2f4b5b21d93e127c177c8a55c9732e1b52b9dbeab8e76592bc31117e50e853b2

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
631s
max time network
634s
platform
windows11-21h2_x64
resource
win11-20260130-uk
resource tags

arch:x64arch:x86image:win11-20260130-uklocale:uk-uaos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
unins000.exe
Size 3.4MB
Sample260504-xp1gcaft5j
SHA256 2f4b5b21d93e127c177c8a55c9732e1b52b9dbeab8e76592bc31117e50e853b2
MD5 a844c7a38715984feb462f29f80389b7
SHA1 bc5ff3c4dbacf80e5fe1603759f9411a44de9908
SHA512 f3454598269d27e825ec8f7da29bb65d5c7ecf3b799b23a55eb5d6de4cf0a869eedc70ed52dde02d89520d1287c28fa1ad2ed85f428da5a8b5e8935b1e064e4f
SSDEEP 49152:Ddx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjz333Tco7:IHDYsqiPRhINnq95FoHVBz333Tcq
TLSH
T1B6F53A16F389613EC05B3AF5467381909837BE212916CC9697FC384C8E39597EE3E64E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unins000.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
960	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223950149474366"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\change_phone.htm:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\change_phone (1).htm:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
5556	chrome.exe
5556	chrome.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1332	4916	chrome.exe	78
PID 4916 wrote to memory of 960	4916	chrome.exe	79
PID 4916 wrote to memory of 1560	4916	chrome.exe	80
PID 4916 wrote to memory of 1560	4916	chrome.exe	80
PID 4916 wrote to memory of 4260	4916	chrome.exe	82
PID 4916 wrote to memory of 4260	4916	chrome.exe	82
PID 4916 wrote to memory of 2852	4916	chrome.exe	83
PID 4916 wrote to memory of 2852	4916	chrome.exe	83
PID 4916 wrote to memory of 6044	4916	chrome.exe	84
PID 4916 wrote to memory of 6044	4916	chrome.exe	84
PID 4916 wrote to memory of 2436	4916	chrome.exe	85
PID 4916 wrote to memory of 2436	4916	chrome.exe	85
PID 4916 wrote to memory of 5284	4916	chrome.exe	87
PID 4916 wrote to memory of 5284	4916	chrome.exe	87
PID 4916 wrote to memory of 3820	4916	chrome.exe	88
PID 4916 wrote to memory of 3664	4916	chrome.exe	90
PID 4916 wrote to memory of 3664	4916	chrome.exe	90
PID 4916 wrote to memory of 4796	4916	chrome.exe	91
PID 4916 wrote to memory of 4796	4916	chrome.exe	91
PID 4916 wrote to memory of 5276	4916	chrome.exe	92
PID 4916 wrote to memory of 5276	4916	chrome.exe	92
PID 4916 wrote to memory of 5248	4916	chrome.exe	93
PID 4916 wrote to memory of 5248	4916	chrome.exe	93
PID 4916 wrote to memory of 4112	4916	chrome.exe	94
PID 4916 wrote to memory of 4112	4916	chrome.exe	94
PID 4916 wrote to memory of 1496	4916	chrome.exe	95
PID 4916 wrote to memory of 1496	4916	chrome.exe	95
PID 4916 wrote to memory of 3040	4916	chrome.exe	96
PID 4916 wrote to memory of 3040	4916	chrome.exe	96
PID 4916 wrote to memory of 5180	4916	chrome.exe	97
PID 4916 wrote to memory of 5220	4916	chrome.exe	98
PID 4916 wrote to memory of 3416	4916	chrome.exe	99
PID 4916 wrote to memory of 4980	4916	chrome.exe	100
PID 4916 wrote to memory of 4980	4916	chrome.exe	100
