2f4b5b21d93e127c177c8a55c9732e1b52b9dbeab8e76592bc31117e50e853b2

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
201s
max time network
204s
platform
windows11-21h2_x64
resource
win11-20260130-uk
resource tags

arch:x64arch:x86image:win11-20260130-uklocale:uk-uaos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
unins000.exe
Size 3.4MB
Sample260504-xmt7jsfs7p
SHA256 2f4b5b21d93e127c177c8a55c9732e1b52b9dbeab8e76592bc31117e50e853b2
MD5 a844c7a38715984feb462f29f80389b7
SHA1 bc5ff3c4dbacf80e5fe1603759f9411a44de9908
SHA512 f3454598269d27e825ec8f7da29bb65d5c7ecf3b799b23a55eb5d6de4cf0a869eedc70ed52dde02d89520d1287c28fa1ad2ed85f428da5a8b5e8935b1e064e4f
SSDEEP 49152:Ddx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjz333Tco7:IHDYsqiPRhINnq95FoHVBz333Tcq
TLSH
T1B6F53A16F389613EC05B3AF5467381909837BE212916CC9697FC384C8E39597EE3E64E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unins000.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4484	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223947404935730"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
2380	chrome.exe
2380	chrome.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe
Token: SeShutdownPrivilege	1716	chrome.exe
Token: SeCreatePagefilePrivilege	1716	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe
1716	chrome.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 3204	1716	chrome.exe	80
PID 1716 wrote to memory of 2388	1716	chrome.exe	81
PID 1716 wrote to memory of 2388	1716	chrome.exe	81
PID 1716 wrote to memory of 4484	1716	chrome.exe	82
PID 1716 wrote to memory of 4812	1716	chrome.exe	83
PID 1716 wrote to memory of 4812	1716	chrome.exe	83
PID 1716 wrote to memory of 2872	1716	chrome.exe	84
PID 1716 wrote to memory of 2872	1716	chrome.exe	84
PID 1716 wrote to memory of 956	1716	chrome.exe	85
PID 1716 wrote to memory of 956	1716	chrome.exe	85
PID 1716 wrote to memory of 2344	1716	chrome.exe	86
PID 1716 wrote to memory of 2344	1716	chrome.exe	86
PID 1716 wrote to memory of 440	1716	chrome.exe	89
PID 1716 wrote to memory of 440	1716	chrome.exe	89
PID 1716 wrote to memory of 4580	1716	chrome.exe	90
PID 1716 wrote to memory of 1732	1716	chrome.exe	92
PID 1716 wrote to memory of 1732	1716	chrome.exe	92
PID 1716 wrote to memory of 3408	1716	chrome.exe	93
PID 1716 wrote to memory of 3408	1716	chrome.exe	93
PID 1716 wrote to memory of 1340	1716	chrome.exe	94
PID 1716 wrote to memory of 1340	1716	chrome.exe	94
PID 1716 wrote to memory of 3972	1716	chrome.exe	95
PID 1716 wrote to memory of 3972	1716	chrome.exe	95
PID 1716 wrote to memory of 1464	1716	chrome.exe	96
PID 1716 wrote to memory of 1464	1716	chrome.exe	96
PID 1716 wrote to memory of 4432	1716	chrome.exe	97
PID 1716 wrote to memory of 4432	1716	chrome.exe	97
PID 1716 wrote to memory of 2264	1716	chrome.exe	98
PID 1716 wrote to memory of 2264	1716	chrome.exe	98
PID 1716 wrote to memory of 2468	1716	chrome.exe	99
PID 1716 wrote to memory of 2468	1716	chrome.exe	99
PID 1716 wrote to memory of 2804	1716	chrome.exe	100
