hxxp://google[.]com

Resubmissions

30/10/2026, 15:01

261030-sd5jpset4j3

29/10/2026, 16:37

261029-t4vb4ac14w8

29/10/2026, 12:53

261029-p4ybjabz9x8

Analysis

user interaction
yes
max time kernel
227s
max time network
229s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample261030-sd5jpset4j

Score

3^/10

adware discovery execution spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3636	cmd.exe
5704	cmd.exe
3432	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4320	chrome.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\DOMStorage	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "1"	TextInputHost.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4132	TextInputHost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
2880	chrome.exe
2880	chrome.exe
4132	TextInputHost.exe
4132	TextInputHost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe
Token: SeShutdownPrivilege	5908	chrome.exe
Token: SeCreatePagefilePrivilege	5908	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
4132	TextInputHost.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe
5908	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4132	TextInputHost.exe
4132	TextInputHost.exe
4132	TextInputHost.exe
4132	TextInputHost.exe
4132	TextInputHost.exe
4132	TextInputHost.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5908 wrote to memory of 432	5908	chrome.exe	89
PID 5908 wrote to memory of 4320	5908	chrome.exe	91
PID 5908 wrote to memory of 3008	5908	chrome.exe	92
PID 5908 wrote to memory of 3008	5908	chrome.exe	92
PID 5908 wrote to memory of 5172	5908	chrome.exe	93
PID 5908 wrote to memory of 5172	5908	chrome.exe	93
PID 5908 wrote to memory of 2844	5908	chrome.exe	95
PID 5908 wrote to memory of 2844	5908	chrome.exe	95
PID 5908 wrote to memory of 1300	5908	chrome.exe	96
PID 5908 wrote to memory of 1300	5908	chrome.exe	96
PID 5908 wrote to memory of 3944	5908	chrome.exe	97
PID 5908 wrote to memory of 3944	5908	chrome.exe	97
PID 5908 wrote to memory of 1280	5908	chrome.exe	98
PID 5908 wrote to memory of 5156	5908	chrome.exe	100
PID 5908 wrote to memory of 2096	5908	chrome.exe	101
PID 5908 wrote to memory of 5156	5908	chrome.exe	100
PID 5908 wrote to memory of 2096	5908	chrome.exe	101
PID 5908 wrote to memory of 4812	5908	chrome.exe	105
PID 5908 wrote to memory of 5580	5908	chrome.exe	104
PID 5908 wrote to memory of 4812	5908	chrome.exe	105
PID 5908 wrote to memory of 5580	5908	chrome.exe	104
PID 5908 wrote to memory of 6028	5908	chrome.exe	106
PID 5908 wrote to memory of 1888	5908	chrome.exe	107
PID 5908 wrote to memory of 6028	5908	chrome.exe	106
PID 5908 wrote to memory of 1888	5908	chrome.exe	107
PID 5908 wrote to memory of 3156	5908	chrome.exe	109
PID 5908 wrote to memory of 1332	5908	chrome.exe	108
PID 5908 wrote to memory of 3156	5908	chrome.exe	109
PID 5908 wrote to memory of 1332	5908	chrome.exe	108
PID 5908 wrote to memory of 5488	5908	chrome.exe	111
PID 5908 wrote to memory of 3304	5908	chrome.exe	112
PID 5908 wrote to memory of 2584	5908	chrome.exe	113
PID 5908 wrote to memory of 5972	5908	chrome.exe	116
PID 5908 wrote to memory of 2880	5908	chrome.exe	117
PID 3020 wrote to memory of 3636	3020	cmd.exe	118
PID 3636 wrote to memory of 5704	3636	cmd.exe	119
PID 5704 wrote to memory of 2820	5704	cmd.exe	120
PID 3636 wrote to memory of 3432	3636	cmd.exe	121
PID 3432 wrote to memory of 4800	3432	cmd.exe	122
PID 5908 wrote to memory of 4608	5908	chrome.exe	123
PID 5908 wrote to memory of 4608	5908	chrome.exe	123

