hellokitty | 9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0

Analysis

user interaction
yes
max time kernel
122s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/04/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.exe
Size 179KB
Sample260414-capfbaav6q
SHA256 9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0
MD5 06ce6cd8bde756265f95fcf4eecadbe9
SHA1 bacf50b20f1cf2165ac96535aeac36b49c8a8677
SHA512 b13677539da247707e7016c56aaba889826648b3050428974aca6d109d7fa88d7e610a61214ddee06f1fa09c287ade6f71182b999955c6d3674d5701b0f89326
SSDEEP 3072:U0bRbeSCuF7PXuwFyoJ+mKTrZYzXlEmS6ZCHOoSnEYXosM:U2FeSCulPXuwIoWT9YlhD4d
TLSH
T1B304AE21B4C2C0B1E5B74A7022F8DBB56D7D7A601B3094EFA394077B8E344E26639D67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery hellokitty ransomware

Malware Config

Signatures

Family: HelloKitty Ransomware
Ransomware family which has been active since late 2020, and in early 2021 a variant compromised the CDProjektRed game studio.
ransomware hellokitty
Renames multiple (145) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4164	cmd.exe
3436	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5048	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134206052137052018"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3436	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
564	chrome.exe
564	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeBackupPrivilege	3948	vssvc.exe
Token: SeRestorePrivilege	3948	vssvc.exe
Token: SeAuditPrivilege	3948	vssvc.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe
564	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3952	OpenWith.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4164	4896	9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.exe	95
PID 4164 wrote to memory of 3436	4164	cmd.exe	97
PID 564 wrote to memory of 3324	564	chrome.exe	105
PID 3740 wrote to memory of 972	3740	chrome.exe	107
PID 564 wrote to memory of 5048	564	chrome.exe	108
PID 564 wrote to memory of 4460	564	chrome.exe	109
PID 564 wrote to memory of 4460	564	chrome.exe	109
PID 564 wrote to memory of 3492	564	chrome.exe	110
PID 564 wrote to memory of 3492	564	chrome.exe	110
PID 564 wrote to memory of 3800	564	chrome.exe	112
PID 564 wrote to memory of 3800	564	chrome.exe	112
PID 564 wrote to memory of 640	564	chrome.exe	113
PID 564 wrote to memory of 640	564	chrome.exe	113
PID 564 wrote to memory of 1204	564	chrome.exe	114
PID 564 wrote to memory of 1204	564	chrome.exe	114
PID 564 wrote to memory of 5060	564	chrome.exe	115
PID 564 wrote to memory of 5060	564	chrome.exe	115
PID 564 wrote to memory of 1820	564	chrome.exe	116
PID 564 wrote to memory of 1820	564	chrome.exe	116
PID 564 wrote to memory of 1496	564	chrome.exe	117
PID 564 wrote to memory of 1496	564	chrome.exe	117
PID 564 wrote to memory of 3804	564	chrome.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.exe
"C:\Users\Admin\AppData\Local\Temp\9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 127.0.0.1 & del 9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3436

