYnN8xWEXIItfybSaATzYr8CioIOVEA
TLSH
T15CF45B85BB9DF8D7C03106705AEB021B1328A5863385AB5B7D197A34DEC33E8DE49BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libopenal-1.dll

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_launcher_extract\libopenal-1.dll
Size 3.9MB
SHA256 9d22f0d41bcbbbe93c8b104507b0b6bab380ba9fe63fec05ba76ed6c5246efc2
MD5 48231379b515aeb4fc1124b00082f7b1
SHA1 57f5f73ba5bf9d89b6fdf38ce2d79f05b756c5fd
SHA512 74b08f958cef5d2b3068696dc48aec7da9fc52a84442ac87ae1ccc54b1851beebcac62b2834f59c3e40ed45c0f9c3d75ee529c823347185b569260883bbfb755
SSDEEP 98304:8WY49JmPFKvF8yiDcMQKx0kwTmdN3ESKq2A9:t39JmPsd8lwT6
TLSH
T1D5165B43ADD70DA9CDD6A7B4A1E363366734FD744B296E2B9A08C6311D536C0AA1FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_launcher_extract\libssl-3-x64.dll
Size 1.0MB
SHA256 c05f670ce514b20dbfa9e640709bda3dd818ef53e3676f24df17ed9322cd1633
MD5 6d3a25e4d9ad49765ae7f77fd670421d
SHA1 093c4665230089522861d30827ef9a7e65cee2fa
SHA512 93da0e1bd12cd22b7da6e7d53e5e7c4ed6ecd20276de0cd498f0a8b34de38b987ec7378746088125ec22e415bd77df374df14f437b1374a4cd8066df85a6fcfc
SSDEEP 24576:lUcksHEbSX17i0ozZYtlnVa6XzWtab15QJ2lYXPNrDHGyEsqJq/m5c268Gu+60ml:lUcksn+zZSlnVxv+60G6mI8C3sVOEAE7
TLSH
T1F9253A67E2A724ECC5A7C134C7679372B932B8142234FDBF1A50CB312F61E60536DA69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_launcher_extract\libstdc++-6.dll
Size 25.1MB
SHA256 dc04a17d6e9fe93bcb0639e93aca2811ad53c81c523e1909a2c24daf827fd2cd
MD5 423b526f643de88d973ddf4c30df3605
SHA1 30a36d26fe89c7a8c3a146be4dc2df0c7be694c3
SHA512 0d88af8606ac659d711a46e1bf881001b4acaf694a7220f2c5d673b134f4e2bef1aba9f80ca63d33a1db218f27be9010fc39079f06bf3c25e0f5721164ca7f7a
SSDEEP 393216:Ys517/FG1RdoQBTTdyPcRZ/kbShyI6ZY/k21O:Y8m9TTdy8MmhyI6ZukT
TLSH
T1D2474A1E639B4D65DCC67BB4F88F136C9B10FD21EE9E097F9E4981247083298DD1AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_launcher_extract\libwinpthread-1.dll
Size 316KB
SHA256 fc9f14551f6609dd51801daec2c194579d35345551ef84fe465cbdb3339c2a6f
MD5 3e28fa4e11df7737f93b4c7e6377306d
SHA1 aec51bee83ccd45817bd091516deaa4180e71f45
SHA512 1e656c0221642e934a411fcfd1d3be19294671d78b3a28b4c7d16de9705d21e1db499d3996204184b4c1114b8a9ad3134a8d8a4c1cc6df899f36a30da2b49d40
SSDEEP 6144:5dt7xPzPm3YNnuCsihJ3KcbzWyhyXF3ZmO04iUM3922in:5dthPm3YNnuCsinaDpmSiUM3922w
TLSH
T143646D89BB4D6CAAC021393188B783553236B190234F5FD7AB34E2341D6FAE5FD8E546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_launcher_extract\zlib1.dll
Size 117KB
SHA256 cb7ab3788d10940df874acd97b1821bbb5ee4a91f3eec11982bb5bf7a3c96443
MD5 66a3477a51e8b7d4586edf4659cde8d5
SHA1 3306c6aca3937d8bca11dd076effb03746367b9f
SHA512 948ba42499bba17b552723c3189289e9f07879c9303ec6f27b4d631b7d701c16fe66fc8c6a681236cef778b0cb0a14420493e048aa90bba682606ce2990c64ab
SSDEEP 3072:djf8ECbYiB317HVhVpaKdAAcsrK2M2nuh2UI6vTH2F3I:xLCbYiBp1LghAxG9BI6LH2F3I
TLSH
T116C37B9BB8A265E9C6B3C170C5D78B75F930F8210675AEAB4258E3742F21F405B1C2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_oac_update.zip

