192940ef2dbdb69094c8c37f678bba9b0e20e13629c166affb462181b64a0452

Analysis

user interaction
yes
max time kernel
25s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
opensites.ps1
Size 1KB
Sample261113-1dletsgy7y
SHA256 192940ef2dbdb69094c8c37f678bba9b0e20e13629c166affb462181b64a0452
MD5 2fc7be46b7537ef08a6277cb0ca2499e
SHA1 9708a96e0fe2895083f7f648a6d6d9bd98580462
SHA512 e87b215e3056fcc42aeb45339b83940be97fdeb1ee552a9ed199e27428d0167c59ba97c43db696000d325c8dd75aedde84c21d9a57a6ddc18ea2bd333bfb3d8f
TLSH
T18F21DC11710B87AAA3722B6D8963940CF9C6749765EF568D780C82A06F30552926E87E
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
548	powershell.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
512	chrome.exe
3048	chrome.exe
3972	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
548	powershell.exe
548	powershell.exe
748	chrome.exe
748	chrome.exe
988	chrome.exe
988	chrome.exe
2824	chrome.exe
2824	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	548	powershell.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 748	548	powershell.exe	87
PID 748 wrote to memory of 4776	748	chrome.exe	88
PID 748 wrote to memory of 2436	748	chrome.exe	89
PID 748 wrote to memory of 2436	748	chrome.exe	89
PID 748 wrote to memory of 512	748	chrome.exe	90
PID 748 wrote to memory of 1976	748	chrome.exe	91
PID 748 wrote to memory of 1976	748	chrome.exe	91
PID 748 wrote to memory of 3784	748	chrome.exe	93
PID 748 wrote to memory of 3784	748	chrome.exe	93
PID 748 wrote to memory of 5064	748	chrome.exe	94
PID 748 wrote to memory of 5064	748	chrome.exe	94
PID 748 wrote to memory of 2824	748	chrome.exe	95
PID 748 wrote to memory of 2824	748	chrome.exe	95
PID 748 wrote to memory of 3212	748	chrome.exe	96
PID 748 wrote to memory of 3212	748	chrome.exe	96
PID 548 wrote to memory of 1640	548	powershell.exe	97
PID 1640 wrote to memory of 4216	1640	chrome.exe	98
PID 748 wrote to memory of 1616	748	chrome.exe	99
PID 748 wrote to memory of 1616	748	chrome.exe	99
PID 748 wrote to memory of 1796	748	chrome.exe	100
PID 748 wrote to memory of 624	748	chrome.exe	103
PID 748 wrote to memory of 624	748	chrome.exe	103
PID 548 wrote to memory of 2700	548	powershell.exe	104
PID 2700 wrote to memory of 2588	2700	chrome.exe	105
PID 748 wrote to memory of 3248	748	chrome.exe	106
PID 748 wrote to memory of 3248	748	chrome.exe	106
PID 748 wrote to memory of 4400	748	chrome.exe	109
PID 748 wrote to memory of 4400	748	chrome.exe	109
PID 548 wrote to memory of 2988	548	powershell.exe	111
PID 2988 wrote to memory of 464	2988	chrome.exe	112
PID 748 wrote to memory of 4208	748	chrome.exe	113
PID 748 wrote to memory of 4208	748	chrome.exe	113
PID 748 wrote to memory of 3980	748	chrome.exe	114
PID 748 wrote to memory of 3980	748	chrome.exe	114
PID 548 wrote to memory of 1008	548	powershell.exe	115
PID 1008 wrote to memory of 2060	1008	chrome.exe	116
PID 748 wrote to memory of 1128	748	chrome.exe	117
PID 748 wrote to memory of 1128	748	chrome.exe	117
PID 748 wrote to memory of 1584	748	chrome.exe	119
PID 748 wrote to memory of 1584	748	chrome.exe	119
PID 548 wrote to memory of 4680	548	powershell.exe	120
PID 4680 wrote to memory of 1828	4680	chrome.exe	121
PID 748 wrote to memory of 3164	748	chrome.exe	122
PID 748 wrote to memory of 3164	748	chrome.exe	122
PID 748 wrote to memory of 1964	748	chrome.exe	123
PID 748 wrote to memory of 1964	748	chrome.exe	123
PID 548 wrote to memory of 3248	548	powershell.exe	126
PID 3248 wrote to memory of 4272	3248	chrome.exe	127
PID 748 wrote to memory of 868	748	chrome.exe	128
PID 748 wrote to memory of 868	748	chrome.exe	128
PID 748 wrote to memory of 3720	748	chrome.exe	129
PID 748 wrote to memory of 3720	748	chrome.exe	129
PID 548 wrote to memory of 4512	548	powershell.exe	130
PID 4512 wrote to memory of 380	4512	chrome.exe	131
PID 748 wrote to memory of 3240	748	chrome.exe	132
PID 748 wrote to memory of 3240	748	chrome.exe	132
PID 748 wrote to memory of 3776	748	chrome.exe	133
PID 748 wrote to memory of 3776	748	chrome.exe	133
PID 548 wrote to memory of 988	548	powershell.exe	134
PID 988 wrote to memory of 4004	988	chrome.exe	135
PID 988 wrote to memory of 3764	988	chrome.exe	136
PID 988 wrote to memory of 3764	988	chrome.exe	136
PID 988 wrote to memory of 3048	988	chrome.exe	137
PID 988 wrote to memory of 4324	988	chrome.exe	138

