064dca20dcd7ee4753912017b3e96766561ddf6d3b8c45a76f3024b97422bf80

Resubmissions

18/04/2026, 08:53

260418-ks9szabw4v3

18/04/2026, 08:48

260418-kqhxgabv8w3

18/04/2026, 08:44

260418-knm4eabv6t4

18/04/2026, 08:40

260418-kkyqqsbv5z6

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Married Into Hell.exe
Size 651KB
Sample260418-knm4eabv6t
SHA256 064dca20dcd7ee4753912017b3e96766561ddf6d3b8c45a76f3024b97422bf80
MD5 754410d8d13d32877e3cc3e8e788c91b
SHA1 6cdfbaab601e7fd142102e1bf497e48fef44e71a
SHA512 2c259f14526d20a39fcabfefcdd0c10f45b40d837dada5ba6107d896fcc61bee9904a16dc373af854cedf293b77325ea9a193254748a61795097f64f4c72de0a
SSDEEP 6144:Z/7Fu9mpcJ/OD8mZQQBtXVRiPqUpjC3TO6PUzidPDpw0UEZOqwQc5dki:Z/7g4aOD8aQQ7XVsA3TO6PndtCaxg
TLSH
T141E472167D44E58DDC42FBFBA18A68F76BA10CA7C11A04B36F153DBD7CBA068DA31211
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2680	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209755387741290"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{F97E2307-9AEF-4688-B1DD-7CF9D2460CBA}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1220	chrome.exe
1220	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe
Token: SeShutdownPrivilege	1436	chrome.exe
Token: SeCreatePagefilePrivilege	1436	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 4804	1436	chrome.exe	81
PID 1436 wrote to memory of 2484	1436	chrome.exe	82
PID 1436 wrote to memory of 2484	1436	chrome.exe	82
PID 1436 wrote to memory of 2680	1436	chrome.exe	83
PID 1436 wrote to memory of 4548	1436	chrome.exe	84
PID 1436 wrote to memory of 4548	1436	chrome.exe	84
PID 1436 wrote to memory of 4188	1436	chrome.exe	86
PID 1436 wrote to memory of 4188	1436	chrome.exe	86
PID 1436 wrote to memory of 2560	1436	chrome.exe	87
PID 1436 wrote to memory of 2560	1436	chrome.exe	87
PID 1436 wrote to memory of 5080	1436	chrome.exe	89
PID 1436 wrote to memory of 5080	1436	chrome.exe	89
PID 1436 wrote to memory of 2472	1436	chrome.exe	91
PID 1436 wrote to memory of 2472	1436	chrome.exe	91
PID 1436 wrote to memory of 1756	1436	chrome.exe	93
PID 1436 wrote to memory of 4892	1436	chrome.exe	95
PID 1436 wrote to memory of 4892	1436	chrome.exe	95
PID 1436 wrote to memory of 1008	1436	chrome.exe	96
PID 1436 wrote to memory of 1008	1436	chrome.exe	96
PID 1436 wrote to memory of 2468	1436	chrome.exe	97
PID 1436 wrote to memory of 2468	1436	chrome.exe	97
PID 1436 wrote to memory of 2424	1436	chrome.exe	98
PID 1436 wrote to memory of 4460	1436	chrome.exe	99
PID 1436 wrote to memory of 2424	1436	chrome.exe	98
PID 1436 wrote to memory of 1032	1436	chrome.exe	100
PID 1436 wrote to memory of 1032	1436	chrome.exe	100
PID 1436 wrote to memory of 4508	1436	chrome.exe	101
PID 1436 wrote to memory of 4508	1436	chrome.exe	101
PID 1436 wrote to memory of 4456	1436	chrome.exe	102
PID 1436 wrote to memory of 4456	1436	chrome.exe	102
PID 1436 wrote to memory of 3300	1436	chrome.exe	103
PID 1436 wrote to memory of 3300	1436	chrome.exe	103
PID 1436 wrote to memory of 3652	1436	chrome.exe	104
PID 1436 wrote to memory of 3652	1436	chrome.exe	104
PID 1436 wrote to memory of 1824	1436	chrome.exe	105
PID 1436 wrote to memory of 1824	1436	chrome.exe	105
PID 1436 wrote to memory of 4508	1436	chrome.exe	106
PID 1436 wrote to memory of 4508	1436	chrome.exe	106
PID 1436 wrote to memory of 1032	1436	chrome.exe	107
PID 1436 wrote to memory of 1032	1436	chrome.exe	107
PID 1436 wrote to memory of 3512	1436	chrome.exe	108
PID 1436 wrote to memory of 3512	1436	chrome.exe	108
PID 1436 wrote to memory of 3500	1436	chrome.exe	109
PID 1436 wrote to memory of 3500	1436	chrome.exe	109
PID 1436 wrote to memory of 4812	1436	chrome.exe	110
PID 1436 wrote to memory of 4972	1436	chrome.exe	111
PID 1436 wrote to memory of 2968	1436	chrome.exe	112
PID 1436 wrote to memory of 1220	1436	chrome.exe	116

