b2e432db52576819dcd247dd61f9fb25e0e03d758d99b9024e3d4ac33448202c

Analysis

user interaction
yes
max time kernel
1049s
max time network
1046s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
11/05/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dota 2.url
Size 219B
Sample260511-t3h8faex7x
SHA256 b2e432db52576819dcd247dd61f9fb25e0e03d758d99b9024e3d4ac33448202c
MD5 d322a9a54f37af115a57d8793a8589db
SHA1 6e57d8f8824bbc9c0590e125ec52464ffbdcda2d
SHA512 148197b358b5f750095523235c53d0d93c15f2824b09527f98f085c7060478f76cd641faa0e3e903b36a7197284be4302f54a2f4f0e0b3c7d9ad5a644bb5d246
TLSH
T1E7D0A7548E4FC5E1D362944B55B17C529849B9A129DDCC8D63C1DB8A0CC45844846A69
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3768	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229909049466400"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
4060	chrome.exe
4060	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe
Token: SeShutdownPrivilege	5068	chrome.exe
Token: SeCreatePagefilePrivilege	5068	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe
5068	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2476	5068	chrome.exe	86
PID 5068 wrote to memory of 2704	5068	chrome.exe	87
PID 5068 wrote to memory of 2704	5068	chrome.exe	87
PID 5068 wrote to memory of 3768	5068	chrome.exe	88
PID 5068 wrote to memory of 5812	5068	chrome.exe	89
PID 5068 wrote to memory of 5812	5068	chrome.exe	89
PID 5068 wrote to memory of 5808	5068	chrome.exe	91
PID 5068 wrote to memory of 4232	5068	chrome.exe	92
PID 5068 wrote to memory of 5808	5068	chrome.exe	91
PID 5068 wrote to memory of 4232	5068	chrome.exe	92
PID 5068 wrote to memory of 5720	5068	chrome.exe	93
PID 5068 wrote to memory of 5720	5068	chrome.exe	93
PID 5068 wrote to memory of 2840	5068	chrome.exe	94
PID 5068 wrote to memory of 2840	5068	chrome.exe	94
PID 5068 wrote to memory of 3572	5068	chrome.exe	95
PID 5068 wrote to memory of 5552	5068	chrome.exe	99
PID 5068 wrote to memory of 5552	5068	chrome.exe	99
PID 5068 wrote to memory of 3216	5068	chrome.exe	100
PID 5068 wrote to memory of 2696	5068	chrome.exe	101
PID 5068 wrote to memory of 2480	5068	chrome.exe	102
PID 5068 wrote to memory of 1428	5068	chrome.exe	103
PID 5068 wrote to memory of 1428	5068	chrome.exe	103
PID 5068 wrote to memory of 3104	5068	chrome.exe	104
PID 5068 wrote to memory of 3104	5068	chrome.exe	104
PID 5068 wrote to memory of 352	5068	chrome.exe	105
PID 5068 wrote to memory of 352	5068	chrome.exe	105
PID 5068 wrote to memory of 4060	5068	chrome.exe	112
PID 5068 wrote to memory of 2064	5068	chrome.exe	113
PID 5068 wrote to memory of 2064	5068	chrome.exe	113
PID 5068 wrote to memory of 1872	5068	chrome.exe	114
PID 5068 wrote to memory of 1872	5068	chrome.exe	114
PID 5068 wrote to memory of 756	5068	chrome.exe	115
PID 5068 wrote to memory of 756	5068	chrome.exe	115

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\Dota 2.url"
1⤵
PID:4744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1c8,0x22c,0x7ffc356bc728,0x7ffc356bc734,0x7ffc356bc740