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\opensites.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://lrwzp.xu51n.1lj0i.j7gc.app/3x05a?x=84390
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:4776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,4646760423882436539,7127836578814045615,262144 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2012 /prefetch:2
    3⤵
    PID:2436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,14465263338321236398,4303118096348002177,524288 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - System Time Discovery
    PID:512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,1998183086505641653,9007064675155996157,524288 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2392 /prefetch:8
    3⤵
    PID:1976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,17635980711882808811,5404747939788067182,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,4391628148548273909,1966678759254063055,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4608,i,16906615936667028613,2131667652539857766,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:2824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3272,i,13263077563521806148,7322200248916898536,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4700 /prefetch:1
    3⤵
    PID:3212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4724,i,7068586515579055329,8489554859814171164,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4716 /prefetch:1
    3⤵
    PID:1616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,3337913140323292491,16706899413435682488,524288 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5412 /prefetch:8
    3⤵
    PID:1796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5412,i,12546634782795432418,12618540141757673556,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4732 /prefetch:1
    3⤵
    PID:624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5240,i,4550008577982455690,2939928405335294617,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4704 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4780,i,1106648153594291262,3987786016623025759,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:4400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5280,i,4502043666718110619,11807532014011687343,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4712 /prefetch:1
    3⤵
    PID:4208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5292,i,10740824950447216884,6605861689276934582,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:3980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4744,i,2425839556723444012,4011438051746666546,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5216 /prefetch:1
    3⤵
    PID:1128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5340,i,8877402264585925191,11944733598923271671,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4472 /prefetch:1
    3⤵
    PID:1584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5496,i,5164558466666041036,12233640039280132859,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4716 /prefetch:1
    3⤵
    PID:3164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4472,i,3730371346264696977,17986653324307672471,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4736 /prefetch:1
    3⤵
    PID:1964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4596,i,3146925674250155093,1994287420214101980,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4000 /prefetch:1
    3⤵
    PID:868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5412,i,17609734264522806623,12635443321477763358,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5676 /prefetch:1
    3⤵
    PID:3720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4600,i,13480587744345742467,11415737186223903084,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4556 /prefetch:1
    3⤵
    PID:3240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5684,i,15314628631693906775,11065700714269887490,2097152 --field-trial-handle=2016,i,6383435500367748031,2556906936839883083,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4832 /prefetch:1
    3⤵
    PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://ctzwxnu.br
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://vkbx.ubqnxj.app
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x74,0x104,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://z7bu.online
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://bl02rn.exgcqfv2.top
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xd4,0x110,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://9nrjm.bysizux.cq4.27nbo.io
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://5evxqj.36o.j17p.shop
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://p37.zd9.otpu9regx.app/ckw84?x=47009
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://lf9zj0.online/9y57?x=5662
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:4004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,16018591469070446332,12867225477133413018,262144 --field-trial-handle=1976,i,3991847958516006809,13562012407486521601,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    PID:3764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,4838057310022520775,11530529592920106359,524288 --field-trial-handle=1976,i,3991847958516006809,13562012407486521601,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,17256206259160692315,13634763857233049934,524288 --field-trial-handle=1976,i,3991847958516006809,13562012407486521601,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=2536 /prefetch:8
    3⤵
    PID:4324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,5832861369398999140,3196696543951538366,2097152 --field-trial-handle=1976,i,3991847958516006809,13562012407486521601,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:3624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,15044452144409001591,12106523656977360469,2097152 --field-trial-handle=1976,i,3991847958516006809,13562012407486521601,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:4204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4520,i,7573142645023149119,15671793068311544669,2097152 --field-trial-handle=1976,i,3991847958516006809,13562012407486521601,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=4444 /prefetch:1
    3⤵
