c0d94c0006a0eaef4426c9e36fae15f41cac3f00d9454a8286b5840af18e77ed

Resubmissions

18/04/2026, 04:58

260418-fl62aaay6j7

17/04/2026, 21:34

260417-1ext9acs6s7

Analysis

user interaction
yes
max time kernel
317s
max time network
322s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purble Place.exe
Size 59.1MB
Sample260418-fl62aaay6j
SHA256 c0d94c0006a0eaef4426c9e36fae15f41cac3f00d9454a8286b5840af18e77ed
MD5 e1ccd2c89fd644d4f3ad8c84d16fc2ae
SHA1 0cd1ffd4d4ac3c90c887f30ff4e87bda617680c2
SHA512 eee7db4d0e3907a4eee77d32b05d964cd7fb5ced5a4146f326cca1f609e68804b15f95ff0e3288a6ea75ac2ec1e1feda6301087455cab6e837e86126d8fc7bca
SSDEEP 1572864:DYuymd7IOwIWT4XGfaOvhBgOTvYgq1o+O8z4yeYF7W/PPFTwVg46:DtymtIOwIWTVvvhyOTs1oX82o7g3Ft46
TLSH
T148D7332B64661780F5710B30C8A6753380E5BD08B996E6EAFEDC3E4145BB3D9A07E335
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	Purble Place.exe

Executes dropped EXE 4 IoCs

pid	Process
3576	PurblePlace.exe
3912	PurblePlace.exe
3484	PurblePlace.exe
4792	PurblePlace.exe

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui	Purble Place.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Purble Place.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PurblePlace.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Purble Place.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Purble Place.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Purble Place.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PurblePlace.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1784	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209620236284701"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1148	chrome.exe
1148	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 3576	1388	Purble Place.exe	87
PID 1436 wrote to memory of 5536	1436	chrome.exe	98
PID 1436 wrote to memory of 3056	1436	chrome.exe	99
PID 1436 wrote to memory of 1784	1436	chrome.exe	100
PID 1436 wrote to memory of 3056	1436	chrome.exe	99
PID 1436 wrote to memory of 3200	1436	chrome.exe	101
PID 1436 wrote to memory of 3200	1436	chrome.exe	101
PID 1436 wrote to memory of 2128	1436	chrome.exe	102
PID 1436 wrote to memory of 2128	1436	chrome.exe	102
PID 1436 wrote to memory of 4320	1436	chrome.exe	103
PID 1436 wrote to memory of 4320	1436	chrome.exe	103
PID 1436 wrote to memory of 4088	1436	chrome.exe	105
PID 1436 wrote to memory of 4088	1436	chrome.exe	105
PID 1436 wrote to memory of 2312	1436	chrome.exe	106
PID 1436 wrote to memory of 2312	1436	chrome.exe	106
PID 1436 wrote to memory of 2660	1436	chrome.exe	107
PID 1436 wrote to memory of 3108	1436	chrome.exe	110
PID 1436 wrote to memory of 3108	1436	chrome.exe	110
PID 1436 wrote to memory of 1776	1436	chrome.exe	111
PID 1436 wrote to memory of 1776	1436	chrome.exe	111
PID 1436 wrote to memory of 3708	1436	chrome.exe	114
PID 1436 wrote to memory of 4604	1436	chrome.exe	115
PID 1436 wrote to memory of 6080	1436	chrome.exe	116
PID 1436 wrote to memory of 5824	1436	chrome.exe	117
PID 1436 wrote to memory of 1148	1436	chrome.exe	121
PID 1436 wrote to memory of 4504	1436	chrome.exe	123
PID 1436 wrote to memory of 4504	1436	chrome.exe	123
PID 4324 wrote to memory of 3912	4324	Purble Place.exe	124
PID 4436 wrote to memory of 3484	4436	Purble Place.exe	126
PID 3664 wrote to memory of 4792	3664	Purble Place.exe	131