C:\Users\Admin\AppData\Local\Temp\Married Into Hell.exe
"C:\Users\Admin\AppData\Local\Temp\Married Into Hell.exe"
1⤵
PID:4972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8fc43c728,0x7ff8fc43c734,0x7ff8fc43c740
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,17134353879183989916,13981340489320039543,262144 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,1292037188123484005,8602149770280147835,524288 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,3230056232445559886,6757993480275526003,524288 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2312 /prefetch:13
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,10929976521523738329,11091751317894452293,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,9383847006402322144,7372817176942866642,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4224,i,5277532952998413796,9334262778233623982,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4240 /prefetch:9
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4608,i,14123704453869944507,10498553159740729039,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,4184840591944286088,2767490568744029354,524288 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5848,i,426435230999574877,10859185049784540132,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4616,i,14971287669787049538,16165372784386799450,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3628,i,17933186818348943697,17956271656185874702,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3592,i,5398058032696147770,8941727333535251740,524288 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4592 /prefetch:12
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,14517823893797417090,10435755947774948431,524288 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3576 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3440,i,9054296949719821450,7597132981563433929,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6228,i,5186845461800374447,7445538431541122951,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6348,i,7042958554715497072,15545548876543302406,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6244,i,17692450795433721489,4321549603362746550,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,9406240756416634590,15283019791559784788,524288 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6712,i,5673959941331621025,16647480593291573324,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6612,i,14501851583602675155,8760983646773359558,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5996,i,6709373409178567596,4759448136623928798,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4604,i,15568533397382957509,13635746735426304030,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6488,i,3043756140538562687,3955363659062062004,2097152 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,13924536288760935186,9491652432984250948,524288 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3432 /prefetch:14
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,4276830254750670993,13666169785625613028,524288 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6464,i,1219497106719657384,12799430094789009899,524288 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5640,i,1930851392990005934,10890430595542293946,262144 --field-trial-handle=1908,i,9318037966519848949,12576968049305603840,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5628 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2200