PID 1716 wrote to memory of 2804	1716	chrome.exe	100
PID 1716 wrote to memory of 4360	1716	chrome.exe	101
PID 1716 wrote to memory of 4360	1716	chrome.exe	101
PID 1716 wrote to memory of 3872	1716	chrome.exe	102
PID 1716 wrote to memory of 4188	1716	chrome.exe	103
PID 1716 wrote to memory of 5032	1716	chrome.exe	104
PID 1716 wrote to memory of 2380	1716	chrome.exe	105
PID 1716 wrote to memory of 1164	1716	chrome.exe	106
PID 1716 wrote to memory of 1164	1716	chrome.exe	106
PID 1716 wrote to memory of 4904	1716	chrome.exe	107
PID 1716 wrote to memory of 4904	1716	chrome.exe	107

C:\Users\Admin\AppData\Local\Temp\unins000.exe
"C:\Users\Admin\AppData\Local\Temp\unins000.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb81f8c728,0x7ffb81f8c734,0x7ffb81f8c740
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,14686856610435291370,7376523940003604359,262144 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,6745491147536953763,938848704743636196,524288 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,10517203452479882012,17192482702036705092,524288 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2788 /prefetch:13
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,14055462036735308494,15484479551440260047,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,11246224877019197447,5822057192047075765,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4228,i,9028344501909682647,500400913494346497,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4236 /prefetch:9
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4580,i,6535754224410761088,2543608445265989814,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,2400150766396213431,4931382509893317711,524288 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5696,i,11827137756195594453,101458157606562135,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5540,i,15265908229224521387,2514667945708552738,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3552,i,13182027534771066383,12697272143972878706,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5904,i,11628781458997165586,16569751642582450974,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3624,i,16709847229011698877,7669227286044295294,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3544,i,8731080828186782000,16047681114137491922,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5780,i,14310326436795697435,4902634245879446635,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6076,i,13573078248166450924,246085630175278311,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3868,i,10219051827994176118,7697362977587922859,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6116,i,12110853570445678148,4446819007003517039,2097152 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6436,i,11241964525682562406,6214915456074017173,524288 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6452,i,8512700123289561669,11782993338063067663,524288 