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe2da9c728,0x7ffe2da9c734,0x7ffe2da9c740
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,9398267849271399976,3682913533797573409,524288 --field-trial-handle=2004,i,11358070757137550373,14569365497607042171,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,2150616123159931666,10384976857144911767,262144 --field-trial-handle=2004,i,11358070757137550373,14569365497607042171,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2452,i,8076445802924996923,15910577564772619329,524288 --field-trial-handle=2004,i,11358070757137550373,14569365497607042171,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,13522533564728947235,9409589421895173955,2097152 --field-trial-handle=2004,i,11358070757137550373,14569365497607042171,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,12562921909873917595,12901939505490904139,2097152 --field-trial-handle=2004,i,11358070757137550373,14569365497607042171,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4556,i,5000723393608521315,14629286578652404611,2097152 --field-trial-handle=2004,i,11358070757137550373,14569365497607042171,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,14399490581002499914,564137575656731289,2097152 --field-trial-handle=2004,i,11358070757137550373,14569365497607042171,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4920,i,570609361723718877,321872352300384505,524288 --field-trial-handle=2004,i,11358070757137550373,14569365497607042171,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3244 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5092,i,9727229802697722380,3328358621695467549,524288 --field-trial-handle=2004,i,11358070757137550373,14569365497607042171,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,15540394292109520423,9871195289936381519,524288 --field-trial-handle=2004,i,11358070757137550373,14569365497607042171,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:3804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe2da9c728,0x7ffe2da9c734,0x7ffe2da9c740
  2⤵
  PID:972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4fd5d530ed140946270170fdf7d661512728c262868b84d775fc44f4fbe643cc
MD5 cb777f6d108ce927a3a5049b67de4c6e
SHA1 2aff4d8db7d4bc8709fcec51e3550b60188bf97c
SHA512 7aaae7f8f5dc4b32e6b04394fea8ca18e72dd428a8ccbc933a49f30aeb0953074a5d78b35cc8ad29d943f02a7c2a9dc8d8fc8bace730a738341be2032bc3c2e2
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 98ea095894b4a1cd651edbff04ff9e205d6509820441af25af2e8d8d3e2fab93
MD5 4b9f281a89776ce383200cb4418ad5ad
SHA1 ea7db5d5e7114217554650d4cd3823f530f05cd2
SHA512 6f69b5954d2cb83da78b90275a307ada5282649cab8ae5dfd70aa8a873465b8a01bfab8e7830a9ffb259226f5bd0ee5d71e18a807527ae88a327868258b87843
TLSH
T117E02BB6C821E83B48FD475860510747EB10235B2BC0484F3F3D831C8FB073A05828AC
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a275ad4bf131b54e4ecc1d55e18047a985072a92df9edfa84aa8dd9bbdede8e8
MD5 7897bdd418b12f9a6d042b1e15012bc6
SHA1 6c3562a37f7e2ccc74b914461d0419e4a3f31d73
SHA512 8c99077e910e886dfa8b220b4abab90ffc128cac09abff01f4e8ec3ae11e6de3416a6c616a2cf04270ed75fdd891ca652e68f0a1ce471f970072832698d166f0
TLSH
T1B3519BF7D3E4997E850196E4AB156F2FCE6E4925131C3CA2C9D4AE0B47F2972D20038E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 251646ef5a203b19745013c7544eae5ec559cb1b6b1ad9bf081abc9269435c5e
MD5 5b811bac1d15fd9362ce5558b438943c
SHA1 2cfe8d6793d556fdaeaca2591f66b2faf11e11ee
SHA512 7894565b455d74cba150c753a76538e7057598273b8d805e88ccb284358207d677772f91d16512d7422ef0aa051ef6a35c688b72d4a92bb907a09a1f02299ba5