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,13845893321156945252,12920357679731174783,262144 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1636,i,14975004921253591993,6922896461348002449,524288 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,3687388532174834763,12814106476936382496,524288 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,935957316367467095,7609130315542641430,2097152 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,10882997485072694085,11886897922502957600,2097152 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,6472321625691551401,8784149450533448216,2097152 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,6375416638827537837,811290562279527973,2097152 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,3802844193220509338,16629209695366131757,524288 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5524,i,11820891430984520529,10443362230188127729,2097152 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,5280874205293962169,15895375975715758379,524288 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,9428637218912996830,9460578470789149039,524288 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,9658294031327436044,7025422423563637131,524288 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4716,i,3850584021606855296,2069932690870271548,2097152 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3332,i,16538419739270253827,883760862304746519,2097152 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4708,i,9004113777762132157,13225840550892813106,2097152 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5636,i,17963293195696098332,14635187560375382077,262144 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3504,i,11804020793256994352,12162223784112109659,2097152 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6552,i,5938018459682018057,1398399912449811721,2097152 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6784,i,15235989738402206893,941712320701944371,524288 --field-trial-handle=2008,i,17178735320418599463,2798394180701215845,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 906bcf4e8b83f1cdac510556800e94fba2da92a10f1857a73e20d66e2929453a
MD5 8f423c26e848b6e05dc3789cb0c2a326
SHA1 f942bb5f446ffb8240a503620f1c233687ee78e7
SHA512 e134ed4ed8c4c9b73d68c5c69d9f04c1afb2308b24881bcf2af64c16980386b7c1c9bc495095939b0ef3dd7ac9f878fd5f11c4fc0614449bc931f2fa36a55d68
TLSH
T149E02BE6CD219C3B18FD0B3960155746EB6413477B50455F3B3DC24C8F726364645CAC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 4e62141c5aa36c57c2cc5120572ce2a021708a6dc6984ca187e21862cbff15f2
MD5 a6d191cfba7edb37fcdc117389224123
SHA1 ab125f841f237779177b1e16b8d6faa60009dbaf
SHA512 635c83103d41200dcf7cbeb120034de520baa079f5c3d5140021c67e6e43f3ac3ca975d75dabef3f51133fefb43dcc14530531d4975c8baac175525481773646
TLSH
T17DB0120421893A36FF8002F229C0298433D13D5B20501F1670930245BE121F68309455
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 7f1011cc899fb3801e374fb04f620a2247e82e7b8af1b596d4ce077dbdee9918
MD5 55eed1488ad6c0cbf839f57fdb4b284c
SHA1 c19877b028e68e3b0f528f39ad0b92a354543ba0
SHA512 73900dfbbc16286f13a14906206540597db486b894ed47a261d7877b593dbfd9f807d62dd193c8f5cc836e9df909778cd76f2b2d7b96c28807fc0d98f2bff406
TLSH
T14FD0A7C931843C7DEB4002F0A5C02878B770659F11311F25718960846B5277D514A299
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 dc3f7d42a4f5aac7896137f1b1a87472efd340690faa930de8a463ac0df7e85b
MD5 8f2a7cf0a607dd9c0363f373f038db2b
SHA1 9fd0d0902ec34ee102bbdbb65a7360d347594522
SHA512 b6129f2a466558d8007048f1b3ee298baa4329db6a395c44f95d4435ed6995409052d1e0bcaa5983824b1bcb81a808e3e1035beb80056c5b17a91e5ab719cc28
TLSH
T16DD0125925943D79D78002B4B4C03C893BB4686B20321F55705650857B537B6528A4A1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6fac98d0c93547fdaae8863dcf034165fa626fe3f87c87ea22a114c680048d59
MD5 349fa2dfde254fc22f0e18e025a90756
SHA1 0e1cbe41c97f1c2609c219c944b84c32cf2decf7