    PID:3236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,14381369997031435481,16770953002769687645,2097152 --field-trial-handle=1976,i,3991847958516006809,13562012407486521601,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:4872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3044,i,12490849501831705744,13166497752978414176,2097152 --field-trial-handle=1976,i,3991847958516006809,13562012407486521601,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=3944 /prefetch:1
    3⤵
    PID:688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4760,i,2601959017106467460,3137807384778014700,524288 --field-trial-handle=1976,i,3991847958516006809,13562012407486521601,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=3432 /prefetch:8
    3⤵
    PID:4716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3256,i,786163427038134947,8547358376277539541,2097152 --field-trial-handle=1976,i,3991847958516006809,13562012407486521601,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=4480 /prefetch:1
    3⤵
    PID:1656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5404,i,15183667057053150418,4851984376340927682,2097152 --field-trial-handle=1976,i,3991847958516006809,13562012407486521601,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=4752 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4656,i,9510180209443199134,11809634059544494981,2097152 --field-trial-handle=1976,i,3991847958516006809,13562012407486521601,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://0khg.dev/8megt?x=95123
  2⤵
  PID:1144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://1he3v.vyxmq5.online/ftq?x=97449
  2⤵
  PID:4668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://p5ac.szj1e4.t6zhrlo.zswr1.dev/ocq?x=12923
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,12651425187145659844,7998741288931899290,524288 --field-trial-handle=2052,i,6376782468623974030,5939525326013931110,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=2080 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,14892937201437549569,11489730776046499161,262144 --field-trial-handle=2052,i,6376782468623974030,5939525326013931110,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=1996 /prefetch:2
    3⤵
    PID:688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,888246040815495045,14850559205011107255,524288 --field-trial-handle=2052,i,6376782468623974030,5939525326013931110,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=2548 /prefetch:8
    3⤵
    PID:4316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,12045652617724917226,10351721074843890679,2097152 --field-trial-handle=2052,i,6376782468623974030,5939525326013931110,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:4356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,11018894330165137230,17035197017199757673,2097152 --field-trial-handle=2052,i,6376782468623974030,5939525326013931110,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:2568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,55117528806204598,11662853303336520238,2097152 --field-trial-handle=2052,i,6376782468623974030,5939525326013931110,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=4444 /prefetch:1
    3⤵
    PID:4996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3292,i,12034931023923238660,9063699758139511991,2097152 --field-trial-handle=2052,i,6376782468623974030,5939525326013931110,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=4404 /prefetch:1
    3⤵
    PID:2108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,15510973245664185868,7164802061804580583,524288 --field-trial-handle=2052,i,6376782468623974030,5939525326013931110,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=5288 /prefetch:8
    3⤵
    PID:3624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5340,i,1293662708041948810,6122509979277625986,2097152 --field-trial-handle=2052,i,6376782468623974030,5939525326013931110,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4784,i,8209392580628600276,17127064500565572201,2097152 --field-trial-handle=2052,i,6376782468623974030,5939525326013931110,262144 --variations-seed-version=20261113-090033.058000-production --mojo-platform-channel-handle=4576 /prefetch:1
    3⤵
    PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://riqjz6.6ogb2.q3vpzx.shop
  2⤵
  PID:204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://lsbho1t.io
  2⤵
  PID:3600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85f1fc728,0x7ff85f1fc734,0x7ff85f1fc740
    3⤵
    PID:4828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32792d98-1aff-499f-a931-289e99373305.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\32792d98-1aff-499f-a931-289e99373305.tmp
Size 276KB
SHA256 19c1b942b4cf0ec7440286cc10240d5568a00ee9c3dc70f26c70c8394ed383c7
MD5 3f94a95af8fe6a47bd942e9ff5984fb8
SHA1 db6e00f6bfe3a8641c6769f6ec7a839bdd2027e9
SHA512 211455f067cff48929a2b702ea6ae004cd0422c9eeb41357de47de3c07b16841a8e42646227efefd7a132ac30205aac399b2cec8281452f5da0c02a3630021b0
SSDEEP 6144:u+oszlvs7pKg9TyGTaAOO3+hFD+7t56OD9ZfSApprw:u+NC7RmAOsyFSXD9ZfS4O
TLSH
T1BC542372DAB5DDD7C9B85284113F81029EEB68CE51DE3316059E9FCF80ADC8D06A2973
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dad6240-d13c-408f-885f-1803185a98c2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5dad6240-d13c-408f-885f-1803185a98c2.tmp
Size 151KB
SHA256 d99f3f4770cbf53bbfc66aec9d43f6eb913c0147447d6263aa0a3520975e7ff1
MD5 a7dccd542dcd07d03082cea7a7bd667e
SHA1 ac124332e3f9a30d8022904adc821952a08b4e41
SHA512 17150e5dad9eb3fb152ff52ef49ad247b39436253b83ac0880481bd9966f8b5c7d4cbbd51cfee4b176de531b7e52a04efddad28f2889f4b1f2fce94743e807b9
SSDEEP 3072:C205u6cxsmCjlvs73ZY1gzJw4ywLMfux/yA2cCT39+97n:rWoszlvs7pKg9TyGTaAOOn
TLSH
T1C2E312B2C9B9AEC59A958398003F40135EEE60CF51D9636666FDEF5B00B89DD07824F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67554d0a-ae6a-4da3-ba76-f43d50c25fd8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\67554d0a-ae6a-4da3-ba76-f43d50c25fd8.tmp
Size 276KB
SHA256 619194bcb73abc0cfb7edd3e665c003a040c908bb94dc5a65e85578bc2152c34
MD5 a76200dc607bed6e3655f9f8608a43b4
SHA1 99438310d19caa91ba488db624d55aff1fad8249
SHA512 7b16795597da70baf508b946d0dcbed087ea315fed84b75330338146a54883505abaa9a71d20c151f5388a655d97f13442c8f37fa47f8b2791e845022465b4c1
SSDEEP 6144:Looszlvs7pKg9TyGTaAOO3+hFD+7t56OD9ZfSApprw:LoNC7RmAOsyFSXD9ZfS4O
TLSH
T1D8542372DAB5DDD7C9B85284113F81029EEB68CE51DE3316059E9FCF80ADC8D06A2973
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4d0c5fbc12a875642429b0dd2daa46ea463d1c2b1482abf3f14cd122bba54191
MD5 d588345da3672470b53c54f52ba4c7ae
SHA1 a4a09d4dfe1f7232a6aee942ed8ba9fafacc4c81
SHA512 8fdce53fcf159847b327d3aea853aff1923b0786fdc362c79ba5e9c4a508f118e8dd193e48658133923b5b97a69d4cf2f94ecc2a52de56b372a393039e32aff8
MD5 SHA1 SHA512