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\_oac_update.zip
Size 18.3MB
SHA256 93cab934049e14f09ecd9241b879021b54e33270eb50e5f388903dd3bd614c70
MD5 51a4183b304a9e238f9519980d814f03
SHA1 68698224286e24c93d1ed40f4b980dbf2a820d00
SHA512 019356a962d12dd2fe76269068cd4871fe716a71787fb4dbbc3001d0ff72225c6ad0bd5810b4efbdb341a3cc9f96fb54468a3f3b943dff71c6385cf2aa230e96
SSDEEP 393216:e4BbD6EO08vHGwufgmAMC9uoDPW/NBWSHl0lKtpI5OGAt/8njhFCjBNp5itLDH/U:HJbSOgfMC9TPW/Nowl02Z2jLmn5CY
TLSH
T1CD1733CD018A8FABCA315F57DA18592587F1D19061D3AEBFDDB042BC675F8268E20B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

display.ini

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\display.ini
Size 65B
SHA256 f08ff85fc7c55504608ec56a5d6848ef747b3b4362686ddec342cb381e84ebe6
MD5 5b8596a95931f02fcbcdc722501c999c
SHA1 75d928eb23a10a8652901cca2756859e9097dd9c
SHA512 3ec34750a02e19fb269027f2b83d87da73841c05ecbf4e4ac5f267b3c69fda7950faa322f6ee6fc137814d4eb6dfec5f76cfe9f7764e9ae7e4201dd9b1281e6f
TLSH
T17CA002355392FD4CC95B40B9A7416BAF21FA6540420AC7E90F03519B342D663981CB89
MD5 SHA1 SHA512 TLSH

Submit Download

patch_crc_cache.txt

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\patch_crc_cache.txt
Size 127B
SHA256 9b0e6a1ec8fa08c0c0f5c6346ef6c26a465d7fb9cd14a8b1c56bd61815cb0005
MD5 632723e1000331f3b670488ce57d8b38
SHA1 e305fa40bda3fecd736920036c65e52284bc0c9e
SHA512 acfd3a20daeba33d3ae6cb35b11bafd799a8988780400991eaf7007045df92ac8fb63de7bb9d6dc92b418f96012e2b8d8d19f19beba26440c07a44a1bbfcd9cc
TLSH
T167B09249128CE6F11CC08C8001C2EC809AD005225C13FA6CACE52B35182318E8FA1DE7
MD5 SHA1 SHA512 TLSH

Submit Download

strings.bin

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\strings.bin
Size 373KB
SHA256 4393e0379d59f3485e856efda7ba24352db1d8d23886f5099460f326baba2802
MD5 2dbd1b440d0422c157fe86747b73a408
SHA1 2fcdc946e1818bc39b22147ec2058cbf620c095b
SHA512 eab841c96c0a858b191123e5c9fef78e5c0b4fe6bf70488c1ce0c85f2671e0ec891012f612647d3624315b348c3bcdc6ea575c987828349949f2c8f0ea17cecd
SSDEEP 6144:R6xWGOevd1EkRryO12nSvDPcPvSCpv+1LEIi2AJYqDa0ttUGUSemmur5aUQqp3Sb:KWG/vHEGyO12icPvpIH6j5tUGUSboS3G
TLSH
T1FE842316FA35BC4EC6FB4B7D16AF2CD8EF514ADB366A49771C09B22090B05C227E1361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tables.bin

