2b11f487e853e952dc677071202cbe25d6800ccaf3f93a3232c5eed715a1c033

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
241s
max time network
245s
platform
windows11-21h2_x64
resource
win11-20260130-uk
resource tags

arch:x64arch:x86image:win11-20260130-uklocale:uk-uaos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 18:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TL.exe
Size 399KB
Sample260504-xhamcae16p
SHA256 2b11f487e853e952dc677071202cbe25d6800ccaf3f93a3232c5eed715a1c033
MD5 96c64d11cf26ebd227ad754b62d480ae
SHA1 cb40090b892c34feb8ceb995a0d0b90ecfe54acf
SHA512 0be0c2b657ba8814112a9ea075e1ec6c6a0fb965c7308ba24e40b98ec90e9e60afbe09328c0f6c3aa27b54762bf880dfec4aee5f20d24c3b644288e0be311d5f
SSDEEP 6144:zQQh9jpDxUC6eVy9QetdHZwJvJMxhnel93mdQoCX:Nh99yIVjAFZwJxEh
TLSH
T14094183A4EBA480AD7823EF84AE1E178D5B8DD552D59C201C6723C95B632DCFFC814AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TL.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6052	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223942704964150"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4272	chrome.exe
4272	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe
Token: SeShutdownPrivilege	4616	chrome.exe
Token: SeCreatePagefilePrivilege	4616	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 2204	4616	chrome.exe	79
PID 4616 wrote to memory of 1804	4616	chrome.exe	80
PID 4616 wrote to memory of 1804	4616	chrome.exe	80
PID 4616 wrote to memory of 6052	4616	chrome.exe	81
PID 4616 wrote to memory of 5596	4616	chrome.exe	83
PID 4616 wrote to memory of 5596	4616	chrome.exe	83
PID 4616 wrote to memory of 6080	4616	chrome.exe	84
PID 4616 wrote to memory of 6080	4616	chrome.exe	84
PID 4616 wrote to memory of 5716	4616	chrome.exe	85
PID 4616 wrote to memory of 5716	4616	chrome.exe	85
PID 4616 wrote to memory of 3952	4616	chrome.exe	86
PID 4616 wrote to memory of 3952	4616	chrome.exe	86
PID 4616 wrote to memory of 2904	4616	chrome.exe	88
PID 4616 wrote to memory of 2904	4616	chrome.exe	88
PID 4616 wrote to memory of 404	4616	chrome.exe	89
PID 4616 wrote to memory of 404	4616	chrome.exe	89
PID 4616 wrote to memory of 3240	4616	chrome.exe	90
PID 4616 wrote to memory of 2636	4616	chrome.exe	92
PID 4616 wrote to memory of 2636	4616	chrome.exe	92
PID 4616 wrote to memory of 3720	4616	chrome.exe	93
PID 4616 wrote to memory of 3720	4616	chrome.exe	93
PID 4616 wrote to memory of 3736	4616	chrome.exe	94
PID 4616 wrote to memory of 3736	4616	chrome.exe	94
PID 4616 wrote to memory of 1488	4616	chrome.exe	95
PID 4616 wrote to memory of 1488	4616	chrome.exe	95
PID 4616 wrote to memory of 1788	4616	chrome.exe	96
PID 4616 wrote to memory of 3624	4616	chrome.exe	97
PID 4616 wrote to memory of 1116	4616	chrome.exe	98
PID 4616 wrote to memory of 2452	4616	chrome.exe	99
PID 4616 wrote to memory of 2452	4616	chrome.exe	99
PID 4616 wrote to memory of 4304	4616	chrome.exe	100
PID 4616 wrote to memory of 4304	4616	chrome.exe	100
PID 4616 wrote to memory of 3144	4616	chrome.exe	101
PID 4616 wrote to memory of 3144	4616	chrome.exe	101
PID 4616 wrote to memory of 3284	4616	chrome.exe	102
PID 4616 wrote to memory of 3284	4616	chrome.exe	102
PID 4616 wrote to memory of 3636	4616	chrome.exe	103
PID 4616 wrote to memory of 3636	4616	chrome.exe	103
PID 4616 wrote to memory of 1044	4616	chrome.exe	104
PID 4616 wrote to memory of 1044	4616	chrome.exe	104
