00d4f8c76162f109e42658456d1b4a92cb372fbc605bf5e9a2d63971042d4e56

Resubmissions

16/04/2026, 01:53

260416-ca6dtsht5x8

16/04/2026, 01:36

260416-b1qkmag16w6

Analysis

user interaction
yes
max time kernel
900s
max time network
902s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 01:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vaptopia.exe
Size 1.8MB
Sample260416-b1qkmag16w
SHA256 00d4f8c76162f109e42658456d1b4a92cb372fbc605bf5e9a2d63971042d4e56
MD5 1e3b98b16795836645e3c6de1b3bc535
SHA1 c46d5cd3093963f4c640708a313c1678abbbd647
SHA512 d396994bf417161d0952143942d4507f352b6737bd50e75036cd06f3c462dd258e89d9bfcd2424125461173eb04b788a1dba2e5e91e870a9d4a10f900734ad9c
SSDEEP 49152:asHbSF42dH8XWvxJ4viJMJvpbcnnGAVJqrDB4eltZju:eRxQpbcnnGAVJqrDBBlDju
TLSH
T1C5959E1E66A501ECD2BBD6BCC92B0623D371B05D1371A5EB12E485F12F43AE91B39F42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
110	yandex.com
112	yandex.com
113	yandex.com
114	yandex.com
47	discord.com
47	yandex.com
72	discord.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4916	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3128	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207776741342794"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{8755B27C-E10A-4141-80BA-A508FF05699C}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
892	chrome.exe
892	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe
Token: SeShutdownPrivilege	4072	chrome.exe
Token: SeCreatePagefilePrivilege	4072	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe
4072	chrome.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 3120	4224	vaptopia.exe	79
PID 3120 wrote to memory of 2356	3120	cmd.exe	81
PID 3120 wrote to memory of 2236	3120	cmd.exe	82
PID 3120 wrote to memory of 5028	3120	cmd.exe	83
PID 4224 wrote to memory of 1632	4224	vaptopia.exe	84
PID 1632 wrote to memory of 2936	1632	cmd.exe	86
PID 2936 wrote to memory of 3128	2936	cmd.exe	88
PID 4224 wrote to memory of 2160	4224	vaptopia.exe	89
PID 2160 wrote to memory of 4688	2160	cmd.exe	91
PID 2160 wrote to memory of 3392	2160	cmd.exe	92
PID 2160 wrote to memory of 952	2160	cmd.exe	93
PID 4072 wrote to memory of 2352	4072	chrome.exe	98
PID 4072 wrote to memory of 4440	4072	chrome.exe	99
PID 4072 wrote to memory of 4440	4072	chrome.exe	99
PID 4072 wrote to memory of 4916	4072	chrome.exe	100
PID 4072 wrote to memory of 3048	4072	chrome.exe	101
PID 4072 wrote to memory of 3048	4072	chrome.exe	101
PID 4072 wrote to memory of 1740	4072	chrome.exe	102
PID 4072 wrote to memory of 1692	4072	chrome.exe	103
PID 4072 wrote to memory of 1740	4072	chrome.exe	102
PID 4072 wrote to memory of 1692	4072	chrome.exe	103
PID 4072 wrote to memory of 952	4072	chrome.exe	105
PID 4072 wrote to memory of 952	4072	chrome.exe	105
PID 4072 wrote to memory of 1300	4072	chrome.exe	107
PID 4072 wrote to memory of 1300	4072	chrome.exe	107
PID 4072 wrote to memory of 2732	4072	chrome.exe	108
PID 4072 wrote to memory of 2656	4072	chrome.exe	112
PID 4072 wrote to memory of 2656	4072	chrome.exe	112
PID 4072 wrote to memory of 880	4072	chrome.exe	113
PID 4072 wrote to memory of 880	4072	chrome.exe	113
PID 4072 wrote to memory of 760	4072	chrome.exe	114
PID 4072 wrote to memory of 760	4072	chrome.exe	114
PID 4072 wrote to memory of 3312	4072	chrome.exe	115
PID 4072 wrote to memory of 3312	4072	chrome.exe	115
PID 4072 wrote to memory of 32	4072	chrome.exe	116
PID 4072 wrote to memory of 32	4072	chrome.exe	116
PID 4072 wrote to memory of 4940	4072	chrome.exe	118
PID 4072 wrote to memory of 2116	4072	chrome.exe	117
PID 4072 wrote to memory of 2116	4072	chrome.exe	117
PID 4072 wrote to memory of 2476	4072	chrome.exe	120
PID 4072 wrote to memory of 1556	4072	chrome.exe	121
PID 4072 wrote to memory of 2512	4072	chrome.exe	122
PID 4072 wrote to memory of 4088	4072	chrome.exe	123
PID 4072 wrote to memory of 4088	4072	chrome.exe	123
PID 4072 wrote to memory of 1672	4072	chrome.exe	124
PID 4072 wrote to memory of 1672	4072	chrome.exe	124
PID 4072 wrote to memory of 1716	4072	chrome.exe	125
PID 4072 wrote to memory of 1716	4072	chrome.exe	125
PID 4072 wrote to memory of 2756	4072	chrome.exe	126
PID 4072 wrote to memory of 2756	4072	chrome.exe	126
PID 4072 wrote to memory of 232	4072	chrome.exe	127
PID 4072 wrote to memory of 232	4072	chrome.exe	127
PID 4072 wrote to memory of 892	4072	chrome.exe	128
PID 4072 wrote to memory of 3948	4072	chrome.exe	129
PID 4072 wrote to memory of 3948	4072	chrome.exe	129
PID 4072 wrote to memory of 1772	4072	chrome.exe	130
PID 4072 wrote to memory of 1772	4072	chrome.exe	130

