hxxps://www[.]google[.]com/?hl=fr

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/?hl=fr
Sample260507-egalvaew41

Score

4^/10

discovery ransomware

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4736	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225996665022592"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
4336	chrome.exe
4336	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe
Token: SeShutdownPrivilege	1544	chrome.exe
Token: SeCreatePagefilePrivilege	1544	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe
1544	chrome.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1664	1544	chrome.exe	80
PID 1544 wrote to memory of 1152	1544	chrome.exe	81
PID 1544 wrote to memory of 1152	1544	chrome.exe	81
PID 1544 wrote to memory of 4736	1544	chrome.exe	82
PID 1544 wrote to memory of 4696	1544	chrome.exe	84
PID 1544 wrote to memory of 4696	1544	chrome.exe	84
PID 1544 wrote to memory of 5044	1544	chrome.exe	85
PID 1544 wrote to memory of 5044	1544	chrome.exe	85
PID 1544 wrote to memory of 2540	1544	chrome.exe	86
PID 1544 wrote to memory of 2540	1544	chrome.exe	86
PID 1544 wrote to memory of 1464	1544	chrome.exe	87
PID 1544 wrote to memory of 1464	1544	chrome.exe	87
PID 1544 wrote to memory of 2156	1544	chrome.exe	89
PID 1544 wrote to memory of 2156	1544	chrome.exe	89
PID 1544 wrote to memory of 4984	1544	chrome.exe	90
PID 1544 wrote to memory of 484	1544	chrome.exe	97
PID 1544 wrote to memory of 4624	1544	chrome.exe	98
PID 1544 wrote to memory of 1440	1544	chrome.exe	99
PID 1544 wrote to memory of 4336	1544	chrome.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/?hl=fr
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd80bc728,0x7ffcd80bc734,0x7ffcd80bc740
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,6757636792331683713,12250205776986972304,262144 --field-trial-handle=1932,i,14715208307390319867,12910517987314457454,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,3877017246230507496,306689911626292885,524288 --field-trial-handle=1932,i,14715208307390319867,12910517987314457454,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2020 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,18382692885385631667,14005148112048556144,524288 --field-trial-handle=1932,i,14715208307390319867,12910517987314457454,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2684 /prefetch:13
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,11900542762359707220,1536602683989640639,2097152 --field-trial-handle=1932,i,14715208307390319867,12910517987314457454,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,13097596841634909866,13363717175980473860,2097152 --field-trial-handle=1932,i,14715208307390319867,12910517987314457454,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4116,i,8467819807597825809,5918415206527202221,2097152 --field-trial-handle=1932,i,14715208307390319867,12910517987314457454,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4224 /prefetch:9
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3184,i,12116965981012133953,3220440070027583816,2097152 --field-trial-handle=1932,i,14715208307390319867,12910517987314457454,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,105209316992144444,14456523701233287479,524288 --field-trial-handle=1932,i,14715208307390319867,12910517987314457454,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,5020936804688287166,851650090431518469,524288 --field-trial-handle=1932,i,14715208307390319867,12910517987314457454,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,9760440776261299541,10722943081213404310,524288 --field-trial-handle=1932,i,14715208307390319867,12910517987314457454,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,7765523983184284456,3033505541973212626,524288 --field-trial-handle=1932,i,14715208307390319867,12910517987314457454,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4244,i,4731585253480138801,12344309595693070774,262144 --field-trial-handle=1932,i,14715208307390319867,12910517987314457454,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5616 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4032

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1824

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3220

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:348

C:\Users\Admin\AppData\Local\Temp\7BA87895-1446-4D16-8C48-0B0C37F8BEB8\dismhost.exe
C:\Users\Admin\AppData\Local\Temp\7BA87895-1446-4D16-8C48-0B0C37F8BEB8\dismhost.exe {494D594E-F52A-48FC-B4BF-2BABE0DC93F2}
1⤵
- Drops file in Windows directory
PID:3504