Submit Download

4743920c-ae53-44c7-8c47-9e532dc895af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4743920c-ae53-44c7-8c47-9e532dc895af.tmp
Size 12KB
SHA256 a8de4149b591ea69cda6bb3729108c7e8daea29660a00401de64536b6df2d6a4
MD5 7e8c7763d6c2e9deb264db7872019cd0
SHA1 427f9fbac5ec2a2f14fbd6ac5bc2f3ccc681e03f
SHA512 d4476e8f1947012b4ec8e203acf75f197519c7e1aec6825e2ffeb944ac35af2364f4fd8fa0a7f475764aa684e5e8f86e493140c78c1a919e6a7f7097cb78abe4
SSDEEP 192:iRzGgw85jGfv7UpAPRp2Zlvl0UvHm99/Hsb+WNnOIMPdk17ox8aUTIPyIsnAUgtK:iRSgrjG3AUX/hwOPPC1MCaN8
TLSH
T16842722DB910697B5CDBC62AF9627B57D3F5103224942E84E6FC8D3C29D76CC621B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50c8a069-caf9-4ae4-84a5-a71895842787.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\50c8a069-caf9-4ae4-84a5-a71895842787.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

90edae14-3d29-45dc-b389-ba7647bb5544.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\90edae14-3d29-45dc-b389-ba7647bb5544.tmp
Size 414B
SHA256 16c667f9d49e2f8eb136929881fe83077433f7f639fd9a20ca6c35a74559294a
MD5 84914b5ad90c8bc1d0044b92c7e65aaf
SHA1 d56ad703cc35f51678c50884c5baa34e31defc8f
SHA512 cd0a79d491d3d05e34667f489eb60644e66e40df4bb393d904ad04bdc87f98a7fe12b3c27bbee93381b11a44aa27d02ec05b3674a15364ac95adf858e59dad92
TLSH
T1E6E02BA9D961AC771DFC076810958746E79013573741469B373DD9088FF93360186C6C
MD5 SHA1 SHA512 TLSH