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3584,i,16767680258307269337,13904449396617336905,524288 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5628,i,2119948820131962417,4931618685623050515,262144 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4332 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=uk --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,5989746662926619645,1989328139166246190,524288 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1156 /prefetch:12
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=uk --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4588,i,17878265980480080543,11706315836231038642,524288 --field-trial-handle=1964,i,4707497170135703931,3001909474397685079,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4340 /prefetch:14
  2⤵
  PID:4904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2584807505877e108aebf8e5e7b08f2919e3af9ffce6193204f063a1afd97e15
MD5 46caf56921731f8597b508e04a92d042
SHA1 29f36669978a020706ea4d368589e89713df0472
SHA512 af60e7f921e4ddcdbf3e6626f8016aad67cb2722a189d93ca67132e8301d7369fbfe22bbdcd77fc8d27689f8b9a86147754badb501625869d3b0096df46822e7
TLSH
T196E02B9AD972DC2705FD0B3960604746F651136A2B90555F7A3DC20C8FF1A3B864195C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 67KB
SHA256 50f31d19b1aa0b5ef65e000533d4dbabb9907befa07b6f0ebfbb11d2597c8b83
MD5 df1ca1e1cb004574d666faebe5a13445
SHA1 1d6395dfab6df8ad8e1bad4174bebc7d4c28d8d4
SHA512 c114db5c2a47f04b6c4da4c2e9f5a624ba6c60d879c167a1c5b4818d39b03299dd63d25eba18d8f400e8c6ebceb64a31c8fdec49310765bb399f371d6a2b77de
SSDEEP 1536:bdywojyhnRExdFcIdsDzFgr2F066INt7VdzQSDantp:bOMnRExdCIds/Fgr2O2Zc4antp
TLSH
T10663012B9A0161FBAC35C4FFD6DAC47A9605C78E3D6844FE46C0144E27B5B8E6BC034A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 363KB
SHA256 5ac6c3c8c9045405f3a89ef0e0c80536a989becb552e97bcb94a80cdf090f0a4
MD5 f007441abab99e3a21d27dc2d28060cd
SHA1 c35c3f7bc29f579b8fef5bca815d8166f25fe620
SHA512 e425a78e7b98639ce278743929745392f47677447fb862d7dca3a9a141ec7795e4a26a23af660f868c400c0f309588e681272c0a437f3fc089944d5affa90f09
SSDEEP 6144:qaBl1GmDy/PFE4focYk1uyBbZ/zf1HV40+0/OuS8c9EznEmePW9OVBfJ8E/DxMI6:qaBLGIULocL1uyBb9BW90mGoErMGObJ6
TLSH
T1958423F5E4B83899198D4DB762DC5A4483D38BB20D63B1A89FC2483E4F40E476A1B4F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 80KB
SHA256 5143a87cf81e3e47d63e7336b52a21ac3ef830aa32ae975626ff5a3e6b85fa71
MD5 45d027fd6ae66c7d370cd73bc0ae94cd
SHA1 6beef066bd243b498db5c344c781ae9a74b06243
SHA512 e65232b1a9257ab3d475a23b842cd717b4e79c27d9afb4c0b687756c0ce5b344af82deea9ff126487616a2dcbc3ccc8bb3e9d7574dcaa0437a8c3ad26e0fa3fb
SSDEEP 1536:yCe8HdQm3fKdX8VnCxcX04B0CTz43aphU9I5a9zZSBxH2peADk+jtyx1Ff7Hz/QU:y49QSy2XTvP43kUuyQuz3JyF7Tf
TLSH
T10683022DE0AADA14C5E60D323F0A6043B6B058C29F65EB1D214E3F19E17EF11D89979F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 499KB
SHA256 7bb344c8c7843f9f4133022763c319d41e80bcfabaae20a23c1cff3086391f91
MD5 be13be691d8a86634bbc02f1d2ad8cb1
SHA1 8a774b4c82f897bd137458bc76a94f57ac0eb36e