C:\Users\Admin\AppData\Local\Temp\Purble Place.exe
"C:\Users\Admin\AppData\Local\Temp\Purble Place.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe
  "C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff6f31c728,0x7fff6f31c734,0x7fff6f31c740
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1808,i,9172843003184835959,16477858318803589167,262144 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,8063621196191732447,6841765301176098429,524288 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1652 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,7535123793416767970,2914068388773674775,524288 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,13476846161264745619,6843631850361035442,2097152 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3312,i,136954719428202564,7126624578794601723,2097152 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,1374905671002727783,8308507021096108163,2097152 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4516 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,4304704291169338161,1328227077564896572,2097152 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,10345323980210320535,13170287563879999476,524288 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5804,i,913002405538930924,3003560339479188754,2097152 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4792,i,5642719802763700300,6194392883632179670,2097152 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,17537077457729479269,5561235500966450264,524288 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,18246531580561936286,12811041489501574155,524288 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3152 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,8206208330363836687,15421560557096355917,524288 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=864,i,7380764175399676154,10489992731418963278,524288 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1296 /prefetch:8
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4556,i,7357596269822348278,3630200517445509368,262144 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,14976979216034547248,14371048261333367119,524288 --field-trial-handle=2040,i,9482108088395975707,18358333335178564120,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:4504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5848

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5968

C:\Users\Admin\Downloads\purble_place\Purble Place.exe
"C:\Users\Admin\Downloads\purble_place\Purble Place.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe
  "C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3912

C:\Users\Admin\Downloads\purble_place\Purble Place.exe
"C:\Users\Admin\Downloads\purble_place\Purble Place.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe
  "C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"
  2⤵
  - Executes dropped EXE
  PID:3484

C:\Users\Admin\Downloads\purble_place\Purble Place.exe
"C:\Users\Admin\Downloads\purble_place\Purble Place.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe
  "C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"
  2⤵
  - Executes dropped EXE
  PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PurblePlace.BAK

Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK
Size 847KB
SHA256 d08ce4bd9de7cd6ed5f67ae1a6c13aa5834da17bc75b8b439b1700fe8a0de042
MD5 8195e999b7dcae59569d3a7f9e6652cd
SHA1 3c673ec180d6f5df867184c96ba871de7b462374
SHA512 b578311fcf6a72b8e040d37a1f726616ae5f6ac7c48f85337980c19ca01ffc65873bffbd78d2ca7f0a6f3cc60792396e20b0facfe105cf9c54df465fb4c4fc15
SSDEEP 6144:9nc2VaC+L/ylBc8GSMMQub8MtfJ5orW7IaKCOkSJU:9nbVN+4BcPab8MeW7QC
TLSH
T13605BF91B8408131CCA643B0447F7AB0069FACA58F2457CB29DC73AEAE779D1663764F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PurblePlace.BAK

Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK
Size 847KB
SHA256 ea16cf7d66d2b37791eaee9a8cf23c5c389679234ac78ca456346fd28d0be1c5
MD5 723cd0e85302b77304ab17723e357405
SHA1 18009a696cbba25f1bdcb21b996ad789baec0f53
SHA512 10fa1b694eaf1bb82792d7bc03f932362f776945345a7473d68951b66637554c36fbc98cacc0623f7b05fa518cda339d2621d8fabbd63a219bc4a660047354bc
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

PurblePlace.BAK

Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK
Size 847KB
SHA256 faf049982d19c3afd6508ba80cebe68fa4d05c3990c373e097a366ea9a2e31b2
MD5 efc4bb0840997e4698487b304109dd70
SHA1 2e19cbc21b30f8024fa01f5de9646ea453f1f010
SHA512 92784946e147da601c01100eaebdd7377fae506b2bfa9978f4b658790da2cb495e77348e4068a3666030cc9959da05c94318c6d67a6e0daf6430da4aad9c6f4a
SSDEEP 12288:SGVRca5hPsi4POcaOXvPnbVN+4BcPab8MeW7QC:SGga7IaOHxNUSCW7Q
TLSH
T1C005185266F84124F8F36BB52A7E62B0497BBD625B34C6CF1244319E4E72BD08A31737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PurblePlace.BAK

Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK
Size 847KB
SHA256 7e1d5e25cc698d9de527882df4739159f2fa70edb1ca926ab432b1c4bd91400d
MD5 81bf37bbb0ee5f357e628ed12c0f2390
SHA1 25bb1640200bac4f9deff9b5e9dcca0e7ebf1fa2
SHA512 8b79ed34aa333243668e5a5892b6e69b8e936db32ec3ddf577c55b43ae5ec0c8410665166ffce5c5510b687cb116fe2b4a5d099f61c065af93d742c2d03b4137
SSDEEP 6144:M4YRJ8ODncaOZ2yvPnc2VaC+L/ylBc8GSMMQub8MtfJ5orW7IaKCOkSJU:M4POcaOXvPnbVN+4BcPab8MeW7QC
TLSH
T17705BFA2B940C134CCA542B0447F76B006AEDDB14B6057C7679833EAEE77AD1673628F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PurblePlace.cab

Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab
Size 58.3MB
SHA256 05c112b0e0d2fb44de0f38e06acce8847cb10a0f8abc7e576a85dd8e7111fafb
MD5 5e0e38a38e879e3e89bee24f7a1959c6
SHA1 e959fc925ed08a1914658d02747c5ba13f1c55df
SHA512 d462b81d6b4a112f53dd723e0a5d1876abe44a349d317395a88200df2503a7031c3a3855df2d8d697790792111723b757ffe3e5c82aabad238c70bc82e6124de
SSDEEP 1572864:6g5wXDEh64iCb3KqGhoFgHEQzU3B4wLiestsEyxF:6SwXIh64vxaoFm6Gw2lk
TLSH
T17FD733C50403B801E26591BEBE92AB093A14F9747899EC47B32DDBB170D37D1C9BB687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PurblePlace.cab

Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab
Size 58.3MB
SHA256 cd9d9fdf6959117b5f510c44aa612d53cbb30a15aa0725b96349e77b0d9be63c
MD5 ef1f92263e4439dd1311ad1b10ae4e8a
SHA1 4cda871054f0fbfba3164e8b280a05a7b5ebfc7d
SHA512 c7051ea76365fc4787f684db19218d3c76608af76e237b7e642a5337b82321a7e0141af8d42206088aa7e43a54bd32437e01b2ea4284b677bd486cbb49f4fcaa
SSDEEP 1572864:Yg5wXDEh64iCb3KqGhoFgHEQzU3B4wLiestsEyxF:YSwXIh64vxaoFm6Gw2lk
TLSH
T17DD733C50403B801E26591BEBE93AB043A10F9747899EC47B72DDBB170D3AD1C9BB687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PurblePlace.exe

Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe
Size 937KB
SHA256 f7cfb608bb472d073c84e4021b2c703d148207098a89a26d313df6ff55a806ff
MD5 affb18e583bb28a40f34fbf6175443a6
SHA1 9eac5549521af8096dd0f8d0bb11016b276bb686
SHA512 9b90deed2d4bd9d1eb188925556876f90267a53b01c72839b94fa4e6b750360bc7bd156a92687e06bece989990be4e15d99acb4fd82dd72a726af14532193c54
SSDEEP 12288:JGVRca5hPsi4POcaOXvPnbVN+XBctngb8MeW7QC:JGga7IaOHxNz+CW7Q
TLSH
T10015E75167F84124F5F77BB12A7A66B04A3BBD62AB34C68F0240715E4D72B908E70B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PurblePlace.exe

Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe
Size 937KB
SHA256 092099db987f798ad2396766a6238c6d6dc509f0508701fead6c40c531a5c836
MD5 10d8f53e897874b77fa3f394ee2be29b
SHA1 e5f8a5c454e659ae771e2d5a3afc04e9362f3143
SHA512 9b57b0b7b1cd71e6a33962756ddbe927ba5ab5fae3931edaf99b2638ef63f3f72c86ac8dfd7ab0e03c1444402aed938ae81c4a5ccded39f11b395957431fa030
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

PurblePlace.exe.mui

Path C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui
Size 96KB
SHA256 3a3ed164e42500a1c5b2d0093f0a813d27dc50d038f330cc100a7e70ece2e6e4
MD5 0a9156c4e3c48ef827980639c4d1e263
SHA1 9f13a523321c66208e90d45f87fa0cd9b370e111
SHA512 8a46c1b44c0ea338aff0d2e2d07c34430b67b68b6d27e1adb8cf216b0f0994172ced106a90283f2f0469b5caa40acedf101d45729b823e5179ea55ac507e04ad
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