Submit Download

9e1bc586-3c07-4639-ba38-c2feff42b8c5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9e1bc586-3c07-4639-ba38-c2feff42b8c5.tmp
Size 13KB
SHA256 eca2d8ccad4995d0fcee9ef4f0c8322552d2454c66bdb27f1a0961458b433827
MD5 ec6a3c3f6110d3e2a9673387ae6b4624
SHA1 3eac8e6c6e51153120420ea998ecd9b7d3f491b0
SHA512 072e306148c9129f28d896dd7f2110f8e1508248ae460e3ada2e45d7ff7ffdae686847f91131bd7948d6746ceae1117052cb3012e676f4507ccadb8567fda8b1
SSDEEP 192:iRzGgw8zjEfv7UpAPRp2IQlvl0U38Ho499/Hsb+WNnOIMPdk17ox8aUT3PyIsnA4:iRSghjE3AUXjhwOPPC1MCak8
TLSH
T12752922DB910697B5CDBC62AF9627B67D3F5103224942E84E6FD8C3C29D76CC621B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 29c0558b0a1f9311280eb4300ccd5547b93199574f02eaed4d49a8d066e680ac
MD5 3deb0365e6d0b2417b8e4179029ab6e3
SHA1 26b5e226a11ba3e64e6fb1770848849666337dbe
SHA512 ed258a037f2632a1f82be25d6eef4d88aa1e7d33c0ff42c3805811f53f13c7bc3b5320a246db3be2db304999c2a4a6b2edd2d32446b26a1e0caa1f025f4f5b78
SSDEEP 12:d/jdNoYZpk/OZcUyxNmr4c5sjM00WblB/:d/FpEL3ARSJT/
TLSH
T153135E6DD4C21D66FDA610BC69179FF07370C9D5FB4087234939F172A083310022B029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 2e260b3c198bd3ebdfcee810011ddf112b52348c782f17567f6aafe9e5403c9f
MD5 592184c991f4dd373b9680e6c5568f99
SHA1 f4ba5c6dcfd63d7ab2b8496f555d6adda3c6fb5a
SHA512 6a23dc090305ced59219c565fc74c1acfa3dbb92a6650123dd4d227dfa5b19f690ecd7386b3d5acfd18f4c0b225f700e86a43a50baf026a51fad83500a21327d
SSDEEP 48:IDY0FlM1XghvkCsMmXP6X5ZdVEPLVBKWwtlZD96TcUf:j0Flugh8CsjPa9VOLHKWolZU
TLSH
T1C244EAFB1C01DEC7E718D7B86C40E23C8E328A162CD5ADB9F63C84A254946E735285A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 f87d573f1065901dec61bef4cd6e5378a9c2014a5e1ade376e751f68d34a18bd
MD5 51321751fbe9c138c01da3ed97d310e5
SHA1 d73116ffce8793e2a4bfe4c6495df3fe65c979cc
SHA512 f269d203c1f30cd7cb08166b1e0f0ea16d4319b4965c5e2c01b1f9470b0edbdd318e2bc56844f54528861a058238480d6b01a71d27d1081df53f8717d6683788
SSDEEP 96:G+12GYUfDPLGRgcRUv+2s+AbGuEWiH4Sflfd:G+7YUfDPLGRgcRUv+lb9E94q
TLSH
T17C25D7AA0B1479CBD391DA71AAC0CD187DB8229DAD664C82F051827556C6FC60FD134E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 34aac404a0714ea2a18e2688aac4d1a843431a8f337cd007ad7b2c5d29edb8ce
MD5 1ae81258499896ae521c4f746c057cdd
SHA1 1807cf1e1a3f68fa3c6a1668700ad00224d02740
SHA512 b51860aea4cd6c12847827750d7d4982686c68392828096ce78c42f2414728ea7458c0f9d6291c5c8023a387e3d83611b8a4496baa977e61a0ff20f80bf1344c
TLSH
T1E0E0264826CCE76D806DC96307B8634E8FE12400B7E43B078F45ECC83281905A981274
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 526f067ddcfa62b64be9b297c4eda41d32271c2b630d04b83f4096174e24d28e
MD5 94b700885aed7416747ad9e4df97b8b9
SHA1 dc1dd7695d1196282da357a37101f79f8757925f
SHA512 de4dcd4d06f1d5a672766e02aa2633df4b9f9193ee78e17c5710c0def6b889199622f1973b10395ae0ec18f8550c65a9a473ed664e4c93f2f0afbeecbb401927
TLSH
T17BE0DF5426DDD62E5208C22B83A8774ECBE02404E7D96B060F04E4C0B2C580CAEC12E5
MD5 SHA1 SHA512 TLSH

Submit Download

1a3db9f4-7fd8-4082-82c7-a599a1f951f1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1a3db9f4-7fd8-4082-82c7-a599a1f951f1.tmp
Size 1KB
SHA256 5dc7cb100901ddc3a89fa6ad3b138a8fc619d30f9fe72ea86529cadeebe15be3
MD5 7d8563d3fcf4313d1456f3147584d1e4
SHA1 151acfe5cf9f216b30f70560a6f815e5d69e3cec
SHA512 8a2c2a7ffbf0fcced900aa566f6d5b00ba09b5bffed42b3d42c570f56403b7b18ea906e5e6e9f81841548dd33a09b1a067e9914ace3dc82bef0ac71d055d20d7
TLSH
T1E82197F793B0997E8A0092E4EB11AF1FCE790524131C78A289D46D2B43F39B2D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