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 924093637eb309715ad02a89e71f48e6dd39028b2214087325d6e04342b021d2
MD5 382b680cd37b923bac39320fe2e871f9
SHA1 d0f33b535a2ad83c79ec09d6ab146cb130669818
SHA512 7cf8c05073a7f9216e21e9adc8080ab2afcad74daaf9c56858126c1b3a5026304393c6caa7ed4694ac33858154880ac87632cd503a01a92a601822912e823671
TLSH
T15AE02BABC972DC2706FD4B1960600746EA51735B2B50549F3B3DC20C8FF1E2B4A4595C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 65KB
SHA256 7bc424130eda2bae7fca759b777f9af68b2ffdd1db9799c7f5b482bbf3375a2f
MD5 2bd30bcdb6172c371ff17cac2fbc52c3
SHA1 17b341c22afa48bf9ac82b7525da4969ce516ec7
SHA512 6e5ec1b1aa0558d9ebc3439adfee842b7f31e9e307ce221f9c463ba6b1d40dfc938d9dbdcd8537980ca600778a97db6b76c15e5915045a9f817699000efd5016
SSDEEP 1536:uYZknOit3uYJaoHyR2Ebg/dEgINEX1b25IjcpXQzv3zC+VFNB:uYmOittLyRHb+dEPsb2Ojc1QzLC+VHB
TLSH
T1CD630202D4949D8DF6F31853F73309BA5F669E70E628CCEB64F8CF6F6818050740A5A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 361KB
SHA256 9b18bd89172ac63893a9a1b3bdd32ebeac212dba1a1bdf1db57252c2c3c0bd46
MD5 61837e57b2cd9318cee65f0b81bc5b88
SHA1 6984102dc9db9375913436995e7af0f4d9fe3fc3
SHA512 2ed84bd4ad75eeaf22e7c681cffb7ec8231e353341b3dda746000809f2c80808867983e9c360815d15c8c3195065c71b1b09851ceec8ce367607d1db1f72100a
SSDEEP 6144:0YlBlHlO/+YiIz5y2O70vARWn3HN0jiJmvREAlwWMeZLKKxdxw2vSBUuPpjIf3ye:0Y3lFARCoWiJmvRblDM6LKG7w3BUuPpC
TLSH
T1AF7423B07F6452D06F915B7B4F9AA690CA398873AD64F676023C5F31667F8DD0AC4A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 9a883466919f6115f33dfcc47eff58427acfd77c28604c9821416601234eb262
MD5 2d9148853ece653df1e8305a9d51b243
SHA1 2ef94fec5d64c74bc0e03dad8ba08601534aa507
SHA512 0c08ad14c5b3ef655b67f8da2317fdbc41b2947f0d320594d43a9659045bc6ea5ecd907960c23a55650ef5b91f24df99083cb14d385411d517f04f79906aa936
TLSH
T1EF31857912C6E316FF41CF72A0E3DE53A03A415805A62B0301C6A1FC78476E772795F2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 110KB
SHA256 efa32cbc332295710779942c15fff9cb4a5eefb75fb1d879d0e35dea66c33466
MD5 9d8c59d6d8d9ce32ca382a89a21e7037
SHA1 a56580e3e9b7d723e2cdbcfbf7e6deb9f155ec29
SHA512 afeae872bf930358fdcc1ef3f7c9a3392ebc5ae90d79e06c6a9a70050c19b0d4b148111c9308fc30cd78a90b2bf44673894c27d540878d2d8de3d5fb766989e6
SSDEEP 1536:7XE1nKi981w7HhzVCzNhlVrj50hFoioIo0:7XE1nlR7HhzVCnlVrj50hF5oIo0
TLSH
T17CB3C54E36E836E7CA49C27519014E699BFD2D0915CC609FFCD17A1CABB7E812325E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 349B
SHA256 16a377e33d9a6567f8a0380487ba35f6d150f5281f413d423d7852b19cc0157e
MD5 f3786f23ca85c014b0155c22d40c961e
SHA1 19940b71d034e431b4e53bb4d945229d5dbe008b
SHA512 65d037b6d8b16b4a622bbcdf6ec01199a7900f36d2d5539666aaa9a6387515b588838ae654f3daaf44b9591683f5b3842d4f4ffc78d956656237de733ffc050a
TLSH
T1D5E0205955C9CAEF519480AB19747F0EE9D6550CF7DDACC51FC3D40470C940CA0A8250
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 3e142f8c7539d22d7a8010557a138b91e4bc043c2f0a39b47a0c6abe54d1f7d9
MD5 62f746dd8a67c502c71e22fea7c92897
SHA1 32fc8ea1a19f531b6af6018e0495fa50b29f911c