PurblePlace.exe.mui

Path C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui
Size 96KB
SHA256 7e757c2e3d4d8dbd434dda0c384ab63fa8de19afce86dce944ab3bbd193b9323
MD5 e9de8ca0c34bcb637f5f942209f2344e
SHA1 8c95e4b8f24f5aa8e914c152465ba5f8c9c776ef
SHA512 61a3f1316fb268ee226eb5bd61d29a2957b5fd07ef559d2b014e2d26c8784d066b35cdbaee8a0e53f45ebb9c564532007203102f479d95ac609617d6eadb238d
SSDEEP 1536:VjSF3oM1lZ4ZInMn5YMVfzgvQ4Fn/4phdZhZd:YoMF4ZIqRsVgprZ
TLSH
T1A0A3CD51A3F98549F2FB7F752DB506A41A36BC52FC39C74E1200510E8AB2A46EE70B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowscodeintegrity.luacdf

Path C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf
Size 708B
SHA256 381f9f243e527541bf377599b978020b325370543c0dc89fdbf23ee764680773
MD5 d37af2d76d58a29f7cadadabd2ad6f3c
SHA1 f683f06b963401ae19bc5284022ec6449d2f3f5e
SHA512 ff55684f713e7f642b8a0f49be4b91f00ba40216017535268c8284dce8899f34fae102366d8855ae33540fad3ce78e0705662766bf897a0b9e9a7b5712577801
MD5 SHA1 SHA512

Submit Download

windowscodeintegrity.luacdf

Path C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf
Size 708B
SHA256 d23ed894d3fc74470e68d017fc627c355c2a70382fa8759cbe8f1bf6603e0191
MD5 b9be0d07b6bf8d81797e564a44cd2d07
SHA1 4c91bd5d1dca691f860bb4fbc2e7e57aede36334
SHA512 ec22fef031c0d0cd4d9e6961a490c739ae248caba8d7a201a67c21d035ef67511ee11cc949ca1d15f5187856b3a3c95bdae52b485d7c3320da30669dd17e4f34
TLSH
T1BF014C063664D557C12D167599E792A297223486FF01174F7A80732DFC752D45F12622
MD5 SHA1 SHA512 TLSH

Submit Download

windowscodeintegrity.luacdf

Path C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf
Size 780B
SHA256 679879a045a4fc0469906f91b6410cc32496e53b24d8e743d4b954826b25a6d1
MD5 43046e41072a4e97a0481d8d928b84d3
SHA1 26b3772c1575ef2f4297363ec709db53fb89cbdf
SHA512 bf3ea2c39c99c1088805548af5fbfb2872f0227f73cd969127e7cf0abadaf97f58423389bc7958f9cbe626ffc76836b8138debdc04492ae7a545e2fe60beb704
MD5 SHA1 SHA512