C:\Users\Admin\AppData\Local\Temp\vaptopia.exe
"C:\Users\Admin\AppData\Local\Temp\vaptopia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\vaptopia.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\vaptopia.exe" MD5
    3⤵
    PID:2356
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2236
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\vaptopia.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\vaptopia.exe" MD5
    3⤵
    PID:4688
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3392
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96536c728,0x7ff96536c734,0x7ff96536c740
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,2348003228919737459,1457926832656973122,262144 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,15988986145455593110,6135156656251095436,524288 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,5711835024120365560,7927957754133359325,524288 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2404 /prefetch:13
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,2633693019824387416,13067129398807451051,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,9528840863457121579,13341892940748563130,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4152,i,2998695784205626299,16675896431637196933,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4220 /prefetch:9
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4632,i,4259604353193056826,14065011247261947951,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,15948462794072106728,17593225060432043944,524288 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5720,i,6902519876510007089,5854820010770401700,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3592,i,13739317100121227006,1224141513993201080,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5808,i,12531107902740924903,15627872720523222257,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5704,i,4061694437246734628,13587195100427475783,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5784,i,14308808268103289974,12512241954962336987,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,7610181168282882138,2390457260992169578,524288 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5764 /prefetch:12
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3468,i,8912438381627099272,5183180860259398989,524288 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4676 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6148,i,17452537132860465589,10683158135401386190,524288 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,8291145627487669356,9364756859891730449,524288 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,16532566564212982870,5830329808832013469,524288 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4256,i,13844692886515628300,16451633521825291128,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4272,i,15616758413395592934,15357576432925032816,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6372,i,12224177453064990061,12699221879745083626,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4232,i,11114105639253174243,4580253486715221147,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6588,i,7540641662789939951,5737197713750131121,524288 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3740 /prefetch:14