PID 4916 wrote to memory of 2780	4916	chrome.exe	101
PID 4916 wrote to memory of 2780	4916	chrome.exe	101
PID 4916 wrote to memory of 5556	4916	chrome.exe	102
PID 4916 wrote to memory of 1216	4916	chrome.exe	103
PID 4916 wrote to memory of 1216	4916	chrome.exe	103
PID 4916 wrote to memory of 4440	4916	chrome.exe	104
PID 4916 wrote to memory of 660	4916	chrome.exe	105

C:\Users\Admin\AppData\Local\Temp\unins000.exe
"C:\Users\Admin\AppData\Local\Temp\unins000.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffd1603c728,0x7ffd1603c734,0x7ffd1603c740
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,12647868920259546460,11858183828141237865,524288 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2036 /prefetch:11
  2⤵
  - System Time Discovery
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,12156028360737014692,18301460888841309994,262144 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,13560240944618198017,5769092239005096679,524288 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,17164656777264940282,12732895908994707194,2097152 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,10177944059098863365,841135442913444369,2097152 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4248,i,2545856597456515028,2318169958525875902,2097152 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4268 /prefetch:9
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4688,i,4867007975009511432,16103306463812172226,2097152 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,10200283435475307259,4619478335904645731,524288 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5468,i,4063908589491791102,12723743769616090690,2097152 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3472,i,5158743133051843747,15185446930052024718,2097152 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3400,i,11636025370718425044,11242708759011080082,2097152 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4608,i,4140209310425119419,6630136907721512436,2097152 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6024,i,8890246941043210688,5410535868457098217,2097152 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6004,i,5014726219264849058,18293084776215688683,2097152 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3684,i,11989010479523886389,15796671178325503898,2097152 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3472,i,15304490057198043756,17132866223378611163,524288 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,5550786097964528304,9542812433486676844,524288 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,13298819329574126505,14020328277997403547,524288 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3620 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3432,i,18416997831424493575,11959168467080376363,2097152 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5704,i,7969761241534111683,15031892130884738337,2097152 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6184,i,17614824428208720514,1677163846150483127,262144 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5636 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=uk --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,9224963201898316263,8429553627410627268,524288 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1508 /prefetch:14