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd09f4c728,0x7ffd09f4c734,0x7ffd09f4c740
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2056,i,11635644079867341201,3114481119047877812,524288 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,10858473407351715897,498655095358913924,262144 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,13010288139231457053,15112922978305188918,524288 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:13
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,101519565388799851,10683686714806590888,2097152 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,12139741341912293543,3170719460881099061,2097152 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4708,i,2248894160076013436,15103603476203852047,2097152 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5216,i,6737524284324393664,469538782212529861,524288 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5356,i,752177925611580104,13132668196050371726,2097152 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5304,i,2909834536475826037,909958687212481923,2097152 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5640,i,13079509197200545723,5988731778742359084,2097152 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5784,i,1779636066039548104,17831724923777764760,2097152 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5524,i,15881072672405786082,9431734039921777028,2097152 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5888,i,8458554579684119640,3431096033680386579,2097152 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6112,i,11574068234264545477,11892958686091435041,2097152 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5540,i,7878592892550672871,10227430735979526652,2097152 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,13838696192274668278,11085560484200126196,524288 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,16134599944307504084,156800136476613307,524288 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,9788278938108139060,7032144883204278477,524288 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4688,i,11789530417207984628,3487384376539769936,524288 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5720,i,7557148787959336922,2473701279553452377,262144 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=792 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,14638568615438495393,10939267276637599241,524288 --field-trial-handle=1908,i,6276857004738691849,6291838515209499986,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
  2⤵
  PID:4608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1176

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\cmd.exe
  cmd.exe /K for /f "delims=" %i in ('where ,,f*n*er,,') do for /f "delims=" %j in ('"%i" [email protected]') do @%j
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c where f*n*er
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Windows\system32\where.exe
      where f*n*er
      4⤵
      PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\System32\finger.exe" [email protected]
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\System32\finger.exe
      C:\Windows\System32\finger.exe [email protected]
      4⤵
      PID:4800