SHA512 ed46a390c6677f4a868b939fb73ade1e23b158a65a90c78e0638de2be248f22a33f909ea3724f6b2ddd9eeee9e2f1a467bfd629950a3b38b42559c8270b89de6
SSDEEP 192:DQBtfmM3UNDx4Khbaahiqcv7uiIPCrW6Kn1T44r27feYWphB+H19blmO:DQBtfmM3UNDx4Khbaahiqcv7uiIPCrWE
TLSH
T1D1226BF7C3E4C62DD8116AF4EB246E2BCE690A24832D3C66C9D5AE4B93F5471D20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 31bca0fa24d98190ad90d0be8efbc7d2cd368173073af77f5f9ed51cf89f0f84
MD5 ddd65f5a8876dd1510d23cbf20b1dbc2
SHA1 93aabd155bbca8186b18f717a01d36f73f8d16a9
SHA512 b9ab3a0ae6b734156f260e898fc80fd4b9e44fa7aac264ade6fe886c9336231eb9de7a77b731e5bf7c2598856614f34ab6cc05a021714a425a545ea58d7accde
SSDEEP 192:zRs71IdbWiv7nY6APRp2C6Xf/gh0N98Hsb+WNn7cbtp4m7cUmr2ZkKkwQO3TVyI6:zRs7LuE7XA6woL4v12KKFe
TLSH
T12C62C79BB910657B8CD7D22AF911B72BEBF11021A5D41E88A7FCCE1C24E7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ca3cd2dc655a6f178c41203bf040c54d18ff0a61e94443e72b9e0d5c7c939246
MD5 b2386ed935e11338d96cbb756c50aa0b
SHA1 d78c2fa9a7cdd4e49dd02e2bb255a11db327c07e
SHA512 bf7b0557f85c75483d5708aab617f08a43a758943cec00230dd70e3504f56f609c6756cbbb7a5a1ea9eb4d2ecbde2afe7818d8ba0c016a104738f55f643db8bc
SSDEEP 192:PRs71IdbRiv7HYhAPRp2U+Z98Hsb+WNnyHbtp42VkKkwQO3dVyIsnAUgtaJ:PRs74uE8XK6wUL42WK78
TLSH
T1E952C55AA910757B8CC7D22AFD12BB17EBF1102261941E88E7FCCA2C14E79CC2227427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4fd4713a2f5567f6511d3c698c0478446d5f0003bf61e76492f3ac3274d974b3
MD5 f0f5477fe6ce36b4f5e35c4ae9ce033b
SHA1 196c295e5d6ea101831dd6bb22fb6b87a4ae2034
SHA512 8008cf2cf0ee2adc47b2524a880cd4e2ee06b04088cc9d36e6a9e4715e3348e45aeab6c648aa61674ccae2f18ee3c398ad57869392671195cd86ee0c1fed90b4
SSDEEP 192:5Rs71IdbWiv7nYVAPRp2Uj/g/N98Hsb+WNnxOItp4Umr2YkKkwQO3dVyIsnAUgtK:5Rs7LuEgXy6wMC4121K78
TLSH
T1BD52C65BB910657B8CD7D22AFD11B71BEBF1102161951E88E7FCCA2C24E79CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2328ea9073549adab02fe99e0127dcb5999d2517b99cac1f85861fd5d1268867
MD5 40aba898dc4efcd9988ec53e06a8b15c
SHA1 af8b73cd37e29a8d0b68b474702174d179201fac
SHA512 1f184dc588afff9f591e8a55398deb52c19ccb2c739739b1384e2a6da49836e5a8171b750e21fad998d39b550d8f4906b846178327f24be8db946220ec5b5a8f
SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLcif3yXODVw+ErU3L5HGcHRXD:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pq
TLSH
T1D172FA676C4C9A770F94CACCDD27BF4FADB9024B65E9886443FA981903D5ACB010A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\29070459-a210-445c-8b86-cf540a994a2d\index-dir\the-real-index
Size 2KB
SHA256 05f9c9048de203ab84ab0b79ed7245206b68f033993de381e9da7fd4fcc0a56c
MD5 8cc5da01dab6094b300e1935cbf6af25
SHA1 c153f5f1d0089305595979992e013c8046cee27e
SHA512 277a7aeccc036ae2740dd7573023e640b2bcc6a1fddf38bbbe643aa96b9ffeb45becd9e1db9b0f299c3fa7751424d6b64cfe24903d73a4776871e84a35d7f6cc
TLSH
T15E41444CCC90ABADEC7551B919D815F253752C38FC58C7A28565B2A53403AA81B479FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ea2c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\29070459-a210-445c-8b86-cf540a994a2d\index-dir\the-real-index~RFe58ea2c.TMP