Submit Download

windowscodeintegrity.luacdf

Path C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf
Size 780B
SHA256 0d26ee8471899227f6d8f4f6864f10b4fa21e2e82678a107b2852ce09d6b90f3
MD5 e3ec5048de7e92d68266ea3fa96ecc16
SHA1 dbdfcf802df63dd3d769236a6ff8018fe08c6a6f
SHA512 2a753b8fcccb81558589eec5c48ca04b1d2185a3f396a58553d8e84ba164c3631b8cccd077b63d645fa852b834d630c0a08c99af8ab9fe3e7a06c9478dceab8f
TLSH
T1B0017D0B3654D553C29D42759DA386A2C6217CC7FF011B0BB680B37DAD352916F13626
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1989af52cafd8b7eb7663b9429fa173295f69b1322b90a093421fde20cf2ba75
MD5 bfe3130b7114d59ebf692323b5e24216
SHA1 cce75366a77624bcc83f07219cb5f635c591d38d
SHA512 7166df1d992fbb2b66eb4fc4cf4ad04bde9d1841b5cb48c28e5e04cfb812882090f7a3f36b063e704b65617b692052b90d5f2b0acbc59490f4b4efcc89724ad5
TLSH
T1F7E02BAAC820DC3748F94728615C8746EB5523573B80994F363D810D8F71A36D696D6C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c92802b11de2f3d5ee3136f4690f232e41f76be30f4908211eefdb7e2645217c
MD5 566ec3265c1353345dd964adacf629f6
SHA1 4aed49cd976b313c6d6e4d1f548ebe480494777f
SHA512 a11d65e94969d6a8542c8d8981f2c1dcfae57da66e8ab363f1f9cce7a3b5a8f5042c31fc14484d79152a5043df20323e9c445eca77d1c3d3b9412527c3339384
TLSH
T18C619CF7D3E4866EC51192E4EA246E2FCE790918432C3C66C9D4AF4B53E2873D20034E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 73cbc4518e0f60d093187b6b22452c4c4643478f35277b523b392d16ba7b7b3f
MD5 8dab8affe70969d4f30ea022d8521d85
SHA1 de9ed58884082132504a67dc4fa4930eb3aa9dff
SHA512 d7d6a05542d9fbd3b05c5e9792b2ca7783825cab560eca73cc4045027317131901a49b0cc6cfa5b1507363e396678e56a7f8e82f872192f972563e2e64393186
TLSH
T190718DF7D3E4866EC51256F4DA156E2FCE290A18432C3C66C9D8AF4B93E2873D20135E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c9b084a35cc60fa0733fb6f8291fd3785e510658f0324ad570b064330b7825ad
MD5 6a74bacb87a10ff52da937d16ea540ef
SHA1 44c420651c4cc8ddd3cc4d153c3a61556f3d7079
SHA512 0891a9676703a191ff9c102de2b6ad1ab2ed151e74eb83182c34aaae1f6498a9aa86593276181e0185561692bc600c2b0aaf0d0dba18c9c098c31e8182b712bd
TLSH
T1FE519DF393E4866EC51192E4EA14AE2FCE790918432D3C66C9D4AF4B53F2873D20079E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1d8528b0aad29c93a0494cf150c596735e9144c9167fb221f1430943558c5f2b
MD5 72a179ebd7e5c400a79b426fd402f3ea
SHA1 ca5aea67a2b283b5173c6559970097b075016679
SHA512 e574c23ff6f3bf2785112e2403ea634491cea8bf55343a91f1da6633a53e330865cc10d61694396da5988fe8817d5a4b260b3c3539dd9c252e434f89817306bb
SSDEEP 192:XRfw6qLM315yv73hAPRp2zk9YHsb+WNnTLjCy24heIDa/zVyIsnAUgtaJ:XRfwTLMfeT8XVCwHv2uat8
TLSH
T19442082EA928783B5CCBD32AFDA27B1BDBF1102160D01E44EAFC9A2C14E75CD6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1c8ab609159b6a34dfdb3e7c5a764aeba26a0c7fda0a0ad02c4ec5e336233d17
MD5 99f3b0680023736e3a53c53ffa38478b
SHA1 06f211965087ee20348f34d50033b8914c44d213
SHA512 abc4e4aee361c34b83010faa24ad0285987acd24e4f642f0efa2296e384a10baa980227ed56135a5c3362a996d9e71d8df33cf7feae6d502ead70080c771d880
SSDEEP 192:XRfg6qLM315vv73hRPRphzM9YHsb+WNnTLjnnWeheIDa/nVyIsnAUgraJ:XRfgTLMfnTjXGCwHDWkaJe
TLSH
T12952092EA928797B5CC7D32AF9A17B1BDBF1202125D01E44EAFC9A2C14E76CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7f64ddbde81119a31b62de9e840e1fe3c3e43e6022fd8fe9862e29e3222101e7
MD5 00741eef4a00f155ba8ec2d1e7956381
SHA1 c3af78e332b704b3be050f060d8ff581a42e9f5c
SHA512 8aa688578263f622a2f6f8f12e28418538736866c962500ec0a9451d1cc36aedfc9eeef58c16d1def5bd197f7fa0e442601afa0418fb576e920d6c72771d9e9c
SSDEEP 192:XRfw6qLM315vv73hAPRp2zM9YHsb+WNnTLjnnWXheIDa/1VyIsnAUgraJ:XRfwTLMfnT8X9CwHDWhabe
TLSH
T1FD52092EA928797B5CCBD32AF9A27B1BDBF1102160C01E44EAFC9A3C14E75CD6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 faf205f38f14aaebb964cc4c6cac86c1d9eed1cc4597cf300d120c12563fcb8a
MD5 cfbb6fe69b1dcf37ae21233f58e196af
SHA1 ed1c796023f5198d2aee9d10882084cdf4376191
SHA512 b9f045a63479b9bdf49685c0d4fc4c6a89a446e520e63af89b50cd1c6be690f1e59e8fa198935484ea5c349cca94ef2e2362cf52b4b372d92b7c9f519f144eb0
SSDEEP 384:rVjn27KxkXqKf/pUZNCgVLH2HfgsljM7pLuLcifx8XODnS+ErU3iIHGk0cvXwv:rFn27KxkXqKf/pUZNCgVLH2HfgslM7pd