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6576,i,12613175290080014942,9611975556117646475,262144 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5940 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,6212804956256218397,15306497546326947830,524288 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=872,i,16037372392018302341,15018845741200078042,2097152 --field-trial-handle=1980,i,8058107109571581724,13397970504910098138,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1156 /prefetch:1
  2⤵
  PID:1772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 864e3ba4e18a5e80ce3c0962801377749e0073240a3a8ce5689a40096fee0338
MD5 a54834cc073195bc4fa703c64d2132a6
SHA1 2dcf6810c96f56d92bdf036976e3f4c6ac16e34a
SHA512 60d25fefbc8a9b1cff9c3357fa9c48f9200dcabc6d75db9796788e8adff7c5396b9eea88e832210bb702a8ced25f5b1b0d10b6c101097b1889b82f779a0be6e0
TLSH
T1F0E09BD9D925DC2B19FD176960544B46F77123972B41494F3B7D820C4FB062B458D86C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 db82d19f0a836055b8c0cad60f92d6bc7552a84f4af392eb7d17dcc9438af3d9
MD5 8d36a30a3b1be014f31392755b4f61ed
SHA1 9b286d28961d22b289c53de732aabe5ddfbeb77c
SHA512 3d8bc9fed6cb6afc8c0669cf16337868d0c1975aaae3147d58bfe97fdd712dc861b0f0bc7397723fb442496ed6cf8ea213c4b4087aa01cbc0c70cc273b64d6fe
TLSH
T13C51010CD10FD92CF3B226365ED88A5771BE18D84907AEC706C5593D19A33215E36769
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 e093b616fe9614c21e26051457e44c1c3cf48e111d677ccba514eb88fd62bd1c
MD5 12021b974ccca7be384dbfb27a8621d8
SHA1 2ab3b574cd508162597425b62257ff63b8182ad7
SHA512 b7adc992cdaabfd729ca5feece4c13faff94da4e73fcc7688632e7a23a832a07f58f0eb97eb7be2e2fcc46b6e1a97a7ad872f78d4474572361efe1c5f7c0b6b8
SSDEEP 192:Dto+Dnnn9/NShGIaahZ4jn3nk9rwy3j4Q6v6DUx5vNiuLWz:Dto+Dnnn9/NShGIaahZ4jn3nk9rwyz4K
TLSH
T192F19CF3C3E5862DC91156F4AB15AE2ECF2D0924432C3C66C9D4AF4B93E2872E25175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 966e016311c3707d2827cf7e643c36e7ed2d57a9bef5c56654b295dda7b69cdb
MD5 b3c0806cb837aa4e5fd305489894c176
SHA1 265e11f92953e7ac514334cb09caf0ef61ea4b78
SHA512 cb9731d364dc860a620a5db8575c68621204c230ba790ce5f58f9abfd531525cb4f7d03b17fad5194f00074486633f658308a5037882ce2d21ba6696baa61e5a
SSDEEP 192:Dto+Dnnn9/NShuGIaahZ4gnk9rwAj4Q6v6DUx5vNiuLOynu93Hz:Dto+Dnnn9/NShuGIaahZ4gnk9rwU4Q6a
TLSH
T10A028EF3C3E8862DC91156F4AB156E2ECF2D0924432C3C66C9D5AF4B93E2871E25175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 7a565ec0c650230999e0a6a8f727ef9bb5952616ba8360e75cd3352c7aabca8b
MD5 de2164eb615e2c8e4f6d9ba811b6b254
SHA1 8238f1e4618be71b7c285cc774d81266f54719ee
SHA512 05d1f8e435ef889c6f31b48f0322cb6dadeb6257d25b10bd751f632a7da1aaa67cba59313234be0c9b058094d0e67f54638a4fd284169a2de2230403328bb95e
SSDEEP 192:Dto+Dnnn9/NShuuuxIaahZ4gnk9rwAj4Q6v6DUx5vNiuLHnWle4Do:Dto+Dnnn9/NShuuuxIaahZ4gnk9rwU49