SHA512 30340e77a0a9ee726f544639d7d6ab53c832af6fde780d4ce0f16258ca7429a30daf6b91b370f373df438f1d00085f548f6deb31233a4ce3c44719f9e59bb6d0
SSDEEP 12288:URi+Vy4gfiOkK0unPBWOgnZvOj+wg6IgZQMu4f7BFCt0YNP8/Q:UTVoaOkiZAOic64f7aCYNPUQ
TLSH
T1D6B423400A30ECA0EFFE941D1798CE145731E27FA2436E3857D2F9A8659148EBF2B95D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 5765d63a83c960a47ed930cd7986353c8c72a09588300e79b7a28ef7e3f09eca
MD5 01da7cdb24a9d4cf10f4ac53e43c0a00
SHA1 6df4df06542d0b67d25a2ab2d96108e8015688bd
SHA512 8b097328f07614552c131b317a12499f289cdc10114de0ee81ff5377e4f04611894e57ce066839449a9fa28d703eff6dd4784ff8ae7c5c2baf4ec2689b0c90f8
TLSH
T12F31CDBAB0C6D41ADF640FF055C46C9413A46C8448B14B430B28F7B169B32F13B06E24
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8907bfe44e7855ab60d38f72aefde63d653092f6e089110b826cdda7a2f9e13c
MD5 9dc50eca71380ad21ef444cac008fe03
SHA1 e2437132db6c9130e4c3f22888bd2ee0c922725c
SHA512 8507c5d7915ac7e7f39ae3b36c954380f85c9e755de144380472d45aa17d103f66d6385bc090c16faf3cd08debdcb7cb5e021401e12b50c05fd7536f4beedca4
TLSH
T15A41EFBAA4C9E836CF74CFB061C66C941393585968F03B820A18E3745767BE0B716F54
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f4303c82ad5b27e98f5a07739378a76ea8c2004dbcb04f29f5666cc53e6f23c4
MD5 99f738168b3ecfa657b9df5a36c2e533
SHA1 6ba4a1917aaf57d97e0eb4d64294b131f45fd63c
SHA512 e2d08de5cf1e0f251cf155bf974ac5e4a3a4ade6e4fc591f0de48912ef97443ce6bc5738df04a45785918919bbd62b47b7cf585901761e11bd828b9ab0c58849
TLSH
T16A41EABAA5C6E436CF64CFF052865C901393088928F07B820A68E2745B63FF17B06F14
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 2d868fc9cc9b061120149d5f41e78b2954db8948b4646d818a6fbb4ac9c0c030
MD5 f4b670f00bd3080e6bb184825bd50a91
SHA1 5b67e28d95f07ba230d5752768b06cd2f7baac42
SHA512 c6ad4952e35af676854cccde1e94b1e303328b3f4fd24c35291fc899edf1c58d6aef97ffc380f8b239e1067f06465ace5f0e1401c8ed0e841efd9f430c8748fd
SSDEEP 192:DqZhXyJ8//MD+0aLIaawygHYWT/VbfWgK6Ni/PY8eR:DqZhXyJ8//MD+0aLIaawygHYWT/V7WgH
TLSH
T145F179F3C3E9CA6D885156F4EB157E2BCE290A18532C3C66C8D4EF4B93E2471D211A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 1ff6b854d33137bbc007605c46d79217d8e949c45d773237b4a62221f754ed85
MD5 27353b5c88e3dcb106e0f34664ff2ab9
SHA1 e0aa62e725529ec7176c816803428426a6b6a011
SHA512 f3e45f64ffd7afaf235dfab7f722f1a5406e6fa26cba4d88f6b9891cc7f837b2aba7432bf503f0dd6dd6e4b09fbbf00def59a8e980151bc62017df058e9fcb6f
SSDEEP 192:DqZhXyJ8//MD+0aXRkIaawygHYWT/VbfWgKiwHi7EweBpAu00:DqZhXyJ8//MD+0aXRkIaawygHYWT/V7S
TLSH
T18F1289F3C3E9C66D885156F4EB157E2BCE290A18532C3C66C8D4EF4B93E2472D211A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 8cee0bb9d495b7c3a70cef1b47760ad07f954380a030385437cb5618e7c01db7
MD5 df282b20d230c70de5fb7e586386c4b0
SHA1 03fb83a86869f0e36e4c7695f0d8b97e0d21dc74
SHA512 83220ddb15e5dc9b901c318d61b82f15d10bb8e3de6ca183edcdc5baa297dfee7b17d45ff6bfb5c409f7ffefcc0c973bc68ca318917c9fc6ca04d00328ee3d9b
TLSH
T1C8216AABDBBEB8AB10AC4DAB1D0578092AB5A4341151B4F4CE6A806CB1C15F74F25822