PID 4616 wrote to memory of 4272	4616	chrome.exe	105
PID 4616 wrote to memory of 1848	4616	chrome.exe	106
PID 4616 wrote to memory of 1848	4616	chrome.exe	106
PID 4616 wrote to memory of 4300	4616	chrome.exe	107
PID 4616 wrote to memory of 4300	4616	chrome.exe	107
PID 4616 wrote to memory of 884	4616	chrome.exe	108
PID 4616 wrote to memory of 884	4616	chrome.exe	108
PID 4616 wrote to memory of 2596	4616	chrome.exe	109
PID 4616 wrote to memory of 2596	4616	chrome.exe	109

C:\Users\Admin\AppData\Local\Temp\TL.exe
"C:\Users\Admin\AppData\Local\Temp\TL.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83365c728,0x7ff83365c734,0x7ff83365c740
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,7253268444577298126,4397708575019045872,262144 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,12873183677727208360,16836252689654234465,524288 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,17878970855585991560,9153203227830561760,524288 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,15782635851505868638,3253387380789849548,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,14024972260062982399,5284309853289820557,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4212,i,7605906178146633463,3904125934066601497,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4380 /prefetch:9
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4660,i,6181710898648336590,17414304799327317054,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5184,i,8739053851635947521,5384570046198193943,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,6238796446528035245,17231197218930399629,524288 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3512,i,14265523387625717117,1358780218337071962,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3592,i,2172011352515458698,750206508181066892,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3536,i,17856639010578838036,10579753272068482323,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6060,i,16462920780750510227,2581741867164987992,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,10629465823123334807,9874887810499581638,524288 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,3493718982218769325,3342776858872051335,524288 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,2121018253056256597,7060909533021593094,524288 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3756,i,3180143336716552064,8142923159396746134,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3596,i,3565568088164077501,2346424256798397609,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3496,i,8602031232741944131,5391143007664510464,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3720,i,18293028339468747157,11531901473540224678,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4444,i,5059457430394698658,14243038916202595243,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3616,i,7319710559112020767,12090514505301139975,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3504,i,7556422270639931166,8399055006213958548,262144 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3560 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5816,i,11050093040270536428,680262774870200482,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=uk --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,16508400272906272233,6657889678127935823,524288 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5840 /prefetch:12