TLSH
T1A812AEF3C3E8862DC91156F4AB156E2ECF2D0A24432C3C66C9D5AF4B93E2871E25175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9586cfe8e3a0e288abbd1098266b21caba221bccba5f26e00be3cd7e8fc6b517
MD5 413ff666811a8f03bae00128b4f7a005
SHA1 0a19f7d45fb9ea30ae8d5156e491bd64daf49673
SHA512 5b2d650f973676fcb889895e39d8a20f7c32d9c663536d0a07334bb723524441ffa039c9278ef7d175d2f7d3f3f9537267853ce6a3c23b940fd3452e9ea44287
SSDEEP 192:8RkcBzFYrsjx5xKNSv7hp8PRpaRWqu5t3a9qHsb+WNSZQ1KBcrWM42COkwjB+Vyr:8RkmzFMqfO+lAXA4wCGWF2COl2e
TLSH
T12862D76BB918297B9DCAD225F811B717E7F12421A1841DC8E7FC8E1C25E7ACD721B023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c0293903015a085486b455ecc82f1f436574a238eba4950d527edc3dae3c9fa4
MD5 4e539f02c4ef1d78f4650612968b4eba
SHA1 c73ecfc5495dac95cf92f386cd2176bae9e48553
SHA512 03295535f60197584eb40558a1d6585fcfa1b67daeeee64e409a9889977e10ef31deebf9ad491bf982ad4657ca956d5df423016a08d35e04776a07d293205e49
SSDEEP 192:VRkcBzFYrsjx5xKpBv7ApAPRp21Wiu9qHsb+WNu299h24YH2442COkwjF+VyIsnH:VRkmzFMqfCRsUXt4w7T2X252COx28
TLSH
T1B752D66BB918693B4CCAD21AF951B717E7F51421A1842DC8E7FC8E2C14E7ACD721B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2454c14fb9459b23eb108810af9aa7311df33b04fc9449757f44e704f27475fe
MD5 92ceac839d08f390c74351f7cd0c065e
SHA1 aad1590e519344aa7f41caa66198f4656ba23269
SHA512 aeb92f5a853ae9021632ef8e07b3bec02cc815b779a8e8b9a1f8798eab64a4a81f8396442be926353d738028d7a9ac891ea358ec34b9551cbe75f034419592bc
SSDEEP 192:8RkcBgFYrsjx5xKN5v7hpAPRp21v5L59qHsb+WNSdbRt1KBYH2642COkwjv+VyI6:8RkmgFMqfOZlUXa4w1S2b2COz2e
TLSH
T1C052D76BB918297B8CCAD219F911B717E7F52421A1841D88E7FC8F1C15E7ACD721B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d44ffad1807eedb75bf64c10a214515b4058108e36686e62cee929a8470d7ea7
MD5 98879c5222ae2cfc2d07878ea95721f7
SHA1 240c16b33e067ba1733f36722fb642df45d12d40
SHA512 14012f0ce8c506ff3c3b05d589fbb78505665e5f07a2d2c0bf2d3c9dd73e5d2bd0aadc0183fb45e718683e1029879939cd21e036c8886e1cfbcb06948873a266
SSDEEP 192:8RkcBzFYrsjx5xKPcv7hp8PRpaRWqu5t3a9qHsb+WNSZQ1KBcrLw82s42COkwjBj:8RkmzFMqfgIlAXA4wCGb2l2COl2e
TLSH
T11C62D76BE918297B5DCAD225F811B717EBF12421A1841DC8E7FC8E1C25E7ACD711B013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 8498cee7e58cf2361f04cbb49126fad25babf29f3c02d0d71553f16d92836c62
MD5 80695c9bdd398c22d1ec01c618a61e72
SHA1 d02963b1d719a118f353ac7309d6ca5455bee7b1
SHA512 3afdc8db2c17b5c9708c23f11ef18f36f972bd5d21b30a6fb4fa64c11aa25e97df4b76e575cd5d17f22f3310566e2e39228ca4a044fa00e8e7d0d603dd4eb02a
SSDEEP 192:8RkcBzF8rsjx5xK2cv7hp8PRpaRWqu5t3C+9qHsb+WNSZhuA1KtYJ+crLw82J64O:8RkmzFYqflIlAXX4wYA+Bb2Jb2COl2vE
TLSH
T1A862B56BA928297B4DDAD225F811F71BE7F12421A1841DC8E7FC8E1C25E7ACD720B413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 daf7e83133ea9a7e48d0edcce43b6df3b9b2cf3381a461814c9faee8727756a7
MD5 185d62e753f09d48f0f5832ecd35d289
SHA1 932db04cca6a92614591acb2630d0b134fbbdc0a
SHA512 ca1bc1120fec0ec852ae43d9de40e633d22050d39943a97ca0e3b46d225ab55c1bd0951630353a17ed5a5b31f16f9cf94ea888345ccbd5e821dec285696ffa17