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9db47bf19fe8d85078f0c136310a6a0e60f65e4db5c88b0bccba11aaba177531
MD5 185cd218e38e92bf1a27598e9fd2c11b
SHA1 db8011f1f7c1e05573a7f6a6743d65a677f24f27
SHA512 48504ef6cddf9bdc9da4a6c9318dd7919cd57e14ab19456984e6ed543fa3eaf1f0025acb6fdc83d9898b0cc0b8db3325a8be7ae5828c26f8a6e37df312ee5885
TLSH
T12AE02B9AD971DC3709FD4B1861600746F651135A2B90595F763CC2084FF5A2B49818AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 5d3157fdededf712a1085512636728f0d22c3074ca359ba1279728b9e5e33e2a
MD5 6b42d91e6fa84a2d592532df555e6fce
SHA1 72b8dc9f7364108b56539f1fca0c334c4305e29b
SHA512 3ef85eef1cae6ac0c4a9dc9693d372290b3d3466284c8b00bead40a17e86ee0da28f532b2250db991a23089ab83cf20cdaf771a9ad23d1f8c19eebf2950ded44
TLSH
T1EAD02240332200C1FB9EC7700FE7C12BBBB3AE05F19297651BA9D60E982E27B89001B1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 83029cc1f3526a583fcc7396b052415fa60567856cc0b0167ce40233f586c360
MD5 de401f706b6b8bc8434abea62c0b973c
SHA1 fe4cd50e1acb9fd0aeb3bfb5e7136f4d0dc971c8
SHA512 974b03fbcdcbddde0e3331a35159b4eb2580a1e18018520503c13e68d6294a3a2aadfe51399946a0409b9a4d9245859b67010231def379680d5f1b89b0a62994
SSDEEP 96:DH2LnNIaEagduUA1U4BeAHEPtCpSklLAor:DH2LnNIaEagdQl4Gik8oE2
TLSH
T14D91ADF7C3E4C56D8A1156F4EB156F1FCE290624432C3C66C8D8AE1B93E2872E21539E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 81177c447b3186d097f353144c99cc4d80db4245c4ad19c20400b6c3a5b1b74f
MD5 35c7e1bcdddde1313470e17b397b30f1
SHA1 c355be924df8c418b58ac842d3f452af8d8c1d9e
SHA512 72e2e97e0d37acaaa33446878c3bc0c4f1cb25f1fac0d43f48f4ff14ec31241992b7d199c63defc6917a29094f2db6c132eee952ce0bf3c0b1ef18c78ce24922
SSDEEP 192:NURHVeU8HBgv7HYpAPRp2Ns/98Hsb+WNnmSZ7162ws4s5sqD2+gkwg+VyIsnAUg5:aRHVS8EUXV6wjm2R4s5sqD2BA25b
TLSH
T17642E92EB914B53B9CDBD219FD22FB57E7F5202161901E84E6FC8A2C11D7ACC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0b672523aa0877b753169324a65002c0cd60da0b8a7aa5944e536432bb8796f7
MD5 62e4c8e85d18277778942931fbf0fbe2
SHA1 0e96ba835e754c2fe92489934af5098377210ef8
SHA512 a27ae5cef133d0ea6a253b9ab5f9b040b9e8a97cde05df6120769e4b85db63b5f16a859ef54165679f2bf311ccb6026d9a1e62efbca4abe47d8f130566e0837a
SSDEEP 192:NURHVeU8HBA8v7HYpAPRp2Ns/98Hsb+WNnmSZo1neps4s5sqD2+gkwg+VyIsnAUy:aRHVSzEUXV6wj2e+4s5sqD2BA25b
TLSH
T1D342EA1EB914B53B8CDBD219FD22FB57E7F5202161901E84E6FC8A1C11D7ACC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2328ea9073549adab02fe99e0127dcb5999d2517b99cac1f85861fd5d1268867
MD5 40aba898dc4efcd9988ec53e06a8b15c
SHA1 af8b73cd37e29a8d0b68b474702174d179201fac
SHA512 1f184dc588afff9f591e8a55398deb52c19ccb2c739739b1384e2a6da49836e5a8171b750e21fad998d39b550d8f4906b846178327f24be8db946220ec5b5a8f
SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLcif3yXODVw+ErU3L5HGcHRXD:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pq
TLSH
T1D172FA676C4C9A770F94CACCDD27BF4FADB9024B65E9886443FA981903D5ACB010A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 dcf4fcce50e87c72691860d4ef86be6ebe6e795df2a4318d0de1dca2b2aa7b30
MD5 d8cb1603b897f5000bc47be950e9c78b
SHA1 5bbba43e042e6b2f0a833a1adf9b7f2a1e4a2f6c
SHA512 dabd90908e5f78dfeb6fe8d9cb812cee110a82dfeaf7e0159eebb11ae1275228cdfb30f4a5dc8890b2cd2caf5627b49cfedf62c9161ad486268055b48300ae9e
TLSH
T15FB0129180025503C04312F511D664883534AF11D705130563E06FB5982A1904115161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586349.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586349.TMP
Size 96B
SHA256 a2961b208776af9e42d23551691e2442ca850d7550b13800e57c82c74c6c7bf9
MD5 4cd37e9f2b65c7f17646b80090f41366
SHA1 ebf862b24177c628a1db35442b5f74eccf22f5e0