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=uk --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,17899585851125410581,2506864433471780251,524288 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4620 /prefetch:14
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3692,i,17974555802679209716,13218205052686360113,2097152 --field-trial-handle=1880,i,13691030847143238828,5605432958028458243,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:2596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10680958-cb32-4904-a5bf-d1de8550aa00.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\10680958-cb32-4904-a5bf-d1de8550aa00.tmp
Size 13KB
SHA256 88b06c6fd897cabc04a620694798f9bf3de9ac2b6856a2f2c5a22c07d22267d0
MD5 f455524cc2eea8e4ef09264a34bca008
SHA1 3a2e37d72e888408a57ca100a121a9dfaab334d4
SHA512 9701d8143392cd8338ba6064219f969c8a13a4e780d80842a4b2bfc0351a1952ccf6548eea2994da7c2821dafd50fb0b8a7c3c2f83105757abed8642dc473799
SSDEEP 192:1RvccBzYe8/8riS/mn/f3xetua4wv7pFpAPRp2bWD9YHsb+WNZ0xOByR2TtEeyYh:1RUmzYeEIbUX9Ow1+2KH5O
TLSH
T1C152E72ABA50397B5CCBD229FA61B717E7F2102130E41E84EBFC8A2C15E79CD611701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 283a5cc74dcb9d2ed2c0f9dbf68094c47e9a1015ab9459cde78c3454194ace6e
MD5 56f6a687fae8ba2b095f47f2fa29c4c3
SHA1 156d070c82a705d210ba1947fc7b49cddde0909a
SHA512 7a96e9a969527a5739f9d5ecf474e96a997b4c03f75405a57b5955042b3e140800faf12df624a38fc0dff11a012a8fe6b21c0fc53c14d4a63e2c85ae182cba59
TLSH
T1CDE0E56AD920A83B1CFE075960504705EB9113567B90895B7B3D82098FB06270186C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8a60b5b8818266a69ae3b58c441d6462452584b7461f7acacda849681c2efacf
MD5 90231ef5f5939b41459f19572fadddeb
SHA1 f11fa0788cfe91d0424a12ec3609e7f102946315
SHA512 75b4dc36e347bb7f2f826008481d2c926a90d90ecd750512d8d196aaa67cd25c34502391c4c63357df30e2bf59e35b48ffbe892c8ca434108779b970375dac24
TLSH
T16941208DDEC6D716CFA42FF290BE0E5537A119256E5D2B9E071C81F183637E73245142
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d0353f7200449a25a06fa16ff76908c6dbbc591d6e51eff29a1b47c53fadfef9
MD5 2809f6887bca942a414edabb0f4cdf17
SHA1 8fe6dcf82d800de69738a215223d7e5ac2fe7d56
SHA512 91dc185f7635f05aae9c4e3361bef6c731ec1dd0b2b3ca00150ea40e225a0fe4247d2189327a8a85dfd9177ad969dd9ace725e9acb192d7fed726d4dc9c97511
TLSH
T1D641F98EDEC9D757CFA02FB290BE0D5537A11A216E1D1B9E071C81F183637E73206142
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 cc8e291cc724ca39aa3cf98396ebab4c9c8ac01ab9c4afa8f4d6c985b21422d6
MD5 1c2df8025458a13aa66c0804b70bd75e
SHA1 812a5988405daa82d6b3a9c9db71a71816333d0e
SHA512 3db77850549384afeeb2de34f7278d21af6d0650d11ed6fd12552e04c442532ed172e3808f52dbf13db3da58adddeb84ea5f716cf1414cd6bf59bd785ec710ff
TLSH
T13A41FB8DEEC6D72BCFA02FF681BE0E0533A118656E1E1B8F061C82F182537D73609146
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 7c799bc79ca376f67110b7bd8cc89b59d5aac21e1ff56dc2db03fe1befa47267
MD5 c7545a87d4821192703c511c7ed0d6e1
SHA1 948fe472a2943443c9b9cbe3a939b5b855fe85e4
SHA512 fbcce2425c1b1f14e54f158958efb3d3fca5c0ba3df58152dd7fc8e39925ad1ee6ff0544c7025fb3a2c444ee85ea64d781f50911e9558289fc04c6cf6920253f
SSDEEP 192:DwSFSXesyRyZkJJJxEFaIanu7+7b08kBxwRbiPzFXiaP8vvfPNfNPi5n7QX7KAjJ:DwSFSXesyRyZkJJJxEFaIanu7+7b08kW
TLSH