Size 48B
SHA256 623431425397a4585a3372e3a41817486f8301bfe4d47d9c79c081a15e57203a
MD5 c04f244de7565037534216ef8fa0353b
SHA1 2cf7e7b9616d79c526431d298757e27643940b6d
SHA512 96cd77a630ba6a5d13921816294a980f3851ea329fca64f2908343340a58d00d02ea1fd7877278232e7e1b562516e36822a3fcca7a8db246bca81a42c2a4fc65
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 abe02079166b8a7cba5d24fe2c101109a4db36e04b8817cbcde8575e4f15da07
MD5 c86908b5223fe40261849b517816a2da
SHA1 74b2e1584e931a4ce27b4adf8103ab6c6c2cabbd
SHA512 424d55ad56d3a599a00749c00d6c5b15b8f9120238255e67cad8ff2a67fb02654ffffae9f82bfc5139ad5228d8c9d412d07fa70d63e41aa94295a7767a9cd0af
TLSH
T120D023C54571594359309F4C243C256C5215DDD5C88DCCE94D0871C73478603C911725
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 2c8f82b08f0dcf3ec9a370486745c7c808d9100cc835cc853bda848058be8578
MD5 a353ea36bc3ce7ef189cafa7108e1b9c
SHA1 eb57c89d84177e46f17a351ec9eaa070d25a2171
SHA512 91634cb78a23c91cc9493599c10838d6139e861be0ba34ed4926c41dba310121444ec884bec5ccfd8c1fb151f767dc40e5fc8dd23f11118f891b548711ec621f
TLSH
T11DC09BD3155099874D75EACC193C672DD65BC1C988C9CDF45908540729785138541729
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 ea3db26c68b05f3f4fe2647ce4a7b16ac7e076aac021860c4983c720ec958065
MD5 d85b52ff4985760adea93d7a9d387e02
SHA1 d39e71a0d67731fea8b19e88f5e1acdfe3392d1b
SHA512 9238cc58445f12f4fcf771245edfa90927afe945f6514e7bf7d3be482b030bf3b887f8b4f5b86dc8535be83d3737fbe59f5f5a488346b9c88fd9b8e8d3bd44fc
TLSH
T1C2C09BD3191099C74E71E6CC3D3C772DD61BC1C988C9DCF45D08540727785138551725
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe589565.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe589565.TMP
Size 137B
SHA256 d6121cae0596bacbf142150dd30be7175d984cd7d9aa23a18a22256936c7d606
MD5 016d6a6a930e158f4ff8e3ceefe3fc59
SHA1 427b33d57f6b8702e11170f6e2c947d774af0d31
SHA512 c9ef281ad5da1bc1bc96d08e24afa5dac1aedef8281759654fab823726c30779b365d1126d49edec034b62072dc7458ea7440e2dfb0cc650c4168559f850a71a
TLSH
T12AC09BD3151059874F71A5CD193C675DE61FCDD98CC5CCF4590974073578513C541725
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 814b2232bee87ebbd916f6375954d4c8336c68a58b651fe3ff980783ce19b336
MD5 ad92aa7dd0a14fc669868db764d766e7
SHA1 a725c7fe58d655442f3a4aa70e0bf44fb896f083
SHA512 03bcdfd88b25cba41c6bdf61bfc5fdfc4ccb7897b10bd1932ddf595c9702e142508d1dcfb4d895365c40532b1bf01e21c6ed08903e03acf2cacb5bc20387f572
TLSH
T192C012A3C106B421C02607F41497C498325CEF30CE19174893F0BD31D83511140151E2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e402.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e402.TMP
Size 96B
SHA256 c1334a489ea3882d9f5989f1fd9498134a3153b44ba1986daf7127eb004b8142
MD5 9b1896edb7770501fc7327d77babfc53
SHA1 76bb62d57ad949169b1baf1f5665a2cd98b9b802
SHA512 f01c49b70a7e0638642ccd73d9310d2339f5fb65d0b7b3db41e18d61d38293baebe0475a3ad9f25c10bb91a19dc21e35208eb599024f248a95e62c7ac3ec2306
TLSH
T136B02220C203E202C00203B0288282CC3030FF22C203032A82F00F23CC30A2002B2030
MD5 SHA1 SHA512 TLSH