9136d0b3-d013-49a3-a103-079714593743.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9136d0b3-d013-49a3-a103-079714593743.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b6093a12-1710-47db-b5a6-f0667278b5a5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b6093a12-1710-47db-b5a6-f0667278b5a5.tmp
Size 523B
SHA256 10059da8e9074cf4777057cc2ebbc8b4eb60e15dfe98e3f090f07b5e26f14c33
MD5 ee46c001b1e3445c93a0e76e936a2b01
SHA1 022b0b4a83867e5d79a8087ac5116de271610f46
SHA512 ea984ae7e9350156396fff25a68c7e526a42b8eb478904536cc8d8f5d73b62fcc7c76c76279a186fa9f845cdffd31b8607332e52ee8232126b1d82549461a8eb
TLSH
T127F059A79B7EB46350BA597B2F04B80A65B9A839014128F0CE5A82BCB0C61B70F0650B
MD5 SHA1 SHA512 TLSH

Submit Download

ca212418-5d79-4b0e-a26d-3ffea5174a1c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ca212418-5d79-4b0e-a26d-3ffea5174a1c.tmp
Size 1KB
SHA256 6f7fcf44ba12a49af3941c10a93336250b567f6f6d4bc3cb8912f60436eb0959
MD5 13f3ecb98661af2895474d0a006e7d8d
SHA1 2aad471a2d48f0cc545f874a60bbd79c10a4af00
SHA512 6eda9bf52c68138fe235fd97e2bec089832cc0ed0c3a17a4bfc05b7e4aa4031a49f1efdfe6f0fd3f41ee61ce1a8d0c834468654e044a3e7b659c270e8a0b8097
TLSH
T1B22197F793B0997E8A0092E4EA11AF1FCE790525131C78A289E46D2B43F39B2D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

de7901b7-d46d-4e76-a6a6-4d9ea85f86a3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\de7901b7-d46d-4e76-a6a6-4d9ea85f86a3.tmp
Size 523B
SHA256 7c43a2500050816e2e7cce2b00bf8a02493ed916c6e5ac7d868de4cbc7f8053f
MD5 f2caefc8c9de512b81db2208298bc93a
SHA1 6f2c0111870b8aee1d5bf8d5fca8912809265e80
SHA512 c2ebb5570accc0d02c85ff7b6443e3677e5e67bfe22108b5cd11a1859a5163ad1451fef914c92eaee183a1339ffb5c8bfc381817d6376ea2459ce5bf34947058
TLSH
T1F0F059A7D7B9B86350BE497B1E04B80965B5B438014168F0CE5A82BCA0D61B71F06447
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 28ab3e9046c1ff6534a19029350d98f9ba798a4db6707a08de2077afce73e083
MD5 e48fcabc834847483ade5abd5fc2416e
SHA1 aedbd7565a088145276ab3c46b63d025a38f2f6d
SHA512 f086314ab43b28cfd99286053b7aa531ead64dbac24a133655876f595ddae39ee4ce2edc9ec6905fe4f108ab07517cb301a3bc92cd70753c7ac25c8f8a61f3f0
TLSH
T1C6E0260826C8E63D5199D30307B8934ECAE46419E3DC39461F84EAC053C5C08B892678
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 441B
SHA256 b3eb6cdf93e6340e6a6d956d87e9ee34146a91eb7b736c59076666e136f267ca
MD5 702468116e75e8f1f7528c49cb50c817
SHA1 e8c154e4f9332988a6f3d2b9ea40f0cb2924dedf
SHA512 e9e471373b1234c9cf2ccc8a36af302a0ea08052ff4435a3653332f1d8bf92f611053b57dcb02c4d84ceae24d5f1aeca458e3248b8055eff29aed84a0c0a0009
TLSH
T174F002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 278eda261da8a2a72d4665475b45e7e84dc783d9fdf9471e762427930671f17e
MD5 5f0cc5ab893f8c1ccaa2553f2720da98
SHA1 cc5efb2b86fb83dcacbf532ac6f537f0a3024331
SHA512 a08f3abbcb848a057c8a566f9c02920b0d135738b74e716d94cf1c58c286b87828e3d726604c76e0ce5b2abbaaf6ebd8f0add4252853c053e7a5fddc8d647262
TLSH
T19DE0869826D9D76D5168C97723B4634E8BE02404F7E86A07DF01E4D0238540AABD16F4
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13439079143787380