Path C:\Users\Admin\Downloads\OAC_Win64_bundled_1.3.0.132\tables.bin
Size 9.6MB
SHA256 669cf8e33d578d5603492ddb9c6aefd6d55b3fddd7d35c00256670005f8faafa
MD5 ed075f5d3009e2b4f411a2d5b193a107
SHA1 675d7ce279f6398fdc0c405db2b82117319c1e86
SHA512 32b15b3184f7111b27514970841f8a0d01c9b700c57316b81a59ffd460ebf17aaa048220962b0ba786b63892da90f17b315a58dad16240165a52d61cbc9efb23
SSDEEP 196608:+BbA8qvxqxK0UTIXnx83U4jrDFLDHxe5WNkY++VLFks6omSjY:MA8WxqxKNGx8hnBHRey++RFR6omSk
TLSH
T17BA63398F40A0116D5BD51B7954E1E5C069875FBC1A233EEA7CA3E293D0F8BF078668C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-815-0x00007FFBDE3E0000-0x00007FFBDE6D0000-memory.dmp

Download

memory/484-818-0x00007FFC0B820000-0x00007FFC0B871000-memory.dmp

Download

memory/484-814-0x00007FFBDCDE0000-0x00007FFBDD383000-memory.dmp

Download

memory/484-817-0x00007FFC0B880000-0x00007FFC0B8A4000-memory.dmp

Download

memory/484-816-0x00007FFC014E0000-0x00007FFC015E1000-memory.dmp

Download

memory/484-813-0x00007FF614630000-0x00007FF6153DE000-memory.dmp

Download

memory/560-851-0x00007FF69FD50000-0x00007FF69FE8C000-memory.dmp

Download

memory/1504-1128-0x0000000000890000-0x00000000021ED000-memory.dmp

Download

memory/1732-268-0x00007FF69FD50000-0x00007FF69FE8C000-memory.dmp

Download

memory/1732-368-0x00007FF69FD50000-0x00007FF69FE8C000-memory.dmp

Download

memory/2096-829-0x00007FFC0B880000-0x00007FFC0B8A4000-memory.dmp

Download

memory/2096-828-0x00007FFC014E0000-0x00007FFC015E1000-memory.dmp

Download

memory/2096-827-0x00007FFBDE3E0000-0x00007FFBDE6D0000-memory.dmp

Download

memory/2096-826-0x00007FFBDCDE0000-0x00007FFBDD383000-memory.dmp

Download

memory/2096-825-0x00007FF614630000-0x00007FF6153DE000-memory.dmp

Download

memory/2096-830-0x00007FFC0B820000-0x00007FFC0B871000-memory.dmp

Download

memory/3180-375-0x00007FFC01560000-0x00007FFC015B1000-memory.dmp

Download

memory/3180-371-0x00007FF614630000-0x00007FF6153DE000-memory.dmp

Download

memory/3180-373-0x00007FFBDE3E0000-0x00007FFBDE6D0000-memory.dmp

Download

memory/3180-374-0x00007FFC015C0000-0x00007FFC015E4000-memory.dmp

Download

memory/3180-376-0x00007FFBDE1C0000-0x00007FFBDE2C1000-memory.dmp

Download

memory/3180-372-0x00007FFBDC620000-0x00007FFBDCBC3000-memory.dmp

Download

memory/3916-862-0x00007FFC00730000-0x00007FFC00781000-memory.dmp

Download

memory/3916-859-0x00007FFBDE3E0000-0x00007FFBDE6D0000-memory.dmp

Download

memory/3916-858-0x00007FFBDCDE0000-0x00007FFBDD383000-memory.dmp

Download

memory/3916-857-0x00007FF614630000-0x00007FF6153DE000-memory.dmp

Download

memory/3916-861-0x00007FFC01530000-0x00007FFC01554000-memory.dmp