TLSH
T1FAF0C9EBA269B89750BD85A73E05B80938B2A031128128F1CEAA412CF0898E71B12023
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3781266c32082eaef2124f2504a1ba129f9bb2d1f9a978e35f5ecf72bce01d3f
MD5 6e4bd3cac2836c68cf5c2bfd02ce7a07
SHA1 189f1f64c9e5c9115343f245f29786546ba7223a
SHA512 56f5e388914bc6e6cf2703034239b57c58f9867a8a303388d3da18c0cb231c3f72a8ea726e8a3a499043cf7eb319644fd087bcf91f5ae21c1b0e7733c577d405
SSDEEP 192:XRioYi4LX5v7CMpAPRp2u93Hsb+WNn4Xn49eo8OZ1nPyIsnAUgtaJ:XRiouZxUXZxw0ni8OZ1j8
TLSH
T10642C52DAE14753B9CEBC319F9217B67DBF2102161D52E84EAFC8A2C15EB6CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0db731b3252ccc4adda1a21c664c9eb0bd3ade68e529f37179690163643439c4
MD5 62a1cf021c53666f3930aa1e9fc1eb04
SHA1 651b313fd3dae546fffda435f752e82978fda0cc
SHA512 5e1194b06ef285027620b708d78ab78555f03a17a0f3aa1d9444e4256e34dc49d0f60263715d6ecbe82b0b3392a32ff85450f663dcd6a50c9b52c33b53309778
TLSH
T1E8B0126180015900C00707B515C2049862189F118B04270163E06976D8264A14018190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d433.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d433.TMP
Size 96B
SHA256 6c87aeb7cb6ec8ec7a8fa0d7c724b1a351cf48e952af5bf100e079095c45967c
MD5 5a6f3bdd84e8147ba0a037781ccc0776
SHA1 51df117fd0b0a527f92c63e305ee18e79dfc6dff
SHA512 6dd76f92c9ab10dd58d1d79e7940f9d9069285cfb2795ecb1c0607cafde7edbc753aa205803fd8ef4e4a2213de1589dc65527e2bd07510f1f3bea45558494adc
TLSH
T1EFB02288C202E203C00303B03C888AC8B330CFB0CA033203C3E00A32CCA8220022C220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 69e117277512d45550f9ed07cad5ff4d7aa34936c6de4deb9ec18295d581f66b
MD5 8ffeaaf3673f6c3141dae4ba391f05be
SHA1 d8b2704e3b47eaa58dc66eb0aa80bd799a44d0ae
SHA512 f283f8b739e812c52a5f58546380f879aa13b8672baa813900ddfa50bb2c29270be95fcc725550b7850b7dd28edf90dff555e13a65e4d614aa3b923eeb2ca172
SSDEEP 3072:7pWmMMJ57KBib72dGAec3Qw/xLANk0mUW5GmRntSFCjEENN:7p1MWhKBY2IcrOk0HOGm/SFyEEn
TLSH
T14814137BCE1746BA8C7C95B774EE6E04CE62764970BFE45C22B8260D255428E3713A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 ec192c386563acb4a060a20eddc586c6c044d8f7004743b1a60dc8d37b89766f
MD5 96d37a1bc5af1c5396ae468cbe05bea8
SHA1 1fbcbf00d0843f35fa540e624d92d1ced9a45419
SHA512 4355a0b99ddaf9252799e28f4d8bb0c16708754193444db482bf7235a5de0d7a544ee894275bcb14818f0f4aac74492e7715fc60b422be6032ed1bf492e662ae
SSDEEP 1536:ip/CcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:aC3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1549312BA4E2646E7997D4A8176AD7909CE12530D705FB9CC325C638D61D01C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

read_me_lkdtt.txt

Path C:\Users\Admin\Contacts\read_me_lkdtt.txt
Size 1KB
SHA256 97109718795f688bdeaec143eff588df1f053c5f1be69fdfd953c8751132fd3f
MD5 10c06898c1a8ee37c2eb262d5c477335
SHA1 363bbdda4afd09205a6434fd690a38b5758ff062
SHA512 0efbc79d3b684af74b85744cd390ac1bac2cca018f859447f686c83106590150d11e55f0e1bfba6b7e86b683659c3a0f4da49331dca8a0bf022fd7ed5e942b74
TLSH
T17221D52633F8404EF2F76B656AB921B15B367D93BC38DA8C0281010D0CE9F1598B0B7B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3952-337-0x00000131B4C00000-0x00000131B4C6B000-memory.dmp

Download

memory/4896-336-0x0000000004800000-0x000000000487E000-memory.dmp

Download

memory/4896-335-0x0000000001340000-0x0000000001359000-memory.dmp

Download

memory/4896-334-0x0000000004800000-0x000000000487E000-memory.dmp

Download

memory/4896-333-0x0000000001340000-0x0000000001359000-memory.dmp

Download