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

08390d17-3d17-4515-a848-77016ebcddbb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\08390d17-3d17-4515-a848-77016ebcddbb.tmp
Size 5KB
SHA256 b917d4c00a0b0e4e21b7a4d24682ed66bf83f25349efc62256e00546c46cce5b
MD5 be5ebfb61d9c815d9e2b04c304931f1d
SHA1 2461f97e4624079744cf3fcd876d46e5dffda093
SHA512 39292a895b8c634e6a0bc6351c58862fe303e4b8ae290d905c044ffd50e3ff4d5733b1422f99404b8a1975a8ce1ce28d1e3de59a8258dbde2365704c005a642e
SSDEEP 96:TC0d+6K6ujgRdfB7rsM6ebSySl8h4otop57JD8B66GyvLscPHQPkrx0j9IooOW9y:TC0CvgFrp6hOiU2NQSVcPHQPkrxURu9y
TLSH
T1EFC11AB0B4AC687719F6E596B4423A43CFB561BBA8406F54EADA0F1C04E74AC1383637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09a3c20a-3c9f-462b-9ec7-9a897f83ce51.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\09a3c20a-3c9f-462b-9ec7-9a897f83ce51.tmp
Size 5KB
SHA256 a5b00e355404f406077393cfcb39a5a7b73889248138680784e172c26eebe7ab
MD5 21ef13210bbf643cb0fc7614feb4dfc5
SHA1 6a0e1d18a317caa7e970435fe46afef5a3f6d370
SHA512 04fa499a9b00c8e014dffa432516b183b9fd5d23b87b4190f59c782a883a624f427c3654f57f8b6d489f6c6e329dc319ed2c76a8395c814f3d3e6e619c628dcf
SSDEEP 96:TbJ0d+6K6ujgRdfB7rsM6ebSySl8h4otop57JD8B66GyvLscL1krNiRNC39ISyVO:Tt0CvgFrp6hOiU2NQSVcL1krNiuC/Cu4
TLSH
T1E9C1C774A46D697B0DF6B885B0022D43CEB961AB69547E18EDE94E5C00A78DC5383533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16861a92-318e-4ab2-b0ce-7d7c04620776.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\16861a92-318e-4ab2-b0ce-7d7c04620776.tmp
Size 5KB
SHA256 41ce1cbc1de61e1c5cdd76c69ccf15f455f0abc10be3b7105eb888b996c824fc
MD5 64d1a03ab62330e0610e0e680ac697b1
SHA1 c7c1332f29462f9be62e15b147dae6d1b135a76a
SHA512 9ef31685569b9be1b6f6bc3aedfb536895bd2f7c162804d9f397d79c60dac53e9192548fdf549c22b6c0872279ce57dbf6b5648990631e3fd3e69928a30292fa
SSDEEP 96:TbJ0d+6K6ujgRdfB7rsM6ebSySl8h4otop57JD8B66GyvLscPHQPkrx0j9IooOW0:Tt0CvgFrp6hOiU2NQSVcPHQPkrxURu9y
TLSH
T18AC11AB0B4AC687709F6F596B4023A03CFB561BBA8406E50EADA0F1C04E74AC1382637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75e1a2b3-b0a6-4017-b62c-a5cfbfd85705.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\75e1a2b3-b0a6-4017-b62c-a5cfbfd85705.tmp
Size 4KB
SHA256 158552a3fc99e8d49ca6ee02fe43dd0e6f0cc10a7d7007ee48a885e220b34b1a
MD5 dd8cf27476d55d40b4d2b8fe354e3fa8
SHA1 5ea2a2e44935100d0517062126ad88a6034b845f
SHA512 964968600a081006ccfda257959fad490cf3972a4e0290fb76fec1d7720cfc441623d086677584e752bec5a93b5c9b90c7cf1551dc78e196b55d5cdb4cc4c7be
SSDEEP 96:uC0d+6K6ujgRdfB7rsM6abCRDotok57bD8B6RGyvLsTFrebQMUpv4a:uC0CvgFrp65DUDTQJVTFreb3UF
TLSH
T198A1F931E0A9597B05F6D8C9B8812B03CF7461BBB951AF44E9ED5E1C28B74FC1382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48902bb6-aa6e-4306-a930-c27dd36e7020.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\48902bb6-aa6e-4306-a930-c27dd36e7020.tmp
Size 11KB
SHA256 b2531a00b690b875ea76042bfae784aa2b4dc3624cfcdbe2a0ead73b29fa69f9
MD5 dedeb2ea40f131baba07838e3a016458
SHA1 521ed444b7ccc3c07196755565db17e7e2ba79f0
SHA512 c570d907be1483aaf17fe0f2280fa0c3eb40b1a0f1d90f710f3bffee97f86b1d21e39120aec9806449bef40b5e893a54769a1e51441a3196319456e74902715d
SSDEEP 192:VRgQitfv7rvAPRp2W3y6Xsb+WNnEgbZgM2sU+v2CKTG/kwRjjiyIsnAUge:VRgQit3H6X7XwTbJ2l+v2CKK/NOe
TLSH
T12342842DEE11793B5CEBD22AE961B717E3FA002635951E84E6FC882C14E79DC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 312B
SHA256 9ca34a3073e1eb9bdc7515bd408bfe0a5fd281b6b760a605e1ab812713ae17cb
MD5 cfced0c92b6e48cf98bac7ba219178f4
SHA1 014e34364deb0fbd48014952210e8b126e208d4b
SHA512 af1eeb3e92b9a877d0d623839f5478c7ae7aea1c6cf50f9b4c0e65cbc420b01cb605db1642b10f901933b3df16a747b04f28ff944dfe56b07300a982af8b9794
TLSH
T1B2E05E7E7A951050DF6B3A73981788993DE209A016864AA685FC987581FB3243544097
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