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 222c27fa54e1983ea5b17a44100e3c3d0e1a4aa1e9c6b0a775109e89c20a1948
MD5 42b49467dca6f1cf69f452fad8b8d32c
SHA1 dfc574f793d00ef54806800cf1d2ae2897a56cb6
SHA512 8833a1254f6156a7feba2018ed8377860916603420fcd912e4a842f71e7d9cee4c9fe842d2e22a654d7900dffa4a2fca6b6a805f1ca12f8178eaf9be5fbab968
SSDEEP 192:aRxcBzV8UTw5/h6v7HYhAPRp2N0F98Hsb+WNdcbMBC3WQD9f9pBVyIsnAUgtaJ:aRxmzVkpWE8Xn6wn6W6ZDn8
TLSH
T18952B61AB950797B9CDBC22AFD22B717E7F5103161A42EC4EAFC8A1C14E76CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c9001167f78ff4aa4429b652092e0216d6e736616a01a7c63826998064648746
MD5 2a22b11a12ad91c131a0d8d049a4c9db
SHA1 701458b41ace792da8dc730fbb6b9ab828f15209
SHA512 901cf95ae84449a7f002ac01190eb676cd0e73a9c5f8f6588b165f68d778c4e24888fb54dc8063d1e2cb8e6cfe0b5f3cccb1fe7935ea1fa8df19ae119045c9ff
SSDEEP 192:kRxcBzV8UTw5/dfv7HYhrPRp6NRIl98Hsb+WNtcPmKNqXqAGo1TeNwSD9f93QSyS:kRxmzVk13ERX96wyO7gOeTZJ9vp
TLSH
T14962C71AB914397B9CDBD22AF952FB27D7F5203161A02E84E6FC8A1C15E76CD2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1652b8bc86716ea2ccce3054d6c5d1a0d04df33fd285027da4387ad972a787ac
MD5 0fc531b0dc1167695f56dc3a6deb3062
SHA1 9734bc29c52c6f9f38bd0dd37438c50cd8bbe6d3
SHA512 39b35a5f4e66300f065e53248eeb6c36d451c56c22afd2fbb6f69e8015e6433709de98881c985515375a73893341b5a9703c2f663aa0c6a7b78203e0871fc7f6
SSDEEP 192:kRxcBzV8UTw5/dbv7HYhrPRp6NRI798Hsb+WNa4qXqAGoRGYiD9f93B8yIsnAUgh:kRxmzVk1jERXT6wwgZYQZJmvp
TLSH
T1D462C61AB914797B9CD6D22AFD22FB17E7F5203161A02EC4E6FC8A1C15E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b5462035dab7736e6df1d078d85771889b3fb60855cf764d96c43bf68f5e2bb2
MD5 524f2872abf14a5e0dc17d35ee34179f
SHA1 b95be99cd4b69010ef994ea0c76c31c312427d27
SHA512 2815d159695ad9e28e7615c31465cf5f4263e4e01912f8cbc28baf44797dac1c048346175e619d4c4f3e44fdafa86ad1ff7ead5800ba2469e2cf952b0f3ca533
SSDEEP 192:kRxcBzV8UTw5/h6v7HYhAPRp2NRIZ98Hsb+WNa4qX4RGYlD9f9pBVyIsnAUg5EaJ:kRxmzVkpWE8Xl6wwpYNZDn5R
TLSH
T13652C51AB914797B9CDBC22AFD22FB17E7F5102160A42EC4E6FC8A1C14E76CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9fdbd405d87b38137840434c84b4f84d93febaf349561ee7270199f7904093fd
MD5 4253f799e331602ad611df82de17eb6a
SHA1 33860c6b5085e59f478f2a226244434c441554bb
SHA512 73195182471863ad1b2780b12f2d24906b88d7c3e5f02c9e8a0098a8ad5fc85831e29bb7e07144ae69dd59cfcfe5e3c5b791775b2ea41766d84b99be27a044f8
SSDEEP 192:kRxcBzV8UTw5/hvv7HYhrPRp6NRI798Hsb+WNa4qXqlyeRGYHD9f93B8yIsnAUgh:kRxmzVkpnERXz6wwxbYjZJmvp
TLSH
T11F52B51AB914797B9CD6D22AFD22FB27E7F5103161A02EC4E6FC8A1C15E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4ac15c98e7c3f9d940eb0774b8bbb09216f33e89efc4dc1e4d1efe292f5b218f
MD5 f14cd16d791f96f76a632e49619ec762
SHA1 8a7b15d7f7a2337c8119093264805e290c7aa910
SHA512 eaa2475ce46160a16053a4c24e1020cf3f9d97bfabe93018414868c45c2371a27a134e51c47cf73b37c59ddee3bd0fdbb9272a8a13e7b9df5650677531e79916
SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLxLcJf3yXODVw+ErU3LwHBcggYXe:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pA
TLSH