SSDEEP 192:8RkcBzFYrsjx5xKGcv7hp8PRpaRWqu5t3a9qHsb+WNSZQ1KBcrLw82s42COkwjBj:8RkmzFMqfVIlAXA4wCGb2l2COl2e
TLSH
T10062D76BE918297B5DCAD225F811B717EBF12421A1841DC8E7FC8E1C25E7ACD711B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 949ff81f137c5f3edcf7e691ac4da8f032e3c906e94558043dc201c435227027
MD5 2b4a7739bd1e7a90f8c1b57c2d486d8b
SHA1 5c11944ed2313e97cd7a5863aaae440d71e535e9
SHA512 38175a05e295ba8c66a28a72e29dfa3920595b48a5db8a10ac36458a7e85c0f1644e3bbac70f28b1f6396dade3381b36a8c85342fde7665e624b86cfc870c990
SSDEEP 192:VRkcBgFYrsjx5xKpBv7hpAPRp21v5L59qHsb+WNSdbRt99h24YH2442COkwjF+VY:VRkmgFMqfCRlUXa4wyT2X252COx28
TLSH
T15B52E76BB928297B4CCAC22AF951B717E7F52421A1841DC8E7FC8E1C15E7ACD711B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 33aadaa0acf1404e07ec453e026f8d94cb24413d8c9485e5167d2af0536322fa
MD5 3920b54e266af8c60909a1a1b66acd94
SHA1 87a78adbd6ac4cfa27211ed610c385dafb45398c
SHA512 84252144d3e5b7d7d3c2bc670fe98c6227d94d64d9b9e15461dc73ec31adae4857c4e56b13cefd74ece7166253a6635a08de52b63c3b883744ee9acd298654fc
SSDEEP 192:8RkcBzFYrsjx5xKNJv7hpAPRp2RWqu5t3a9qHsb+WNSZQ1KBcrWv42COkwjv+Vyr:8RkmzFMqfOJlUXE4wCGWQ2COz2e
TLSH
T1C962E76BB918297B9DCAD225F911B717E7F12421A1841DC8E7FC8E1C25E7ACD321B013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 54d64df4d695cb73695647a5c50f5f5861ddb1f8b1c9d703ddbf4464a052c170
MD5 5b2a56bfba39086c1bb63961d310953e
SHA1 b8db36fe00e7ec330d6dededbab664b61fafd97f
SHA512 f33444a15467ba8fc836d6d0cdd378b19958bce2bb253265e80aeb8cdd814f292dd217725f4779a352fb77f249ea9f0861995cdfb3f427de7fb9005308601542
SSDEEP 192:8RkcBzFYrsjx5xKXBv7hp8PRpaRWqu5t3a9qHsb+WNSZQ1KBcrLw82s42COkwjBj:8RkmzFMqfARlAXA4wCGb2l2COl2e
TLSH
T1D062D76BE918297B9DCAD225F811B717EBF12421A1841DC8E7FC8E1C25E7ACD711B013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 91091ba1e4674e28c93bf7fe81e0c832037de4cdea1090be4d32e50a5dd2b85b
MD5 b4c8ccd86461f202462c845f0b87c1ef
SHA1 fead448c7f175354342d132a193eb1247f9df3cb
SHA512 aea21027ce171344238e4aaf6b5b25143f38e7f4bbd4b942a97dd21dbb113094dd00a9095237b942bcdd1f18c69810ebd22eeb636e38d66e0b3a1c64dce049d1
SSDEEP 192:8RkcBzFYrsjx5xK2zv7hp8PRpaRWqu5t3CU9qHsb+WNSZhuA1KtYJ+crLw82J644:8RkmzFMqflLlAXV4wYA+Bb2Jb2COl2e
TLSH
T1F062B56BA928297B4DDAD225F811F75BE7F12421A1841DC8E7FC8E1C25E7ACD720B413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 44dfa816c8ee072890e1cb9ff1215e1e0d4997d3d483dc235c9e910aeff090d5
MD5 4f2cd13600e2f92c1d77b0f973273619
SHA1 2053218dbc482795b64410cf73c03b1a2e54c644
SHA512 b494e1d0543a9b3a745ab6ae8959b309da8771f960e5ebc3b9153c7b14d2a74e6dd8f4533dc99dc89a9051be8ca2add7453bf80b7f0300799bfa7397353319cc
SSDEEP 192:8RkcBzFYrsjx5xKzzv7hp8PRpaRWqu5t3a9qHsb+WNSZQ1KBcrLw82s42COkwjBj:8RkmzFMqfcLlAXA4wCGb2l2COl2e
TLSH
T14462D76BE918297B5DCAD225F811B717EBF12421A1841DC8E7FC8E1C25E7ACD721B023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
MD5 e1d791f76039330e35fa0e1827d639ea
SHA1 a37e7b6749565fdef84e626eb8e8ab5cfd1eaf09
SHA512 4cd2d4ec371de591ed8fc49a3c9c69bf2d80c0d8879044f55af268ee4a35e216538e529304db502c0dc2822c3e20cfadd9949c623d30489800bbc0cdffa3ddcc
SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLuLcifklXODqt+ErU3sjHG9TDWxSal2:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pU
TLSH
T1B672E8676C0C9D7B0F94C58CD8267E4FADB9024B65ED886483FA582A03D5BDF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 8c0e51961b2d728f1a2f1893e035ad550a17ff896ca6edc339d00bf52749904f
MD5 7aecd4d7da0b50d23ccf8c48ce7eeb85
SHA1 6dd418cabd653140fecf920f29d9e402cde3291b
SHA512 fc638fc14c99a453d22a31cd66a9af9f739a99ec0c826562728e6e16f60f64b92f528c6c4cf509ebdfeb68fc8c0b1848d7a351d1e6860519881c74d160fbca8a
TLSH
T108D0971BE2020980EFABCA91393304AD4BA02D880C41D04E9002223908F6E939119F92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 9c91d8e5503070a5430cb79ae4bb98cc6ee598b1c4f5674331902207c5669661
MD5 5f6b1406fc719551ecd3eacd6ce12814
SHA1 dd00867419c170a2daef75e8149037248387cdd5
SHA512 40f299aabb48853d952957e307b91a20f28e872fda5936acc5c05894569de649736d67464b5e069532bb38eed057fe82733c9e887736d2ac72aa0958c7399f51
TLSH
T177D0971BE2020A80AEABCB90393704AE4BA439880855904EA00201350CC6EA3A006F92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe6219fb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe6219fb.TMP
Size 138B
SHA256 ce5b9e104b0ada45567068fdb000d7b2af9ed31a235be6aae4b2f9ee81c12b81
MD5 ac908f21134e2eb8a953548884d9f3be
SHA1 a67f391070394812fbff8d90c9236969a5564b63
SHA512 0cda2f116df3745b22550883d5b6ac987786d8549cb61376ed22905be9e4b4fede6de9f33b9be53de46bdb8897dce03cb932384ac841c7674cc35b9e1da2d153
TLSH
T1E7C02B77E2050C518F5243610B33159C87043ECC0C82808D601335242077F33610EFA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5df82a8966673376ad26d40df3470175b39ea1654e60d177928497ac84591525
MD5 126a295c202c029bc20ac994bc1af2d0
SHA1 57a4da17c8fbb7665160c8d9b4d57778a7a6e059
SHA512 c35b1aeaae66a685750eee7dd0713f9bda7cbd7dfbf54102055d3e2b231ba7f727bafc810790c9e97b0ca6d4283a54df7dee8f95ddbe9df60fb3a05697937e05
TLSH
T1B7B01290C0539601C45703F42183488831149F50C705670193E1A971AC661904015160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe6221ab.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe6221ab.TMP
Size 96B
SHA256 8e1b28e3465a21f19633c8da090657f7af9b66c560e754720f8d83be12956c47
MD5 052704af370b81886d856fc5d136fdc1
SHA1 d4ae377414e80f1bda3aac3574fb262963213b81
SHA512 b224fb54543f79c3a47cb6e9bcf563744392490d70898bf97faad969d87acc979a90dd76bbe19f61d491f929a87e7066874eba3e8ae9e40ef25df7f0b7848296
TLSH
T139B02232C002E202C00203B0288AB0C830B0CF22C303220382E00AEAFC232200033820
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 9cf25a12ad564f4ec9b082188468c205756761569615eb8b2283293c5cd8b7c7
MD5 505c3808d3dd17fc2b9df2a04bc53971
SHA1 16b680824da12a6ae1724246272fbffaa16cee90
SHA512 dc07bb8cb2c84b0971e960a7ffa89e540a08232df46c22bf91ed61f7c88c6978be2d7e0045cbc9051df6e84c547cffe42899a59fb1cd8e5dbb8e99065fc97158
SSDEEP 3072:uTiZvt7EwVxFwhwtCIopQU9eFAxiZIBYQYfxch++J3qUQm08KMWF0bFTcVHr6zW:4GvGgwGox1+Q3++JjcMW2VcVL1
TLSH