2cb385a3-3e30-4b30-b71b-cf1660ee8486.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2cb385a3-3e30-4b30-b71b-cf1660ee8486.tmp
Size 3KB
SHA256 59c4a7479c855d7d2e2cc534ae88c299039b8e9007aebe98400ef6fd31c15b1d
MD5 06ca4bac9a2d02f497519834af414ec1
SHA1 bfba276f396d95821aff719666fdaef3e9cb2d82
SHA512 a630862b4de782a377ac7195c318e267fe3357cdbb2aae815379288acbe5b0ed3923827f185e330c83da447abf72fec8ebc812a773c50707861a07fdab718bd5
TLSH
T1F6718BF7C3D9812D891116F4AB15AF1FCE2E1A18432C3D26C8D8BE5B93E2931D22565E
MD5 SHA1 SHA512 TLSH

Submit Download

a0f8576d-9dcb-40ee-9ce4-6b93f55e02e4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a0f8576d-9dcb-40ee-9ce4-6b93f55e02e4.tmp
Size 3KB
SHA256 99c3383a424b7e36c71b49b37d56767996fa9c6b1099b804771534b764da308a
MD5 c0841c8da6b83545d81c74af0050af1b
SHA1 6a8f7e2794c084465814084be9d93230d217afd7
SHA512 93a0a115812d3133ecb5587ac6de43a86e29d94b402363fd169a6b5360d7b561b6eb63b41c7509dd9e48047f508c6c7daf119940733d3ae307ca777e4fbf7af9
TLSH
T17361ADF7C3D9C12D895105F4AB156F1FCE2E1A18432C3D26C8D8AF5B93E2931D22525E
MD5 SHA1 SHA512 TLSH

Submit Download

f3181e2a-6818-43e0-adf5-5a72fc741e1b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f3181e2a-6818-43e0-adf5-5a72fc741e1b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c01387de3adb9c2d_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\c01387de3adb9c2d_0
Size 196KB
SHA256 bd6bd2d891b3d3027a6aeca92db1fffaa9555ab49602b4388ae19c0d65695cb0
MD5 2f7919317779893fe462abf81ce447c6
SHA1 fc4a5acec16ed991851c6b92e7e209796e777dfc
SHA512 bace8fd5bab94b433c4b8e99c7f3fc2b42f94a8a57b09375929eafb1be2f50bac5500b4b9162ed974fdc4ad6ce033e50380deb8b3a2356c66554402c3480f52c
SSDEEP 3072:J2XU0LBARbIRdaYcob5ISvXFjvyomKJZu:cXxLBKIRdaYxdImNNJZ
TLSH
T1D0146B356300F43FB923DE6162BE7F4E3C25A167DD0686FCA5A4E9309AD6DF20522748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 f8b91223091dc6248072397669cd767194b0ba33f4fbf69bcc10b8c07a2c888e
MD5 02f8e73f41e35decfffe7658f613c56a
SHA1 dda4786f696702f05d14c734ab8e3d4597abc0d6
SHA512 162383aeaf3820c23980114917706402377461453aa717d78b5fca6a1dc7b572485bf0de55e99bbb6fd891aa6ce4652ed68f4eb8a979f17d54141de699f05935
TLSH
T198A0023055D00A49D82023B2668159756390EC1547818A7340924D79CD7335AC25D5D2
MD5 SHA1 SHA512 TLSH