T10D82F9676C4C99770F84CACCDC1BBE4FADB5025B65E9886443FA982A03D5ACB010A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 3f3b0aeeee63c6beaea79bdcc9903bd847afb233577eac0ca08195ebd8ce0835
MD5 50c3b7d904cf7c8baeb0e2a18038a06b
SHA1 f3832312af54ad8d9ea42c1fd439f75c3e364fe6
SHA512 6acad3731ab3cf2bd04c67a2c20024ae2e29a301c4a165f1b8c50e5b67b580c1e902260f7e2a294d517d4837495b3498c77ccfb416b42bfc751af6b0d0e27934
TLSH
T144C01294C8029181C15242B4519354DC7735FF50DA0A030463F0596BB83A2335029195
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4cb0dbc988c38dccefe32ce97f16353a7875f11d593cf15997c03bd2e507ea8a
MD5 d763f160305a142da0120fba1eee7583
SHA1 dfeb4a8d79ecdde0f49272a683f70ec1c898a3fd
SHA512 73d1473fa0a5fc349bd98d7fde2246f1d731f4fb157c078f96176448c60bd763abde6e065b3f1fab1af3e810c2b9481648778104c44c696ab5f30da34da288ce
TLSH
T118B0121280415501C48302B011D3048833145F1087093B02B3F069B1D8365B14018151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5872ba.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5872ba.TMP
Size 96B
SHA256 1aa58e7afe56f3c31ab260cefeb0e783984052174b74a8cb32e7f6b466b8c22d
MD5 5debdf7fc1f864adaeb58ad86697e9c9
SHA1 4db9a1c186b8b93896602eee17bcae6b3527a74a
SHA512 77cf89434c4f712827841a0f49312662607b11b3a07cb01035da232eb0255d5eee17257d7d0d79bf5b652c54b4a366c37ae9315be8615e8af221d87780951069
TLSH
T1BCB0220EC0032203C00223F020E8E2C838A0EF32C203020282E82A22EC382B0A0280A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 337eae2b041f15f1ec38a54044408b902c4b709b15074db3c31d2605ba9ee374
MD5 3711a036a467fe5525ed6dfefc682a25
SHA1 743883ab1bcaae139c558309f3985a74ab7f8c71
SHA512 47ea8316d396049fb529d46eb3745af3659df93cd889fe626bcd850cfc5b3686f6a730efa7b4e8dfb5035003aa8cb7e59fae64958db523a89f70e20ad81eba52
TLSH
T18FA0022083C5915DC813B77A658553E03F608C150113420384A01764EDB02C96E25005
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 ad3b8b2897a34a543d6b17df43bc755671ac72468545d810acb66de1b38c10c0
MD5 4f33b63046cafd11cf0018558b8a9555
SHA1 ddf96e95b4513504cd49a0212ee21031d1844d81
SHA512 78a1d0bf5e0f155d87daad117e8a4b992a0ea145bb7b7b9dd8b8e934f5633ef167720eb01795c242756db81875152d983d1b32eb81f869806737c9810bba7f65
SSDEEP 3:MsEllllkEthXllkl2zEL161Xll/:/M/xT02zh1v/
TLSH
T1DE44040D7FD00407C50011744013C3504374D41405115753355174377CC55403C00041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 9080c252aa50f1123a21c896913ae9d8ff4969306bd24e898f3556a712421474
MD5 f1bfc9f4dbff1d8774e6c81d29c0e5e3
SHA1 f3030c3b6ab4901cea316c4d855ac08c418024f3
SHA512 8b84ef4676707670a4c25e662867ab2b68d469289a3a2310a6f8c7029aec52c48ac93dba57a1a7edf82c3888f8c510a9528017017a598e723fbf8557fe02c433
SSDEEP 6144:PlNpWVJ7Xe1vS6NINi67c++JjcMW2VcVL1:PlPWD2asBfOMWn
TLSH
T14D1412F8753EBDA7116A42A9600B8E2D5EE3D4EF6104307C71C32B0E0665BF55B67E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 e83e61837cc2cd6ef0da4c67e95c237e5df5a1ca8db9b9d02eea238e3590ccae
MD5 4b5d7bf1f78bc918594ce2ea6b9933c4
SHA1 fff8e1bbfa7049c3d950101baa51232f30b91d94