T1AF141277DA2F3C3E33AF53B5A1255C1A19E29A6D119021FD20C75B0F1CEEB82664B861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 cd442eb4132898204012a94466fdfaf9fad146443dcc034cc20ffa30ff6e460f
MD5 d3c3aa32daea08f15d984b5e518254dc
SHA1 2e51d3a06030b511966651d06ba7bc3e4ab60db2
SHA512 58907056ac1197ab2c8bf3b1fbd4c78cd3328ba4eb0890e67927376f92620a6d70a67bd2a0b474ccd029c78f9fac535d9e088ea30b81ac045c67f98c850b9938
SSDEEP 1536:hZPP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:P++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T19D9302BA591E7D39636AC296D0079CAC8CE3DCCE1514557C30C7AF1E18BA393A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 638006d12137b073b173e050e5140f3bd030853fec7225a9eb97ce72d68a0e04
MD5 d4a9a9f4fc4f5c3540089eb5b787928f
SHA1 4842e1055d3341f81115ea3db424a96a33ba4f0a
SHA512 2423f465ea3d3c696ac62c30e03fa2cd5a0880a39242e6a914408af12455f55ec3a36d63acd21790993a9678729da056a5f74a4420500249f9cd814d3ce98155
SSDEEP 3072:4fTiZvt7EwVxFwhwtCIopQU9eFAxiZIBYQYfxch++J3qUQm08KMWF0bFTcVHr6zW:4bGvGgwGox1+Q3++JjcMW2VcVL1
TLSH
T1EF141277EA2F3C3E36AB53B5A1255C1A0CE1DA6E165031FD20D66B0F0CEE7826647871
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 229349b897b9ff06ccaae009c6f1e46d6bc83d865a32d3f60d075ddc54db64d1
MD5 86872de452794cc0ed5f4044309d6f49
SHA1 5ec558ea0682d09aae2a0ac366a294bf6c2257c3
SHA512 0886b13a04d0cda182dcaf3a1c43949cc3866ec2f5aaa5bd887d8993bc2937e632c468990c29405730da3fbba696b563b8c36a3f4b6242e81b7868727adb892b
SSDEEP 3072:RTiZvt7EwVxFwhwtCIopQU9eFAxiZIBYQYfxch++J3qUQm08KMWF0bFTcVHr6zW:ZGvGgwGox1+Q3++JjcMW2VcVL1
TLSH
T123141277DA2F3C3E33AF53B5A1255C1A19E29A6D119021FD20C75B0F1CEEB82664B871
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 9d40c9e156c6f4c3facf8663f820ceff3f4667cbb7b30fe5f4b5df4447269fad
MD5 7664cbc7acaae57b2361124f70651a7a
SHA1 e5cd90863d23ee406c67eafe1f49c8a488282ec3
SHA512 22292d5cda2207120ec2cf160c6f09d6f5c93f2b254663d2611890d45ef663e769384e7f61bf05a03668e9483ff39594144529459b571b1f99eb08a6e2e02a86
SSDEEP 3072:NTiZvt7EwVxFwhwtCIopQU9eFAxiZIBYQYfxch++J3qUQm08KMWF0bFTcVHr6zW:FGvGgwGox1+Q3++JjcMW2VcVL1
TLSH
T149141277DA2F3C3E33AF53B5A1255C1A19E29A6D119021FD20C75B0F0CEEB82664B861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 eba4de72f4f6eb2f01c9099eb7346f2a3c0aea05d6ed452b09d4c9bd3b5cd688
MD5 0165c7d0d38df0bb6cc5ca9a50af2317
SHA1 959d00c74ea6772fe2a378d405c2d278400e8130
SHA512 0358e408d5374a97919e02142b0b49b56874c7993f1b9610555cefe991db9f8327eaf48f1d876a303684927ab07c22842928909d5625fdd8d294bd2783d724bd
SSDEEP 3072:ofTiZvt7EwVxFwhwtCIopQU9eFAxiZIBYQYfxch++J3qUQm08KMWF0bFTcVHr6zW:obGvGgwGox1+Q3++JjcMW2VcVL1
TLSH
T125141277DA2F3C2E37AB53B5A1255C1A0CE1DA6E165031FD20C66B0F0CEE7826647871
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2356-0-0x0000018BD1AA0000-0x0000018BD1AD1000-memory.dmp

Download

memory/3128-4-0x000002BA3A4C0000-0x000002BA3A4F1000-memory.dmp

Download

memory/4224-1-0x000002528E690000-0x000002528E6C1000-memory.dmp

Download

memory/4224-6-0x000002528FF10000-0x000002528FF22000-memory.dmp

Download

memory/4688-3-0x000001D9AD420000-0x000001D9AD451000-memory.dmp

Download