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6476,i,12698272107021051538,14942409678439221489,524288 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6464,i,2548896264555529053,16648276511091442174,524288 --field-trial-handle=2008,i,4756480647128924891,13867612387517075757,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  - NTFS ADS
  PID:660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cddd7b606324c19e39df918f996c46a690fe10b2f083ce0e1e8939d94d224608
MD5 bcdca2ef4a99d099370ed08d3e6d7664
SHA1 fb9c3dcd82dc05c2d308b9fd98219af9784ac2dd
SHA512 5bed973674d35f85662622e7287a8122691d4b93dd4dca6a8f1617c09aadb80abeaef2ee988f29c79161e64edb3a77ac0bf519bd7282b50e6c72f309640de89c
TLSH
T102E0EDAFC820AC3B1CFE072970908745EA9513262B90894B7A3D86098FB462B4586C1D
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 363KB
SHA256 5ac6c3c8c9045405f3a89ef0e0c80536a989becb552e97bcb94a80cdf090f0a4
MD5 f007441abab99e3a21d27dc2d28060cd
SHA1 c35c3f7bc29f579b8fef5bca815d8166f25fe620
SHA512 e425a78e7b98639ce278743929745392f47677447fb862d7dca3a9a141ec7795e4a26a23af660f868c400c0f309588e681272c0a437f3fc089944d5affa90f09
SSDEEP 6144:qaBl1GmDy/PFE4focYk1uyBbZ/zf1HV40+0/OuS8c9EznEmePW9OVBfJ8E/DxMI6:qaBLGIULocL1uyBb9BW90mGoErMGObJ6
TLSH
T1958423F5E4B83899198D4DB762DC5A4483D38BB20D63B1A89FC2483E4F40E476A1B4F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5beb73142199f279b87fb7d52e319879b04d301d21c9c733df264b891c18467d
MD5 e7929e0f655d8364656ae5ea9f69c63d
SHA1 4ce87f136a3c20d8fe6987ce04979a1b81afc0a9
SHA512 4dda16600a0cc9a1d17c5e0d20bfa9e3c1ec1f0fa8cdfa5493526f1bac32601f9c8fc9ab5f23698e39ebd6efa065df3694ec56f782af64da549213c58d9c6353
TLSH
T1E841CC8973C584AEDF7E0E7305E8BD4AB3B4D90A6EA50F0A0618987082436967F067A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 47e8909d59d954cc6856d340486cce87963853a1e6d943f75af77a851a693be2
MD5 af10d82b023125eadd5e343688970aa9
SHA1 edc9125f6b67e1d4cb56f7af5746f3ffc84a675a
SHA512 a7d688f39fb0369f7b986d3a370f07c098e41d95bba8745318823f37b2aff46de54bb143d8421e7d40ff286adb583a8840059860698d9e70b8fedf461f902c79
TLSH
T17641CC89B2C584ADDF7E0E7305E8BD4AB3B4D90A6EA50F0A0618987082436967F067A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 8e3c3292d65aadfc745680737375efc12f34251c6cb5d17fabfd5057ea3789de
MD5 366c25d9285e211405a53dbab38768a3
SHA1 3b354359b0903e9b050bb4a6a880a4717439c8c8
SHA512 9c03759ca0e9c9eba79bd48c122f0332bcdeccd299feb4b1872e0f015f0459e3ca2f75077a0c5b1551806532ec642f50c637325ec8f4dabcf576883cb937bf8d
TLSH
T16041AAC8B1C9857EDF3D4E700AE0FD5A33B4D904AACA0F030619987086536DABF079B8
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 ff9ae23020bc4c9b9117ffbe6ba3f129f9613e587991d4b6d7f75e3e4cf916fa
MD5 f5b9cd72fcd09ac05c5d02d45aee6382
SHA1 00ab0d4b0b18da3aa20ef498c68108d003b0dfa7