SHA512 d05e6a1d76694a617c33e8e22e7a085d6a5287a6db81976aed71d7dc803d751861e63ed7c7547d62f0256c5f8a4f25ce04163b2a1c081bdbf13febae92a81138
SSDEEP 6144:ElNpWVJ7Xe1vS6NINi67c++JjcMW2VcVL1:ElPWD2asBfOMWn
TLSH
T1511412F8753EBDA7116A42A9A00B8E2D5EE3D4EF6104307C71C32B0D0665BF55B67E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 9fc8d6ed158d7439eecccfa7ab94f942ff90852515d120a18a13a613dd9f4331
MD5 22c7402189ae98e5077308a92649ee92
SHA1 1a0b0076575a911e225f8a54df6be3643a9e2b6e
SHA512 fd623e146faa6e150e21af50d143bc585ec3d3794f7377b7f3ebb185d7cecccb865d380b5f405ffee4be2aab291810b2b9e58381c653ef973552a44f9064a62e
SSDEEP 6144:AlNpWVJ7Xe1vS6NINi67c++JjcMW2VcVL1:AlPWD2asBfOMWn
TLSH
T1F91412F8793EBDA6525A83E9A01B8E1D5FD3D4EE510020BC61C35B0E0665BF11757E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 a221f8bef7e5f60f4b975fb04640a46f10f7ae4fdd15a946a8d66ec236fb756c
MD5 39d4ab5a2390cac6f95706a4de6629b5
SHA1 00d961952d06821c6a11ffe5a1e912b28a244048
SHA512 17310929c41b1e34cc5c25b599789cffea49ff4f3fb4c17433c1f25dd094be755b7783d63378b020f95c2709be4933dbe15156396823fe498099b742952053f8
SSDEEP 1536:wSmP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:u++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1E59312B9991E7D39236EC39AA0179CAC89D3DCDE251410BC30C75F1E14BB392A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 054a31f16e2a809397f76b31130f816ec2c978d7eb62516af7f5f996cea01297
MD5 ac4dc1588c6f5e5df0794bf95d0b7381
SHA1 e86bc7e3e80abb42c2711f1edc765c1261fa9bf4
SHA512 245c16a35627cde124759d8e20e1077e9ac2ad135046baa6836dfac952ec4a5c91bb76fba4c981193e6d193f877eed9b5f7c35a709b50f53bee549fb865e41c5
SSDEEP 6144:elNpWVJ7Xe1vS6NINi67c++JjcMW2VcVL1:elPWD2asBfOMWn
TLSH
T1201412F8793EBDA6529A43EAA01B8E1D5FD3D4EE510020BC61C35B0E0665BF11757E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 e46f511cb61fc506e176b838e00d3b97eadfdd50abf151a7e2ebb1967939f448
MD5 9376256c59dbcdd3640d0ebd6ae486dd
SHA1 7bed39c8eddcdf100d045199630e1fc8328baf54
SHA512 efdf463b2c4c9ad0424a1054ba97359b94c024f597e81d2aa2d0c1794c1799098567166c86b932ce50cd791d0544317b95b0ed096a28d5752203067e17bacfbe
SSDEEP 6144:DlNpWVJ7Xe1vS6NINi67c++JjcMW2VcVL1:DlPWD2asBfOMWn
TLSH
T11D1412F8793EBDA7529A83EAA01B8E1D5FD3D4EE510020BC61C35B0E0665BF11757E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 eeb4d46f68b0ccfa34d4e9665661d3fb1430cacd138058505574e942fbf5c8c7
MD5 8d8008f1b8c4d7eee39cbc9c8bdfc0bc
SHA1 902f6263ebfc9bd90800946a8aa8704445aff76d
SHA512 591a851c7586064522af7c235d647e8636615211409d160337567cdf6596ed43f5a16a4ecbab9e50405b5ed680a60978f099311154293a1a6fecd6ed8bacaf6c
SSDEEP 6144:kFsFrOiOjlNpWVJ7Xe1vS6NINi67c++JjcMW2VcVL1:5FqXjlPWD2asBfOMWn
TLSH
T1183412B8753FBCBB026A92A9642F8E145FD790DB72007578B2836F0E42257F05717E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/3056-0-0x0000000002680000-0x0000000002681000-memory.dmp

Download

memory/3056-80-0x0000000000E60000-0x0000000000EAA000-memory.dmp

Download

memory/3056-79-0x0000000000400000-0x0000000000775000-memory.dmp

Download

memory/3056-81-0x0000000002680000-0x0000000002681000-memory.dmp

Download