Submit Download

d9d827d6-a282-4aa4-8e97-5c0cfceee95e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d9d827d6-a282-4aa4-8e97-5c0cfceee95e.tmp
Size 11KB
SHA256 7cf90f60717ea914eb93ccc6033befd5960eb8f4d3021cfe6133523579b6cfa6
MD5 37718b64a06a50e517bbe3f1c3c724fd
SHA1 e079d2a6cd0db714b76cff36bd7b1a38aafeb016
SHA512 9f7cd3c34bc9a2841fe5431b839f218dd2a816efe6d43c0687399577bdbd570eec24fc3f027d7fe60de1d4c244c271d7f0e2060b988ae52f31700822a57400f0
SSDEEP 192:ehu4K6Hr7KxkXqK4I40pUZNCgVLHrKHfFKslH5nXzKD/kH+ErUkKNIxrAfJWf4P9:gujMr7KxkXqKf/pUZNCgVLH2HfgslZnw
TLSH
T15432D927948D9A3F4FECD908CC52AF4B6CF502927778092496FB9D1803957CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f07d0e5c-a11c-42fa-89e2-93d98e99264f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f07d0e5c-a11c-42fa-89e2-93d98e99264f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

fcd48a90-48da-4a41-8785-85846c132f28.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fcd48a90-48da-4a41-8785-85846c132f28.tmp
Size 12KB
SHA256 4641bd570714df36b2479b24dd547e8f2b5e2716bee038d67c5c95e315cad0da
MD5 14754fe830feaa5f165b96ee9e870b3b
SHA1 0fa39a80d1479c5d37fb54dd583e19b6c791cd40
SHA512 682d1aa63ceb14cee9c3c66ac61974109c2bb0573059bc3d4caedb44fa2fed4b95cd131dc311374504d250c7da7a1740ebfdd2323be56976644d25df2ddbe25b
SSDEEP 192:VRgQitmv7rvPPRprW3y6Xsb+WNnEgbZkoeVGxU+v2CKTG/kw/jjiyIsnAUgE:VRgQitSHvXuXwTbdeVGa+v2CKK/rOE
TLSH
T1ED42942DFE11793B5DEAD62AF961BB17E3FA102276911E44E6FC882C14E79DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

febc12da-d18a-45e3-a4f6-91ca8cc917d8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\febc12da-d18a-45e3-a4f6-91ca8cc917d8.tmp
Size 11KB
SHA256 6bfdccf82d493db771425819ec2fa2061c055a801fd65ad5e18c1a3e6f248b88
MD5 e63536feb7322413ae0c15cd58fd7387
SHA1 4d35949a8c9a8b496fcbb86e29c1622d5e634b6a
SHA512 1111adeb8f67107ce92e1e95a655cabd500d3044d20c441ce5c2520954794fc0f56d766e27aa853fc280e6bf6ba9293193f0dbe79446c296589280f6460d52a4
SSDEEP 192:VRgQitmv7rvAPRp2W3y6Xsb+WNnEgbZkoe26U+v2CKTG/kwpjjiyIsnAUgE:VRgQitSH6X7XwTbde2X+v2CKK/VOE
TLSH
T1DE42942DFE11793B5DEAD21AE961B717E3FA102276911E80E6FC892C24E79DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2bd4e8d-4a74-44cc-b079-a173eeec7ec2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e2bd4e8d-4a74-44cc-b079-a173eeec7ec2.tmp
Size 5KB
SHA256 7be15796f24b61fa54e56b7edcc191b6693491b0a97efceebe21821198794956
MD5 7697c908b84bebf2a273d7605c7bda4c
SHA1 685327edd749c95cf6ea33504fba3c611df8df72
SHA512 de7b98183edabf7ef3adc483b402d851d0a5ce84e16eab844b0935bd25ea2259812be3340e0bf73c1b1de8ee2ed7072c761f9d4bd26189f62fd7e50da9c49532
SSDEEP 96:TbJod+6K6ujgRdfB7rsM6ebSySl8h4otop57JD8B66GyvLscL1krNiRNC39ISyVO:TtoCvgFrp6hOiU2NQSVcL1krNiuC/Cu4
TLSH
T12FC1D774A46D697B0DF6B989B0422D43CEB961ABA9447E18EDE94E1C00E78DC03C3533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4132-336-0x000001C9869E0000-0x000001C986AE0000-memory.dmp

Download