T17922BDF7C3E8862DC85152F8EB157E2BCE1E0A18032C3C56C9D4AF4B97E2471D251A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 da3a76329d4f8283216d188f97b5302f4ca7bf4a8e141e48d2a7da955b597a49
MD5 3b6a9e7dcefb3bad95d6c8f4a4c24dd4
SHA1 5ce3a71f25fc1e1f78fd7b652d4eed7709569fd0
SHA512 c62eaa084fa1520dfadc261c658d2b5699ca0f5a9329e5db5fea70f2486197d6b953f3b089c516653aec7408bd7296eca9a318cea0d9a7093a1ab677418ad3bd
SSDEEP 192:DwSFSXesyRyZkJJJxE9genGaIanu7+708kBxwRbvzFXiaP8vvfPNfNPi5V8d1GGd:DwSFSXesyRyZkJJJxE9genGaIanu7+7e
TLSH
T1AA329CF7C3E8862DC85156F8EB157E2BCE2D0A18432C3C66C8D4AF4B97E2471D251A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 7f1d8892db0327a7fbeb9b851e556bb5ef4cc636be4b410052df1b57e6ce6ad9
MD5 fa52eaaa3440a3c9df4502a24882a06b
SHA1 f407e927a0057942e7d5791ac3a2a2bcc21f4b51
SHA512 7a12cd033a2e87604d1e8d8034dbd121ac6fbd496128b0dc284da8b366d1b03eca469a11e1d87be2fbc9d3988c8781a82c2d7d6f2b34d65454abedb5744e113f
SSDEEP 192:DwSFSXesyRyZkJJJxwaIanu7+7bds8kBoPwRbiPzFXiaP8vvfPNfNPHA5n78cw:DwSFSXesyRyZkJJJxwaIanu7+7bds8kz
TLSH
T17812ADF7C3E8862DC85152F8EB156E2FCE1E0A18432C3C66C9D4AF4B97E2471D251A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 2691753bba636430e1c0b6221d91bba5d496b494bc3d811556afdca2814aa942
MD5 087a75907806a234ef3fbba4fdf94d38
SHA1 7e3a8d7fcdaa168d981871c25f05c84a46d45f3e
SHA512 fde4b3eda530c56f3c59361e7430a9079474fa00cd0d85509d8f6bae2b25e2c4d1fd9f27c36738698810d6654372a70671d040440f1f7c98b51c221f7e8e8cdc
TLSH
T1CF217F57E37E7C2B10AA55EB2C097C095AB69431029174F4CE6780ACB0C65F74B19876
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 aec6fd7defe888a76fd81e5cf63bacfff8024b8302ba823165f6f1c08cdf74f5
MD5 79a7483394974548731191e06ea9fe2c
SHA1 702dce50b12836c19d6e5829d16fd62d562bdfa6
SHA512 248d505cc72c3604c1ae4793486513aca09e57b46b4db24c3f73c419bf74627672a44a4fc657d743f64fc45cfb0ff70152287b9f3d15261f9859161a317514a6
SSDEEP 192:1RvccBzYe8/8riS/mn/f3xetua4Fv7pFpfPRpgbD2V9YHsb+WNZfaxOTfMG+tuNC:1RUmzYeERbBXdOwTo9uR4vR
TLSH
T18362C62AB954397B5CC7D22DF961B71BE7F2103232A01E84EAFC8A1D15E79CD611701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a5a06c4697010a61cbe313939a2c73636675e5c1470a1bfe37b85f913d3900ef
MD5 5ee426d4195f36eba5b566586766119c
SHA1 ce61fbd3de1e20d011c486e91feded338806fc88
SHA512 f76aba0440623da64dc9272e17250c4148fc306b78aa0967937c296986df2f5c1bcf18e4cc98fe01a49594668d8263641186aed7b83d2ceab73872886d92cc6b
SSDEEP 192:1RvccBzYe8/8riS/mn/f3xetua4/v7pFpfPRpgbD2n9YHsb+WNZ0xOTJGo29Ebtr:1RUmzYeEbbBXvOw1M7ES4vR
TLSH
T16A52D72ABA54397B5CCBD229F961BB1BE7F2107131E01E84EAFC8A1C15E79CD611701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f9fad9a9599284f5e524a9dc5779fdc341de80e878822b71476a2365637bc995
MD5 8d0d54bd7e6279f7a6cc4b495616c99f
SHA1 92b024564af72afdc60995378f237e5aaca05b8a
SHA512 70cb55763c5878490315137e3954c8927a2c282f80bb73a7d4d1eb32afcf3636d058daba392bbf9b8523ffc996c4fdc500ac36c675d5befa6e7ad2b41eb5558d
SSDEEP 192:1RvccBzYe8/8riS/mn/f3xetua4iv7pFpfPRpgbD2V9YHsb+WNr7D7B7zxOTfMG9:1RUmzYeESbBXdOwyo9u5pvR
TLSH
T10C62D72AB954297B5CC7D22DF961B75BE7F1203232E01E84EAFC8A1C15E79CD611701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e470300630929ca896e5aa708234cd0c50b257fb7c5827a4a9d611c1ba3640a8
MD5 ced3cfa25558d1898194554b0f0efd7b
SHA1 2b44993405efc1b9130d7681633f227a9a53f08a
SHA512 c063357bf18980808517a1300022102057643813e89817f8e27949037c8229f43272b16d2934d5fd4b2674f23491909d4f69e04a409cbdb811595b8eb3a46008