SHA512 11d4c20ba75188aa99289fcbbdcce034dd6bf56524c3cffa5b746384c82890c58a489e72b3720458e97d31544dd7f2145e9703b9d4c535e70c52586333b74b15
TLSH
T106B022C3C0022202C20303B028A288C8B220CF30EA030322B3E00A3ECC202B00020220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 740676e92c1d86ff501fb653a20e2dfcd133ccca379f18b4e88a980af7380f08
MD5 503f7ec2c51b9c922201d3c47439207e
SHA1 ae9017969191419bd0159295f716c20b7739b848
SHA512 c8395c1291c55d8bd7f3c64ddebde35c12e94414d654d877540f5c1477c06ebc2b37c423cd1041e7b2dcd7ec42f446070a99fa1ce1c060e6a8df2b01cceb173e
TLSH
T15AA002D812D8A921C808067066C2118026F45E51754E8743A1D4409CED7AA40B68A0E1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 b21ed6e1e111a4838971ce776de7baec06db8f867228d2bd03cc2b643e4b3836
MD5 17e6ae2cfc1eaa6e51d78fc9b0954958
SHA1 755fdf0a5f6c844c8276d7b2b845c305581f03a9
SHA512 eab3968b6020454435f5eec7a88686ce0514accfe1dc73b12bf624b875563a64d8e5212bd276c8138403276eaf1cd8ed2b55b385b908f13f02489fa6168d4df5
SSDEEP 1536:xSDeP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:Y0++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1589302B9991E7D3913ABD3D691076CAC88D3DCCE2518247C30C65F0E14BA392A35B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 9de9f879c1e33ece47afe4b2442408dc43824505e8686c1572d0cb91b2d9520f
MD5 ac3cf3e2bf34ded449b3a415a3c4a5d4
SHA1 0953e593e1efd3d11bbb46b115063db098440c24
SHA512 df2b363c2b9c1669242375f0de3117a6b6f1ed97bdb0ddb5a3f7ec5ecf39a0822dddef320230227e39b9763f3ef13a32b116dc84a43b5a8524e452219dae3375
SSDEEP 1536:QS3P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:J++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1949302B9991EBD3923ABD3A6A003AC9D8CD3DCDE1514157C30C65F1E14BB392A30B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 94237329d2177e2de27ff045012343e753369c019d6f646d725011dc929a75ff
MD5 2cdcef9d1caf9f166caa184441d050f2
SHA1 7df777f5fbea3cca14c1b766afa145d90a213190
SHA512 063890759804b11d85aacbda5d1d8655d96427a51ae6a7965e200d35aab0d013569ec321dbd83a50020c88f1e5bf3b2e87a781966b63c202d873e25246e4d6e6
SSDEEP 1536:wSHP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:9++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T15D9312B9991E7D39236EC39AA0179CAC88D3DCDE151410BC30C76F1E14BB392A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 b9c3c9d1b3976a0995c5ef6d9863aa2e638cf9c6466fa837fe3d1fb05885b3c5
MD5 09dfbc9cc6e8343b6f200eb44c00355a
SHA1 9107d0c286b889b81bfc3608cd55b9e261ba4ac2
SHA512 bdcbf82459373e566cd0fef5ed8c23a1335d3c272e6334f3190ca559cf14b609a7b95541f7d6d9c3c5bafbec983184af13fbc0e43a86800b4a10ba0bd5f09024
SSDEEP 1536:xS3P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:o++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1BF9302B9991EBC3923ABD3A6A003AC9D88D3DCCE1514157C30C65F1E14BB392A30B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileCoAuth-2026-5-7.354.3220.1.odl

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-5-7.354.3220.1.odl
Size 706B
SHA256 fc738e906637702c1f369af1b5e7b35d58ccc409bf5120507a5e36f13e06af46
MD5 2b867b970be22e207eadc3423ab19606
SHA1 328dbac10d6fdcfe30955aedb70e210ded772cbb
SHA512 c6260c572eae1492183d6c901ce8814300a4a513b6d3aa5c781b7c0f734f5484595661d6659d6172a77e26b6361c4f9df5a51eb86c53191c52b752d0026e0496
TLSH
T12C0197AAFC178476DF31013CC80DF20C0816B9227C8D702186D90B995A0F7E2210AE36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1824-150-0x000002463FF00000-0x000002464009A000-memory.dmp

Download

memory/2932-198-0x00000000008D0000-0x0000000000934000-memory.dmp

Download

memory/3220-144-0x0000000001A40000-0x0000000001AA4000-memory.dmp

Download

memory/3456-13-0x0000026AD8040000-0x0000026AD81DA000-memory.dmp

Download