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13439079143787380
Size 6KB
SHA256 c34065703c3d4a61d6c15bd4f4e73d6a56c5983d748b9275daf0c8c3f99521e4
MD5 2eaf131cd8717e91f571e487e7ab677f
SHA1 35a08e47c4fc2d2535e40ce4b893e868e89b5c0c
SHA512 8a3ee94a94e58010dddef10c9cf154c785a81c8768eeee6a2b62251677a857ad6c8d4d0be3b5a3d7312918af2a5ce9e8c6c87c36f163d96ba5b5ee42414a47e0
SSDEEP 48:3hhGbxGoALFqGrDV2w0tP48yV87wsES6kghkpoTL/tez40IjUpOKGZP/Gl69j6g:3fG1GoAYhm60Bj6OKY3QGj6g
TLSH
T12DE17F2AAD94063AD33D857981AF25F7F6296A1176C14F0B41B1A21A0D277135F70CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 616B
SHA256 6b8e6aecb9b824cf3df1c79907a2ef7e89035886e212bb79da7e84ac8d95f98c
MD5 ee16cb466994b14001eae09cf5264ac4
SHA1 3a839b3f5e898b17f1fb012c1eb2727c3cf9df56
SHA512 7d063cd11b707ff223b751fdb5de330acbdaf0663e405163d2e526a7b0d72c956f4fc83dc2bc673776aec7e251559ff163c18ff2b8d5405bdd03ab3fedad95d9
TLSH
T132F0C07EAF724701EDAA9330175623F00704D04B2D6199B3C59CEE430C47194BDA2BEA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 8f0f9de5428801ce78ecd30c2329ef0e2a36001d534788774b619436b5790b1b
MD5 a83a342400b5a131e0071471758d1bf3
SHA1 c7452c7b1a5786b068156e01cea5430f3f48a5f5
SHA512 18b5f8d69273527888787bd33c60959d06a0f156f17ce8b2a16ef35028b9aefcaf5147941e95ef28921f4c82607782fbc5202267b2e6add12d045e53f7692080
TLSH
T146E0DF2426C9EB2E51CDE35B53A4E34E8AF26408E7FD55162F08FAC46389444B982A60
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 00a16a1b828eabfef5c00f5c16382718e6e21e6cc1dcd1f8f9130bf642c1f8d3
MD5 b088e1b5d71f6a25a02143e9dd3acd80
SHA1 1d3abbb2d0aa8b880cd7691b7ffd42c621485e87
SHA512 db984a6bae5b3ce35834780864dada1bd6b05e03fdeefa97acd6e53afae84dcd342f0bccb54c69ec535cdb93d89dfb7d13026e280c4e50cc2ff8a59c04afba27
TLSH
T124E026742AC8EB3D408AC30703A8A74F8AF06804A3DE370A6F09A1C06282044E9A0BB0
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 9a72bb6df248d1021cebf9b0059118132e8cd798e08f27364e8785e225f7983b
MD5 023db07437a1737dd8ec935b18fb347f
SHA1 2ccc59f672f9c9b60108f7b66729d697eb1295bc
SHA512 29ece9aec870917d048c00f337ee7a3cc2f0db7c3b5640200b6b5913415c5cbf05f218abb3203e645094e2cd4d01485e0f616bb11b580ab221df7471dda853c5
SSDEEP 48:T3j7dojKsKmjKZKAsjZNOjAhts3N8g1j3UzBulLUL5VL1LG6:f7doKsKuKZKlZNmu46yjUuj6
TLSH
T1BC03408E87B840F3C0F2C13EEEC256E2FC7C2A08D7263DD115E903B55E8C036616466A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 3c9e847de4ca3225414f4a1c96257b18f3eca78adb8b155d8d2b11dd2e0f5454
MD5 585dbfb497b172c42d18d039caf01c71
SHA1 ac8ad3774f630567a8f3a4cf82c49c83b223d8d0
SHA512 982e7e426bbec85e7c88ae67f0ee36db321559a992c1d5c487f9fc44833f32d85d0e86b35d0a6ae2a5fba0f1cbc57008b93379bbd5924df0d9338b72061a7f07
SSDEEP 3:jlllNllv/etXlOUpJ9voll+qg/G9TjffaXM/RuWGJpDEJ7KgJpDEJ7HBQvOcfZn:YlOWwlMSCc/mLEJOgLEJLHcfZ
TLSH
T1420222A8A0848018C43140BCC7EEF4803B2D0F593F86260128E000583C9C00650A8B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6f2e081-396e-4002-b9a9-d61d79baf86f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c6f2e081-396e-4002-b9a9-d61d79baf86f.tmp
Size 13KB
SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
MD5 8620b09f169758aa6d92f2e7b8a4c29c
SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
TLSH
T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0fcefaf-a9f0-420a-9e0c-75d4a0020ebc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e0fcefaf-a9f0-420a-9e0c-75d4a0020ebc.tmp
Size 12KB
SHA256 e8614dbf06fbc6c419bc29afabfa4dd5f3916b39cd485c350eb7be0db3d32632
MD5 523c93400c984abc04bb56f8292ba620
SHA1 a6b981ad9ec7825c3f1b2144ab6467c050c59bc4
SHA512 f09b92941a27fb2795d6b8ef8d9fb1db4090d42dbdd122f9fbe852e75065f001fc570f9960c1a1dc5779b2de64eaf35652d293e027e8c1609434412c55cb7a41
SSDEEP 192:iRzGgw85jrNefv7UpAPRp2ZlvluQm99/Hsb+WNnOIMPIk17ox8aUTwVyIsnAUgtK:iRSgrjrNe3AUXFhwOPPx1MCaz8
TLSH
T1F442822DA910797B5CDBC62AF9227B57D3F5103224942E84E6FC8D3C29D76CC622B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 26KB
SHA256 ed2d63a8afd6a7ac3d78ada62242233dec5c70eb2946ff4b8522cc728b2ad279
MD5 e7e91d69c16301754c5bf93fb8ebf264
SHA1 65262ad6beb3d3d22c8df53df90aeb9f2cb8659c
SHA512 22e0f21766319520e9295a3d1ba1c3f14f9aef78c589c870e028f5ae28827e1a791aad243d2b6801f4cc1ef4861d43a2e66f94c34d2a4024d9dbbb2cff259b50
SSDEEP 384:UVT/sdG9wB35QkIIIbbLMIMqBM0D+sdGo4UT4isdG5nQWsdGNdGsuvQI9psdGNdK:6wLQPiuKRI
TLSH
T178C2A66AA3B41B41DC9FD7FBBC594D2E0BB29C8981E74002E49656FE7823F07488179D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 38354a3306cd0f3bdbcf04c258b53ceca31e53590023909a1b546d6a5a14bf02
MD5 37058a7d848d4f71b714be70c37e7ec6
SHA1 769820b6d8ecc2e87e9abe36c96f116d238f0fcd
SHA512 acf52092997818ccf0730c50df0001733788654c44d371d7b4a0911d0f175ecbcc48679334f5fe0ed45fc1c8de9d0618c6df42878a1d4faaa1b2055afc905d48
TLSH
T1A0E026087EC8C76EB098C10702A8D3CDCBF02803FBE4260A0F00D0C462C0008A9A83B0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 4b63fadf5c43e414b1c2066f65d01b3e2237e967820668e69d53411832aa5b12
MD5 537c52c824a28ab47bf06df2b73cb9e6
SHA1 002317f8b96321694be27dc6d007b9df0138711b
SHA512 5c62332bd9fec7423734b5429abd7f5e623d3c4d9138033e50ff082e8c7e09145ddf1996824e882f3391d6a9d041c9d91c49a0a85ad748695cd0e98b720745fb
TLSH
T19521F556F330C259D289863A553E6B25133CC4169FB8EC0F44B520383EB6E000D8B2D9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 8e81336d49e7571991492dfd3e9d3591fa32a0df0efa393661a099297d40d891
MD5 91e216789c17d84603ed9f0bc9c7ae97
SHA1 f410d85bfcac43af39f0f6ea48b1b8674e7dafaf
SHA512 3d2989b9c3c65f71db55a08a8a9efe62a0ff5de60d042ba83da3fcf8816952a35736dfb31d5f20d4ddf9f820206e2eafa091810ffdb0872cff044767023357c7
TLSH
T12FE0DF0C79E8C7AF8028831313A5D38DCAF03842FBA42F0A0F04D9C463C0046B9A52E0
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