TLSH
T14A7209A77C4C9E770F94C6CCDC267E4F9CB5024A65E9886883FA982903D5ACF114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f98e0c110c62bfcf4ce25d3c8a68b23ba34f845ff229dc9072c17e0e626caf85
MD5 ef21c3344a4dc61507211a439d370f3f
SHA1 4f559007915a366562b17506c3fd8db82fe25418
SHA512 de27f107027622d55a676caae1dd6bde0f21092ab1f2250417d8ea304962ae016d42e1bc575851f5de017071e156503964b4f0a0f547132944fbf3053a4cc758
TLSH
T1D9B012108001D911C04302B51182058C71585F118B09134153F17AF1E8265E1411B150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589e7d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589e7d.TMP
Size 96B
SHA256 c27ad75900ac08fc44f5faa09cd9ebb497261093101bc0632fb4a59b0614efe0
MD5 eff38fb7332315229b1ebd64914a7e63
SHA1 fd65044ed6b82acaa36f518ae38f297b87504c4b
SHA512 a76cb9f89209b8926ba4cfd7e4d1439a71b1028f398754818b9afe6a235579f4eb7ee26bbe8a7d29b8f77f72c0bea76fcbaf3095c5f1641575adf785c2553805
TLSH
T13BB00255C142E316D14243B025D59EECB165DF36D603121293E06B76DC257B149279E0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 e5e2e996fe0dbbffda9b176693f214c9cb215c5e6a09f8363adef4409785b375
MD5 76004af4b64dbc7424b457eb58931e33
SHA1 46a2fd41cb8fe4994bc386ef5a20ab989afb01d3
SHA512 611af6da301840f091bd1763fa8208a0ad23f03d85846a32a44f4feee1e575d3cdc439a580755d4e2aa4b173b6a82d88b98ad0225a1c0311c9f5704edf4f0a30
SSDEEP 6144:hLsDOEOJe8tV5SUDU3XgrOk0HOGm/SFyEE9:hLsDSJe6RHrOjuGdF29
TLSH
T1851412B52F0E9EB62A2AC391359E984FCC51624834DBD26D21D8A7BC62DC1C45BA3D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 b2fb9f939d3d6327277fe041578f0fa77a1f1ba0f8b131ca452685bb9bb0ca0b
MD5 cef8da8f613b8c8d6fbeaefe1fa73d38
SHA1 d524c3871e481c56b6d659ca86555803bf13a9cd
SHA512 ff3953cfd24efaadace941c7dcf2f2eec2c86f05a7b1741969453685ce86cb746f063cbf3b8f68f58e19a95a6cd5d40a5403b945d6d804b4f4b8e57f39ef84af
SSDEEP 6144:xysDOEOJe8tV5SUDU3XgrOk0HOGm/SFyEE9:AsDSJe6RHrOjuGdF29
TLSH
T1011412F52E0E5EB62E36C295349B640FCC91634975DBE26C21D8A7AC62CC1C85FA3D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 e82e21a82ef6903208d4b9b5cbc6918088d2eb1a17e8703588a7af4736a66abe
MD5 789a1493a46fb95d19dd89d3d8624319
SHA1 756c5a29114220a07a85b812419a34415890c8c6
SHA512 16faa3b79525853da8b75830deb2a095600283f4b1fc8276dff044017d0d7bccd03e942369366d95875f997f24743ce15b2eae80c708dae3e77eda6e47c90c90
SSDEEP 6144:1ysDOEOJe8tV5SUDU3XgrOk0HOGm/SFyEE9:ksDSJe6RHrOjuGdF29
TLSH
T12C1412F52E0E5EB62E36C295349B640FCC91634975DBE26C21D8A7AC61CC1C85FA3D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 5040ad87e2fcd8846d660b26ed67d6e453a6ab86b725396b566dec3feac00519
MD5 c4d4d36b691a0b1a0844cc2a17e1001e
SHA1 a0905e1faf09b6977b4393401b6bf9f1a78983f8
SHA512 27431d7d443a68a8f29da62209240d4b33a4e4dde37e18a5ac5536cbf094bc84d5227e7156174474635322d662f7126de1149ba470440501cd636b1007610468
SSDEEP 1536:5h6cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEj:u3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T18C9312B94E1B46F7957D468276AE7809CE22234D709FA9CC316CA39C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 531b2c5956fa3aad7b4ee6b0aa1fd96be240c260324071e9cf804bb9d1e41d5d
MD5 28cb433b1f280470ac8a76acaf6702b7
SHA1 f4be5f9f2918c125644f81877a22fb7c64222d89
SHA512 a21b69e15e8e3e55da30c35b756a9d9ccb47ab0f4c72162263a27ec957e8fa8f03a6c961e852e9ce0941f29341e1cc25d61312e95e31790d49e26c76bdf47b34
SSDEEP 6144:ALsDOEOJe8tV5SUDU3XgrOk0HOGm/SFyEE9:ALsDSJe6RHrOjuGdF29
TLSH
T1511412B52F0E9FB62A2AC391359E984FCC51624834DBD26D21D8A7BC62DC1C45BA3D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Purble Place.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vista Games\Purble Place.lnk
Size 1KB
SHA256 5473697c9c7e420cbd99f21b96dd476264b92baa983455d8233dab2669f5aafd
MD5 5969f809c542272b3df403e191ccc0a7
SHA1 ab986c90ebecc24151658f215f8ff54e2a3b4f81
SHA512 6f3e971509f9f3a3a180936cbb46f138ef22848c13f5b02fa59997f7a8c75334d8c3731af0fafb785a771e368759fedc4bdd27046e9d9c6ef4047649a1b5ec64
TLSH
T12A21740407E21F99F372157538322BF0AA33B503FB65DB0D424C229928F49049A2AF26
MD5 SHA1 SHA512 TLSH