SHA512 9ff6318e910394b640c086ea295afa43a55f03d67ab1ba950469a30eab1a41b3be8cdcb3d97bf179a16ccb79d516ef07ab8c6c8056691d5d119bfc2cf802bf73
SSDEEP 192:Dh/u1LAtnxKJzyJoSUxses1aIal7JtJEd7ttJSq/JKTJaPrJvqfPimNPhJHNbMJ7:Dh/u1LAtnxKJzyJoSUxses1aIalV3Ed9
TLSH
T12D02CEF783E9C66DC511A6F4EB15AE2FCE290624032C3C66C9D4AF0B93E2472D25175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 7ded69f0be4fe4a6a3ce399d39a821445401c416d122fc508971f2ea64e90b0e
MD5 d26ffdacfa4712fb5f7a133e1cf760b9
SHA1 47ec677d60e790b3d1dc595b0557d979ecd8647d
SHA512 662f59ceea25c25b26457e9cb87a807d99f374678e1fbe8ac71aacef75c22020bebfaa276755243d9e3ad538cf3dcec39ee5777d6e8e59e10fa5f9ab994f0add
SSDEEP 192:DMymtvUgurOJzZJoSUJaIal7JtJHJDJ6JRJtJvJXJ/JtJTJaPrJv+JfPSJTJNPhJ:DMymtvUgurOJzZJoSUJaIalV3pd4D3xY
TLSH
T18512BDF7C3E9862DC85166F4AB156E2FCE2D0924432C3C66C8D4AF4B93E2471D215A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 8124835c4247c423f887489c8df923f1584712c421a05dc9981a429ef90add1f
MD5 7f534590e797c69b0af5a131d8262cf1
SHA1 8eea8ecc5f65065873b2e27d133bbe621daba0a3
SHA512 090249fdbb5934f4c11ef32faa587d2a60f0f98e5a2f877b3f488fa199bb8054cab38a78c408be92c06fe07b2b19bc5930e986193173dfc206976466173756ff
SSDEEP 192:Dh/u1LAtnxKJAyJwuyHsestyaIal7JtJEd7tuSq/JKTJaPrJvqfPimNPiHNb3/8i:Dh/u1LAtnxKJAyJwuyHsestyaIalV3EE
TLSH
T1D802ACF783E5C66DC91196F4EB15AE2FCE290524032C3C66C9D4AF0B93E2472E25175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 599ea40a63e2b782f8792877d5cc97f71a760098c9580140e85f2eae6650c35a
MD5 077b273c926f9780765452b43cb455da
SHA1 94e7e02caa4eb1522b27f5d35c177eebc0ef95d3
SHA512 e396c192af4e09df0bffb32f4d33c924b0cd401bb8e80a3f87a78c545a2c0b9a8d43239d27f599cb9888e6fb62c7ff8b9355fb588ed1339155bace8489f12cdb
SSDEEP 192:XR6acBkoe8WsG9xGL5D/mn/f3xetua4Bv7pFpEPRpGbL2g9YHsb+WNPcLECTX1MU:XRLmkoenrzdb0XyOw0b5mYa22svp
TLSH
T10862C82BB8543A7B9CDBC22AF921BB17E7F5113565D02E84E6FC8A1C14E7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 42b94f47cf54ad5ac5993af9ab8bdad33e42cf8008172b9e741c3883dcb8352a
MD5 1ebfdadf6e764684fea11f771983f2e6
SHA1 99680881ce15260db326b58171bbe71298027d4c
SHA512 09b6f23ad121af4ec3b0624f0646041c27f44dd069841168e2527c48357b2964edd319bf15cb797ccba1ea47f72ccfb7357d0ed5336572316c40400652a22294
SSDEEP 192:XR6acBzoe8WsG9xGL5v/mn/f3xetua4kv7pFpAPRp2bLD9YHsb+WNnECB/LYF12X:XRLmzoenrHsbUXyOwnxYv22T8
TLSH
T16C52C62EF9547A7B5CDBC22AFD21BB17E7F6112520942E84E6FC8A1C14E79CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 279f94727445648e8b848b7cad914e1a8a751ccec9dbaf7316fe1f093c90f323
MD5 7d642fadd01e502496ced6cba4a692f6
SHA1 10cdd831ec0029e483795fca75b1d28f88a85e86
SHA512 438c38c320d418220e0bacb6607300267bb5f9fec7ca26ce6a989346fceed3f3cff42a395effc4064b90d64f0af3ec254d6715d072b2d7ec05b2c424f94ff2f8
SSDEEP 192:XR6acBkoe8WsG9xGL5D/mn/f3xetua48v7pFpEPRpGbL2G9YHsb+WNPcLECTJIUA:XRLmkoenrzMb0XIOw0bd/sYXB22svp
TLSH
T1E962C62BB9543A7B5CDBC22AFD21BB67E7F5113520902E84E6FC8A1C14E7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ccaf2e88c95db279567371923d6bff587207e827e04a86c2c03b9b62316235a6
MD5 ec019c007fabc8ee087477ea147d9aaf