c93a7cc1-d5a7-4525-b927-d1f6bc8bdab5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c93a7cc1-d5a7-4525-b927-d1f6bc8bdab5.tmp
Size 130KB
SHA256 4648838451c895ea7e6c10a2a156266777a3866c200b0d86f2aec2c25b9b2706
MD5 ea23bdb03ccc6d9f84d487c5889b75f3
SHA1 5401c39ec6416cbc946c27f2e35577de954d7a2b
SHA512 0f855183bcdb4aefbbff97ffecc2d4594b12a084238c555182bdcabad64da89ecf73e3e037f071b288a3ebb96ebbbe626eb4800f04fd242a51a3544389a124e5
SSDEEP 3072:xpT+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:LT+hFD+7t56OD9ZfSApprE
TLSH
T161D31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_nzdbk5uk.ukw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nzdbk5uk.ukw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/548-1-0x000002A76E920000-0x000002A76E930000-memory.dmp

Download

memory/548-59-0x000002A76E920000-0x000002A76E930000-memory.dmp

Download

memory/548-60-0x000002A76E920000-0x000002A76E930000-memory.dmp

Download

memory/548-7-0x000002A771020000-0x000002A771042000-memory.dmp

Download

memory/548-0-0x000002A76E920000-0x000002A76E930000-memory.dmp

Download