Download

memory/3916-860-0x00007FFBDE2D0000-0x00007FFBDE3D1000-memory.dmp

Download

memory/4492-810-0x00007FF69FD50000-0x00007FF69FE8C000-memory.dmp

Download

memory/4636-822-0x00007FF69FD50000-0x00007FF69FE8C000-memory.dmp

Download

memory/4852-237-0x00007FF61B6E0000-0x00007FF61C487000-memory.dmp

Download

memory/4852-238-0x00007FFBDC620000-0x00007FFBDCBC3000-memory.dmp

Download

memory/4852-240-0x00007FFBF64E0000-0x00007FFBF65E1000-memory.dmp

Download

memory/4852-249-0x00007FF61B6E0000-0x00007FF61C487000-memory.dmp

Download

memory/4852-242-0x00007FFC00D50000-0x00007FFC00DA1000-memory.dmp

Download

memory/4852-239-0x00007FFBDE230000-0x00007FFBDE520000-memory.dmp

Download

memory/4852-241-0x00007FFC01710000-0x00007FFC01734000-memory.dmp

Download

memory/4880-841-0x00007FFC0B880000-0x00007FFC0B8A4000-memory.dmp

Download

memory/4880-838-0x00007FFBDCDE0000-0x00007FFBDD383000-memory.dmp

Download

memory/4880-837-0x00007FF614630000-0x00007FF6153DE000-memory.dmp

Download

memory/4880-840-0x00007FFC014E0000-0x00007FFC015E1000-memory.dmp

Download

memory/4880-839-0x00007FFBDE3E0000-0x00007FFBDE6D0000-memory.dmp

Download

memory/4880-842-0x00007FFC0B820000-0x00007FFC0B871000-memory.dmp

Download

memory/5012-772-0x00007FF69FD50000-0x00007FF69FE8C000-memory.dmp

Download

memory/5124-264-0x0000018FE92C0000-0x0000018FE92C1000-memory.dmp

Download

memory/5124-262-0x0000018FE92C0000-0x0000018FE92C1000-memory.dmp

Download

memory/5124-255-0x0000018FE92C0000-0x0000018FE92C1000-memory.dmp

Download

memory/5124-257-0x0000018FE92C0000-0x0000018FE92C1000-memory.dmp

Download

memory/5124-256-0x0000018FE92C0000-0x0000018FE92C1000-memory.dmp

Download

memory/5124-261-0x0000018FE92C0000-0x0000018FE92C1000-memory.dmp

Download

memory/5124-267-0x0000018FE92C0000-0x0000018FE92C1000-memory.dmp

Download

memory/5124-266-0x0000018FE92C0000-0x0000018FE92C1000-memory.dmp

Download

memory/5124-265-0x0000018FE92C0000-0x0000018FE92C1000-memory.dmp

Download

memory/5124-263-0x0000018FE92C0000-0x0000018FE92C1000-memory.dmp

Download

memory/5524-831-0x00007FF69FD50000-0x00007FF69FE8C000-memory.dmp

Download

memory/5796-776-0x00007FFBDCDE0000-0x00007FFBDD383000-memory.dmp

Download

memory/5796-780-0x00007FFC01560000-0x00007FFC015B1000-memory.dmp

Download

memory/5796-779-0x00007FFC015C0000-0x00007FFC015E4000-memory.dmp

Download

memory/5796-778-0x00007FFBDE2D0000-0x00007FFBDE3D1000-memory.dmp

Download

memory/5796-777-0x00007FFBDE3E0000-0x00007FFBDE6D0000-memory.dmp

Download

memory/5796-775-0x00007FF614630000-0x00007FF6153DE000-memory.dmp

Download