Submit Download

Purble Place.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vista Games\Purble Place.lnk
Size 1KB
SHA256 83033439366a31a5e1842c273d323a6c1375aad61af81297e5a6ec27b38bf946
MD5 8fe3bc98be5aa49dd76441aa861e866e
SHA1 014825f243dacb52bb47e6d35736976a86e01f63
SHA512 b861cb70ec7befbf06740356ff9f5381ec24706176ad0b0f00748f581c6ba78fb236e2e5e25d37267448a3d20426bc35bcaf3724de7ce762a3970b2ddcb2a54c
TLSH
T11421740407E61F99F37215B138322BF0AA33B503FB65DB1D424C229918F8904993AF26
MD5 SHA1 SHA512 TLSH

Submit Download

Purble Place.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vista Games\Purble Place.lnk
Size 1KB
SHA256 3d6593f59f7ced477cbae63a2356a929c6799ee4c443e0ab14cb1f948ebdacfa
MD5 5da376d220c09a37f57a548ee63f20ca
SHA1 3fd389346bb7a43459cd524b0f40a0cf3742055d
SHA512 26f43a7e1bd0d2d92b4f9a19b4af66ed25b43aef092d257d6a9d6d120e49291f6ee2afb2035d26732c81199352ce3eb9e163164af171b3e221aabe20ec5f9a14
TLSH
T1D121341417E61F99F372557138322BF0AE33B503FBA5DB0D424C129918F4954993AF26
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1388-23-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/3484-255-0x0000000001000000-0x00000000010F2000-memory.dmp

Download

memory/3576-22-0x0000000001000000-0x00000000010F2000-memory.dmp

Download

memory/3664-286-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/3912-218-0x0000000001000000-0x00000000010F2000-memory.dmp

Download

memory/4324-178-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/4324-219-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/4324-186-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/4324-201-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/4436-256-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/4792-285-0x0000000001000000-0x00000000010F2000-memory.dmp

Download

memory/5492-37-0x000001CE32F60000-0x000001CE3308A000-memory.dmp

Download