SHA1 88a71a6a4e92ac5f01d41aa15a2d0fdfa0a9077b
SHA512 f0ad987409d18dfbdfa72703c1c6128f7a04c9653b615eac7d3cf102a71b9e77d6987afa700f784d11cf1226083af66cd650f07ab0f53254ae70d73b819a7f7e
SSDEEP 192:XR6acBkoe8WsG9xGL5D/mn/f3xetua42v7pFpEPRpGbL2g9YHsb+WNPcLECTX1MU:XRLmkoenrz+b0XyOw0b5mYa22svp
TLSH
T10162C82BB8543A7B9CDBC22AF921BB17E7F5113525D02E84E6FC8A1C14E7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e33c418e45a588319af598350a00a0b266b12ed496524a45d41235ff92584eea
MD5 28f6161400c718911b07e687b83eb469
SHA1 40ce55d72285d16e8cbb6c90a6dfc9c744c0ed3b
SHA512 8a3ce0941dec0eb5c1f819c401706359bbfb842403466b917ba1ee51e1107129223a93931430df862e1d904284a20675186d95c8173c16db82941bfabe58b723
SSDEEP 192:XR6aoe8WsG9xGL5v/mn/f3xetua4kv7pFpAPRp2gm9YHsb+WNnECBZZWf122eenu:XR3oenrHsbUX2OwnlWd22T8
TLSH
T14242C62EB9547A7B5CCBC22AFD21BB17E7F5103520942E84EAFC8A1C14E79CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 412bf2d02187e1f21617cc67245ad9f92657f2fca7125eb5d6d885f1f4f1af60
MD5 8ca96cec1de3089c5460792b5090900e
SHA1 53e611e75842fe28cd8411562a6b9cb5f930c2b7
SHA512 ec2fd65fa3ea50e89ad02ffc6670313c8590a05519da025327e5a32fdbb37549b67f7868c9097726ca3cb7fac680b0fafb3f0e89ce24a8746a45cdee10028c93
SSDEEP 192:XR6acBkseJWsG9xGL5D/mn/f3xetua46v7pFpEPRpGbL2i9YHsb+WNPcLECTt6GK:XRLmksecrzyb0XYOw0b8kYc22svp
TLSH
T19562C72BB8543A7B5CDBC22AF921BB17E7F5113521902E84E6FC8A1D14E7ACD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5634db941add2e8f2b4cd69d28bfea232edefe58f01070337ecfb2c610e347bd
MD5 ded1374aa4ac43a739a8114cded6e527
SHA1 43c20703e2d55b6bf8141b1db9961a4c5e36665c
SHA512 1df106a5d92a286eaab24a2b18f9d3804b851fdf342b3ac88b6f1768d9e4c2f9d7c5a364d5a7d12917b8ff9ec8ad9e4089d876c6773f08a03fea36268571baee
SSDEEP 192:XR6acBkse8WsG9xGL5D/mn/f3xetua4Uv7pFpEPRpGbL2v9YHsb+WNPcLECTReo+:XRLmksenrzcb0XtOw0bsiYQ22svp
TLSH
T1AA62C62BF8543A7B5CDBC22AF921BB17E7F5113524902E84E6FC8A1C14E7ACD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 dc4c91707224b01d47a9b91e54001e839c8a9cb7e21c175c0bf62a18c86ee12a
MD5 d2e40729bbf776aeaa2dd0aaad60c078
SHA1 c92c350b96e957b5d78b473587e0b23ca878b1a0
SHA512 40cfba272474b9924f3ae810e03e4716408b73087950768cb8fb2c3d0d16ac5106aaf8b897d003b6a160bac8794c2f6b91ea719d9f660fd70855e903ac8421a7
SSDEEP 192:XR6acBkseJWsG9xGL5D/mn/f3xetua4bv7pFpEPRpGbL2i9YHsb+WNPcLECTt6GK:XRLmksecrz/b0XYOw0b8kYc22svp
TLSH
T16662D72BF8543A7B5CDBC22AF921BB17E7F5113521902E84E6FC8A1D14E7ACD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 62823570cfedd89166cab086847ea58cbc66514e75a0359358b356ff96b4c8a8
MD5 daf328c1daee68981df7c78992a63215
SHA1 d4fc4ba9f7c78e83f6aca921771e05266b349cd9
SHA512 95cd831894bde02381e56fe0e7acadfc4c762e536f7076c10522f5df117b9f9bac8e20e33bf7f14a69c29e703b3934e31b30a6ca6dc51fe3a9945b0d2a5fa2ee
SSDEEP 192:XR6acBkoe8WsG9xGL5v/mn/f3xetua4kv7pFpAPRp2bL2G9YHsb+WNPcLECB/LYJ:XRLmkoenrHsbUXoOw0bxYJ22Vvp
TLSH
T1E252C62EF9543A7B5CDBC22AF921BB17E7F6112520D42E84E6FC8A1C14E7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1f48e1f92df404373959d2310298a8b25d9aa9ac4ef8937381c40b46a415f309
MD5 bcef59b6de11e95e42e8cc2562c65e67