Submit Download

16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1436_1405739394\Icons Monochrome\16.png
Size 257B
SHA256 d52376c8b210b8003f5aed9f4555a7916b4640d4c42a36cc81d9864991c87a8b
MD5 6cc922565abd761f4039c816d86018c4
SHA1 05393c91529467f8ddec22a121fe482701365d6f
SHA512 8732f24ea85ab3fa845b3cfa2a354a85cab63a507947fb61bd8119c623e31c87d6f0735ce7f06119db597ec4fce4ad44c15046859b574cb11fb1306e489cf995
TLSH
T1ADD095F2E311DD34C52E96900533C473F433171B1DD56055664491DA4D9E90533C8D59
MD5 SHA1 SHA512 TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1436_2107802300\Shortcuts Menu Icons\Monochrome\0\512.png
Size 2KB
SHA256 e7537de88977426000cf535f51c50337339a74dcafbc57f4a8e3da6e72d6bb7f
MD5 3f4622732a64b2bd7f0b6c9165fdf499
SHA1 cfaf799b98b045b88b2782476b16804266a3255e
SHA512 d410b3fb37228f08481a033f2936f76726b00fc09888a1336d738ed0fa7d240ee67a98479702bd7521cc5f9900fe9428134a3797a1b4ed08f4225561de626bc1
TLSH
T19C512B185350539340B98C5ECB530DA19CF2CBD24ABF82E8B80C274855AAF24BA88FC1
MD5 SHA1 SHA512 TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1436_2107802300\Shortcuts Menu Icons\Monochrome\1\512.png
Size 10KB
SHA256 8eb2475af37471d0c8668d19cac0260cf31320b189217b01da9e937acd8f6b18
MD5 e5ed1d60a7f33f28b9a6789a089a6d43
SHA1 974bb8df6c4b316bb6954437894181527e1f28d4
SHA512 0a705f27f5b16fd8a125354b63b1b5789b88290ca570783ae61ac5d441f49bd9a666b166aa178547046c775ba72b95af20600ce5cd960431c4144bdea60156d0
SSDEEP 192:G7rJ6x3h1JJRIc2CHl2i2W2OI14DWEEnjMxD3TLU83e3G:G7mdjI64TdSDWE4jK3Tte3G
TLSH
T1AF322A55A441885179FECAF3D80BEA034663C33686165727841EB97824F75836C4AF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 4fb250e33e9f2713462b55040768505f0dd9274c4bbb25243d76e4786775367e
MD5 92a4067db19916ae37fc9f42afef8447
SHA1 a0f63db93afb0f76917d6ddd80092803bf90e775
SHA512 1431e11afdf6507032fa05b4242ab13f0bb48bf1855646377b7e49ef62d0d1850b1bb0b0e05a83a19bb78f70cb0f7b74433673d44d7850af2c14e419030971cc
SSDEEP 3072:SkZkJm2DO15PEOJeOTtV5pYUDPYUsrVgSnNNrC++J3qUQm08KMWF0bFTcVHr6zx:hsDOEOJe8tV5SUDU3XO++JjcMW2VcVL2
TLSH
T1041412F42A0FBE752B27D39630078DAECCE1D49F2955923C20C6AF6C15AD290DB5BC64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 90087b792edf280d9e514721cec2103e936662b24bdfc864b42074877697d380