SSDEEP 192:1RvccBzYe8/8riS/mn/f3xetua4Jv7pFpAPRp2bDD9YHsb+WNZ0xOTXE++FWDtEb:1RUmzYeE1bUXyOw1YhWaBvR
TLSH
T16D52E72ABA503A7B5CCBD229F961B717E7F2202170E41E84EBFC8A1C15E79CD611701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 61458d9e76c062db9807a1a7338ad6816870b46f633606fd7ae0e5e3ace4fafa
MD5 825c79fea335a6f82f51dda55a73fd80
SHA1 16a50a25b3de8fe5b729bf8d7bf9f14aa1dca0ff
SHA512 a8d76a0447427543765b98b70f991f8ae08e669c5aaeced3f64a7e5bee1a5a9fd84fc59c9a0badf4bba1a65e278d7370017181db7b550d750cdb9c28f1cccdb5
SSDEEP 192:1RvccBzYe8/8riS/mn/f3xetua4Xv7pFpAPRp2bDD9YHsb+WNZ0xOTXE++FWTtEb:1RUmzYeEzbUXyOw1ohWKBvR
TLSH
T17E52E82ABA503A7B5CCBD229F961B717E7F2202170E41E84EBFC8A1C15E79CD611701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 689dd0fe569557c95196b6ac0071bf53daf6eabdc8bf0f5e9cd0c517faf27c97
MD5 60bde0b683a11929d318cf9aa459be7f
SHA1 8a6e40a01a7ce202f2a65a396e7e797bdcd3e326
SHA512 7bb66ea97541ebd9ca97d76fc965469460e226884ef9dd2d119e1f1daf70ff3400821b749b8003c3e8020cdd123a739b07c05d8268a4e8b0c52b780b356b2a65
SSDEEP 384:OEjql7KxkXqKf/pUZNCgVLH2Hfgsl817pLxLcJfMtXODql+ErU3H0HB7uP5:OIql7KxkXqKf/pUZNCgVLH2Hfgsi17pA
TLSH
T1478219676C4C9D7B0F94CACCDC267E0FADB5025B65D9C86442FA982A03D5ACF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 afba496969d82900055d2c0cdb1ca0d4baf5d74e184760d67e0d15e1a2c22792
MD5 6fcfa623fb4e1ae2d015ea23172128b3
SHA1 9fbb611f815eeb72f2ed0b19a5907e27aa2224c8
SHA512 082d3497ca9194e94cb5aa937630c47ab45426379f3fa792cd83c009b0c7b9624fc9bb491eb3817be0e7fab83b66d4669a66b3c30747403167aca284cefb0a26
TLSH
T1F9C01298C5029142C05243B4219F1CCC7324BF50F60A0B48D3F0196BB8362325019191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 50607373b2ab6cf905f99a80c5e71a9ff2191e2a38b85c90748965c0fb6767ac
MD5 3985641d1b286bc1ca36d71313ad5837
SHA1 f638dd2759b5e6e1949294c95013764947064cb6
SHA512 1fd3621e890e06466b4106a19278472fa2f3bf1e488ae38842a6c3bb3e30caf90526f63ed7a0fd508c4b7b8586770db42bd3a84ce196e05a45ca5d9f8c9c692e
TLSH
T1E4B01251C501D906C44303B01382088C32145F128B051B0193E06AF1E8261B14024150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584d6f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584d6f.TMP
Size 96B
SHA256 e75175ae78174aa9f61b2c623d27874ecfeddb8ad1d074e68be1d5b1743a6441
MD5 a7a762ac77958a0d71e37abb838da377
SHA1 b96553b502b7c8f1111cd215fff89968a507c216
SHA512 248ba6f2a3c992d9dafe31ad6eb2d845535678040425156c47754a36cc1b7fdd586a2c16b4958b0143da621fbb9f52ed92d69348e207b3afad0cdf63b155ae0c
TLSH
T160B02202C2022332C00203F030C3C8C8B220CF2EC3030A02A3F02AA2CC223B00020020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 5c78860ef4f06aa4d85ea5b2fc63080a86ebca95fc5666e5709b2e4134d039a7
MD5 0e0dfcae24564ea53f306a7394953523
SHA1 5bf27ac17885f556a401ff88b27c747822c970d4
SHA512 bc4f2a27b94c2de29265a0c3080c1f163a20a0c50be5c8393e14c29e02affd14acf95ccec7a6c6bebe71660276d26cffba50c4bc1bcf592c943272db2df1acfb
TLSH
T1AAA0025CC34C0607E05376B754C10742335069115301CA4740D06349FD6C1819B6AC12
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 e6a3ec9ba043999ae57a660e70574572758b1653e089ecc1bd342bb606687530
MD5 8410df3cb65bb09acd65cf9b97c83156
SHA1 a6d43f1bacaaf0e69714050f8c8d0327f27789d5
SHA512 70f4f775ef6e163e97235293061d924772d28d622831f534c2b942d5513bc47e70d983c63078344f78850144140a9ee3bc83bd113c74d356c9a88656d5d82092