SHA1 cbb1992e8baf69e4daf5596fc9655ddbe25352ee
SHA512 6de0ae0dc2f5febdcf00305247e9dfc9a6461b11135785b8349349f82b506599551487b1a00ae251f78a175f12e79e18ae0bcc174b3ef598da3c9a6b9a335679
SSDEEP 192:XR6acBkoe8WsG9xGL5v/mn/f3xetua4vv7pFpEPRpGbL2X9YHsb+WNPcLECTwO+p:XRLmkoenrHzb0XNOw0bfMYH22svp
TLSH
T19E52C62BF8543A7B5CDBD22AF921BB17E7F6113521902E84E6FC8A1C14E7ACD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 689dd0fe569557c95196b6ac0071bf53daf6eabdc8bf0f5e9cd0c517faf27c97
MD5 60bde0b683a11929d318cf9aa459be7f
SHA1 8a6e40a01a7ce202f2a65a396e7e797bdcd3e326
SHA512 7bb66ea97541ebd9ca97d76fc965469460e226884ef9dd2d119e1f1daf70ff3400821b749b8003c3e8020cdd123a739b07c05d8268a4e8b0c52b780b356b2a65
SSDEEP 384:OEjql7KxkXqKf/pUZNCgVLH2Hfgsl817pLxLcJfMtXODql+ErU3H0HB7uP5:OIql7KxkXqKf/pUZNCgVLH2Hfgsi17pA
TLSH
T1478219676C4C9D7B0F94CACCDC267E0FADB5025B65D9C86442FA982A03D5ACF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 51a0d99ecb11e2f0ed55405920d05bc270102a964048b594a29ff5e452429a96
MD5 cfa0c8fa531c410d734a6ae6b0db32c4
SHA1 2f4510f1cb602501d7d45ebf0c524838eabe9d35
SHA512 aaf8c63b930238a9b7feca033392ca7e70483b63cf4eff94ed51c850672f964881be648c038c5a8fd25177b3ad0dbfd66867827f26a911d2a4036f2492f73851
TLSH
T119B0121180025602C04303F021A6148C3254AF1EC70A174153E06971DC261A14015170
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d349.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d349.TMP
Size 96B
SHA256 e9ff1eaf954245bc3c93b183e5159cbac7fdd4a6e35ec125abe19887174995b5
MD5 6f52a262768b2574fcf54885e4e1238b
SHA1 fd75f779f2ecce238a34b825b49e432980678481
SHA512 8c2287051f80d6c26a4f86c06fa25b30f0389ea5b268b59f73b06bdec13aac72dc133a4bdf7318b2ca041714e37d86a5a646e8a2c8fa6177853b5ceba85e95b6
TLSH
T1BCB0220AC002A202C00203B02280A2EC3230CF30CE33030283E00E23CC30238202A020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 2557a9f7c97a0000cc6a37f22d5fb94af69ce3e440ee17ffd0b4cc90ef46475e
MD5 2813d8e909f92c1c9fcc8a575d9f5354
SHA1 27c4f4edb070c2717ab538898b55211c8658520c
SHA512 f54193267508d88296b8a674ffbddcb110c6f87499118ba3338031365c3cbfd9527929aa35e9c59e098468dda93094700643591f8750394f49b0d6e8d02a4632
TLSH
T198A00214C7810061D10B23B365D683493390A910936B1F9755900399B9941597F7544C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 e10c30615218ab806efa72f5d81e6b4b267ddeffc57a1f265c5dbfc587565dd5
MD5 a27f89233808c14521f66bbd4d4e5357
SHA1 788a229bd47bc0a3c1a7da4e48eef352dafec373
SHA512 e81ee329e068cc6ea168b0ab12f37b5ad745f978f8cc5aea091f21c99adf1ce54dfd9ce8d0ec01376a379adc2914628d3fac3b6268fb78a1161d38d2fdb9b401
SSDEEP 6144:hAcyx0wNJMQSR0GxJy+gqvl++JjcMW2VcVLO:6x0wNJZ1CM+gqvXOMW0
TLSH
T1CA1423B5594BBCDB035BE659622BCE39CEC10C9BC5047DFC2280AB0B24A97D38757CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 d34432917cedb22d58015a907a36043831cc2db01baa1ab3290ea866e485020a
MD5 fbc9070ba6f618fb49484a4a4ed4d03c
SHA1 b95104b41be3a6503fb3ee717e6aa32c18ee4c9a
SHA512 279f96ea04c8635559c94069deaf295c2fccdfe586a72a0e33af35faf4f7f72514df4c2e51b6d07e8d4a6123dd175b0ac91d7c18ab38d8ccea41bcf660cf898f
SSDEEP 6144:icyx0wNJMQSR0GxJy+gqvl++JjcMW2VcVLO:Cx0wNJZ1CM+gqvXOMW0