MD5 fa7d0cdac337f1bd051ea40f60423d2a
SHA1 0ba5117cd62ef7b94961a8a89f1ccf963b8e2698
SHA512 4ce0234c3dc85134ff329ca24ca7f920d67c32fc1870cdb0131e25ae62983c1da739905f07f88b2521287f9433e079c115644213813b61ebff73016e05fbb4c9
SSDEEP 1536:wS2P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:K++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1C49312B9991E7D79236EC39AA0179CAC8CD3DCDE151411BC30C76F1E14BB392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 3ece6ee474625959b465ac316bf565c01f06219bd9636da0423fe32c518f0577
MD5 a5e202b4e9dccabd13f6bbdd436b9065
SHA1 90cb97510d6fb04fd1e38a54220825146e3652c5
SHA512 b3f0c0441b7aa0350091be992243fce68092dcb971448a99d5aad80f6ac5514fa4c0e6cc8de4b29ed0e9c7685ec1b24d0a147e456de3138f1fb11468585200b2
SSDEEP 3072:BZkJm2DO15PEOJeOTtV5pYUDPYUsrVgSnNNrC++J3qUQm08KMWF0bFTcVHr6zx:vsDOEOJe8tV5SUDU3XO++JjcMW2VcVL2
TLSH
T1E71412F16E0EBE35371BD3E6301B8CAEC8D1D88D1956923D20C6AB7C15ED390969BC64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 bfb5b60d5c85f4af330bd3d8fb4594696ed724d77d026869846e703f3fecb61b
MD5 7fcd59dd23d705504544709885b8cca6
SHA1 4da45bab591c4437821f977f3a7f6d6b3b984bfc
SHA512 47a4ac83261752b5d4a0b70d1f2ad98c2a5a5a2ea6b8f2a41f77f415e0bf7ac89582ee60e5560910e18415ec4c4d5a893bf12168a3f973a9875d67a5a652ec38
SSDEEP 3072:/ZkJm2DO15PEOJeOTtV5pYUDPYUsrVgSnNNrC++J3qUQm08KMWF0bFTcVHr6zx:xsDOEOJe8tV5SUDU3XO++JjcMW2VcVL2
TLSH
T1411412F16E0EBE35371BD3E6301B8CAEC8D1D88D1956923D20C6AB7C15ED390969BC64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 b9491f020bb5375540905c7ac64ea98b50ec8a3a9ae1a3339aba6c7e679111c7
MD5 a41ff353bde11ff5ad3b29985996dfb0
SHA1 13b0ad60d75ecb88f40ff90a0730fe0e0672a6bb
SHA512 aaa26e8d2ff57ca24b6504033f505a3ceb91bccfb87948ee36a0ab51a41279ffd1e6e4d745926d687bb1e8b49f84981344e134581e942d8a41f59853ee10f519
SSDEEP 3072:kZkJm2DO15PEOJeOTtV5pYUDPYUsrVgSnNNrC++J3qUQm08KMWF0bFTcVHr6zx:AsDOEOJe8tV5SUDU3XO++JjcMW2VcVL2
TLSH
T1FA1412F16E0EBE35371BD3E630178CAEC8D1D88D1956923D20C6AB7C15ED390969BC64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3556-560-0x000001809EDC0000-0x000001809EEDE000-memory.dmp

Download