SSDEEP 3:MsEllllkEthXllkl2zECllh9l:/M/xT02zhn9l
TLSH
T16D44040CFFC44505C50410345051C3501774D4105D117F4734511C335CCD5401D01054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 432abaeca29e983b17329490eb07dd95641423ee8d5a6bfc9d353c241ab7414c
MD5 e4a183f2650db827b2376bded1f2d56d
SHA1 ab82eaaea6062c33f3beb3e0daf10e9902ef5a9e
SHA512 708697181f2afdf0211fe4e148a8cd244ff2b8f20eebb7ee93936956c1a9c8d09cd1d405124dc11fa636f5ca56a9494a04ed97cacf6db8718c18196270fc3ec7
SSDEEP 6144:4jcyx0wNJMQSR0GxJy+gqvv++JjcMW2VcVL0:Ax0wNJZ1CM+gqvxOMWi
TLSH
T1F11413B5594BBCDB035BE649622BCE39CEC20C9BC5047DFC22846B0B24A97D38757CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 4987bba7e035e8cdd1018d8ed4135c0bc8e9058fc9fb5e6a332da29a95443d5a
MD5 37c68d87499481f11f7c4575305ab539
SHA1 8ba159492b146ee283fb0fb6a545331d6bbc9652
SHA512 177477f8b428cc93f4376b6bbc6928f581f7a7ee53fb08b4d9e118772d7b05be0442426b27944d62db7dcdbaa4ec0e8a2f31ce19da40685ad58e0210573a498e
SSDEEP 6144:NFcyx0wNJMQSR0GxJy+gqvv++JjcMW2VcVL0:Zx0wNJZ1CM+gqvxOMWi
TLSH
T10B1412B5594BBCDB135BE649622BCE39CEC20C9BC5047DFC22846B0B24A97D38757CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 48f34fdf2b3bd7f7ac5de7ec416cd6a23646ffa0710d48ecf0b25b9df7415733
MD5 5a30871d43e002e09b6cc7f3b6e68dd8
SHA1 2aa63abc48769349fa72d1906e9d5e3dc1f6ae05
SHA512 8be0611dcc9108ee3108c94ad8232fab7e61690d68d8a01b2c1fa6423ea8fa65ca4515d6702264f6fb3f989f8ee67a5511597c63d9c8083bf5866487de7a089c
SSDEEP 6144:rcyx0wNJMQSR0GxJy+gqvv++JjcMW2VcVL0:Vx0wNJZ1CM+gqvxOMWi
TLSH
T16C1423B55A5BBC97134FF619662BCD39CEC20C96C0142DFC2284A70F24E97C3436B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 3a5dfd034a8f779ce7512551d41e59c1c5cb082f831b226450dda7822323e48d
MD5 fb0bafb38f10e302bcf9aa8d5bd2a4e6
SHA1 8d139ba84895958eb576734ea054cf09484ef0fc
SHA512 e1dca8e80b049b848f7267ccbee1de19c590ba2c43ca5c80fd1d23ff971f9b0e97d772d8092ff35fdd94aa50b7eb0f3715a35e0ebdf50e03f39b50c421e942c6
SSDEEP 1536:SoP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:l++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T1219312B99D1FBC79635ED69690079CAC4CE39CDD151014BC30C75F1E14BA3A2A34B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 b829f4c17fd083a2fd53c6e50aaa5b959e4f77c8c5c72ca6ab5b57dd2cc13c7f
MD5 fcc6eedfbcb1c06bec885e7e42367541
SHA1 e06048e7fa1d787b25713d4a63c2548f87a2de44
SHA512 6d5fb025e08dd2a01e2b8f6450741223fbde9ebd04b693ddd2ec26867cd62e74e46b0458e0d2d0d3e115e0cc73c5710358c3d027d6aee6cc792ca6ae89d066ea
SSDEEP 6144:Qcyx0wNJMQSR0GxJy+gqvv++JjcMW2VcVL0:Ux0wNJZ1CM+gqvxOMWi
TLSH
T1581423B95A5BBC97134FF619662BCD39CEC20C96C0142DFC2284A70F24E97C3436B8A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 279KB
SHA256 3c46f69a3f4d1060f79b489b9620fa999560c61b27ebb23480a5a110c61ee68d
MD5 3bd80e23040e6776ba527e10a2c8b156
SHA1 93f9b1069ed755d4fb6b701867b4a39fa0a2d7b0
SHA512 b055af27c4cabe8438eb7b247eab9baeca612c23b18362fad924e60f5eb3d2e5a5f657b8c03e194b46366958ff5b6fa459defd03493d129ea81b3047c18a4bd5
SSDEEP 6144:FhRsTle79mPKpcyx0wNJMQSR0GxJy+gqvv++JjcMW2VcVL0:vYle7WKx0wNJZ1CM+gqvxOMWi
TLSH
T1CC5423B15D0BBCDB573AA7986227DF25CED208D7C12869FE12C0BB0E14A5B835757838
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4836-0-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/5480-145-0x0000023FEA930000-0x0000023FEA9CE000-memory.dmp

Download

memory/5480-498-0x0000023FEA930000-0x0000023FEA9CE000-memory.dmp

Download