TLSH
T1291423B9595BBC97034FE619662BCE79CED20D9AC0046CFC22C0A70F24E97C3436B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 02dd96954d56beeedbca1b0a84816f30e4eb595193396f0eda1a58e5e6d25b27
MD5 6f8ba1defa5bc1099bca74f1e99305a7
SHA1 2ba686e8a8cef71d58c0ab27eb13b47476070ab7
SHA512 02409930b3c3daeafd9ce18491de1947735ddb8782bc4ab4b30623a76a4fbb564813582f8a51f970cfdb2454729ae9ef9e9e7bd57c5a27163b0907a4cd1af4d5
SSDEEP 1536:SuP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:/++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T18A9312B99D1FBC79635EC6A690079CAC4CE39CDD151054BC30C75F1E18BA3A2A30B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 68991cd0cc4293a9534e2b708e04963d555ddefe1c79529910f3a3f8a23fafcd
MD5 a81916c72fe88852251048a1209001ad
SHA1 d9abf919ce35d41a3918caf0684048de0e172702
SHA512 e0ec42eee44431f5406470b31525b42c5a12e720769165cc2a1cad6c17aaaa15a6d1f5c027ea5385d345fe0b132e698fbac38c91ba4eb391e767f738bdc51821
SSDEEP 6144:rcyx0wNJMQSR0GxJy+gqvl++JjcMW2VcVLO:Vx0wNJZ1CM+gqvXOMW0
TLSH
T1BB1423B9595BBC9B134FE619662BCE79CED20D96C0046CFC22C4A70F24E97D3436B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 b382390a7581f3caeb083c110e121494031749601fd5471020a614cec9160e73
MD5 ba1c559b2e1ed59b08dac377d054c25a
SHA1 c4350e11ef1c54f9928c074efe4167f744f458c5
SHA512 1f0f31d5201e4bfb891c4aee9a895bdf25213013917fdc1e2ef0b9928bc6965bf53cdb8681d6592abb13c30e0a0fd8daef2cd3be974a4396a317a27f0497eadc
SSDEEP 6144:JxOwd9XQN89+FpGcyx0wNJMQSR0GxJy+gqvl++JjcMW2VcVLO:OwTKW+F4x0wNJZ1CM+gqvXOMW0
TLSH
T175342275598FBCCB136BE655460BDD39CDD24C43C508BEED2284AB0A10BA7D397A7CA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

change_phone (1).htm.crdownload

Path C:\Users\Admin\Downloads\change_phone (1).htm.crdownload
Size 20KB
SHA256 70be0ff3eebb2014146af28aead3079ac92dcef5281e2c6849c40b3763e2c51e
MD5 2cc3a198877bcdc78d3389e82fd6da61
SHA1 68806230288b1f93586e5acfa85e8a1495e68af9
SHA512 6a668a26cbd369787429b3505753d7792e679696b8d67dcf7de7243a321b2b90b021920fc8fa85a5643d64b39aca3c9d2c2a796bde7fba05b04344439526619d
SSDEEP 192:IAMCLsqyPPfbQlojmgWWX6g9FA684UdbIB9LosebnZ1w+rPhvv2OPXFrv2OPtTvj:vXLsL30ncNq6gsLzeF1zv3rvrruh3ot
TLSH
T1019295B3E85558670223F1C6F2A66714B0E7403FEA421A11F9FC16BD27EFD90EA23915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

change_phone.htm:Zone.Identifier

Path C:\Users\Admin\Downloads\change_phone.htm:Zone.Identifier
Size 129B
SHA256 067bc3515fc60172c80de0c3df33dbb1073eba207e4356038a0b0e19f50815b4
MD5 b698e7c1c87a9d9f957577ca207299e9
SHA1 4490b32ddda30357d109a56893c732a5e15b0996
SHA512 a08cde9be4bbc0901a856d5cdad561412774b68cd2c2682c2ad1f9c9ab10f58fb5e37475badb3b102967be8e31a1ee1581e968a924c0cc37c390caef0cf6e4fc
TLSH
T1B0B09BFF554C54610597B2D2D1D4719DF15FB1E8CC7601D0F9011C97DB46094C657417
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4600-0-0x0000000002760000-0x0000000002761000-memory.dmp

Download

memory/4600-1-0x0000000000400000-0x0000000000775000-memory.dmp

Download

memory/4944-15-0x0000015FC7CD0000-0x0000015FC7E6A000-memory.dmp

Download