SHA512 9e330ecdb3625263be33d60dec0c63f81cb6ea4405f51c67471833c034f7f8abdb6175d935bead4cb63d95b9c7185d75c7f82b460af7d574d11d8d0044933288
SSDEEP 192:DmXOlbfiyKaIa8zO30mrRGI34h4PELIjMd:DmXOlbfiyKaIa8zO30mrRGI34h4PELI6
TLSH
T1D9D192F3D3E8C66D891161F4AB143E2BCE690918536C3D5688E5EF4B57E2872E20068F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b71fc0489d841263a220af71778197b8e39f2807938b1b82d7dc6d5e4529b535
MD5 988834ec381e0ec5b945e09ac8c35580
SHA1 c69ea55407ca7327f1c9006e0044a04b7f36c3bb
SHA512 501b32fe67ef6582168ebfa6cbba80ffdf3caf0e52df089a0e6aadf7cb6fee19eb00ab8c04854f2ea84186398fd71c972ea8eef2c35e0c9586c8c234c79205dd
SSDEEP 96:Dm0utfK5yKaIa8zEd0HrRHN4h4pELIjF2iKjhIt:Dm0utfK5yKaIa8zEd0HrRHN4h4pELIjD
TLSH
T1E2C190F3D3E4C66D990161F4AB143E2FCE690518536C3D6689E5EE4B57E2872E20078F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d61d04fe4020ed686f6b0894c53142e4c372fec78266956ad7e8f470a7edc53c
MD5 955bba6216f0fbd535f047620b45d355
SHA1 02b276fa239fd6d7c9a2b5434862bf7eecf106c9
SHA512 01dde99e7b3867b78c62caf505fc7fe015f557fb9a528c5b13ed40d727145709fc8960eb3d280d05fe5766732fcd753713dbe9363b9891647c7deb1229058385
SSDEEP 48:YALlhAqMq3pSwpp6maXYfo7zsggmzsR4szfs7osHKsi+sFpspHsT4sOfTYt:DmXOlbDaIatizO30HuqOf0t
TLSH
T1F69191B3D3E4CA6D851152F4AB153E2FCE690918136C3D6689D9EF4B57E2872D20138F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 c9e12954ec81630eb890d66bd607f2fa04a880fd62af1db168e0e111640e3554
MD5 9ad0c07cf9964d7f2d532f415a14214b
SHA1 ca440be29a10d6bcc87fabaf9e08a9a1abf0d349
SHA512 382f9c84adedf67c8b563ecadbca0e10b8974e6f6a7e886024e31830ece9ba2d34b850772c580e8d5080427ebc6064a138bee99c476624a0ebddccc923b4eaf2
TLSH
T1012149EB96BEB46711784CAF0E04BC167E75B835029278F4CEA6803CB4855F75B23817
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 567b674ee17083bc394ad5f432ec4d343869212fefcc9b4a9b2458f286d95068
MD5 ceb50bb51838060b8440caadc05e2f44
SHA1 188f59028a99d01645bb43808c314fcb6826b48f
SHA512 8695658c4d7855085f38da59c5ed7963190e1a137c563156a195b99a6030256ec2182eff0282de340245bc499bfca588f9409b74b0a9297e2e220b9560babbc1
SSDEEP 192:9RqWhXVAhIv7WghMPRpaGHl9lHsb+WNn1rgL4YlBnP2C6RkkkwBRUai+8yIsnAUp:9RqWVMUloXJ3whjYTnP2fRzhRUai5e
TLSH
T1CB52E62EB814793F5CDAC22AF9527B67E7F5103225942E48EAFCCA2C15E75CC621740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3a246e34e699b2795d35b4650c143c18ea9cd8f9abc5b1c9d298879a79ea0575
MD5 bf8b876c49435bc9458dec0a722d9de9
SHA1 80a9bc2f727e87dd06d31aff040e765547792f82
SHA512 bcccf0f3a2f39851569160961344d3bcfc967a222b05e0d55fd75b0b81da76075f2d5313156a9f21912cca14b8c89c6802f25ea878d524ca7a0ff719c0e65058
SSDEEP 192:9RqWhXVAhbgv7WghMPRpaGHOB9lHsb+WNn1rgL4YlBnP2C6RkkkwBRUai+8yIsnB:9RqWVMIloXaB3whjYTnP2fRzhRUai5e
TLSH
T1CD52E62EB814793F5CCAC22AF9527B67E7F5103225942E48EAFCCA2C15E75CC621740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 da03199c77379c7228617a47d909c32813ddcf776b2884d345c98f92f7384941
MD5 ea0a911dde4aa9016f10263c79ee008a
SHA1 a20281dc9430c70dbdc01ee30191aab5294b00df
SHA512 e8c451066d39195c9344caa2ef74e793525584313f6bf1e70eb7130db3bfe7050ccb79f60cb733a4b76abf37844fc854d9b9cf248badebd7fec0c9a2be9f2e18
SSDEEP 192:9RKWhXVAjIv7WghMPRpdGHG9lHsb+WNn1rgL4YlBnP2C6RkkkwBRUai+8yIsnAUp:9RKWVWUloXl3whjYTnP2fRzhRUai5e
TLSH
T14052F62EB810793F5CDAC22AF9527B6BE7F5103265901E48EAFCCA2C15E75CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7575bcd86c4eea805b9647a69a6eacf66614eced5e7895b27fe740453e64dbdf
MD5 b9f0a92d07b224eea5a619c1cb57e940
SHA1 16cb9a7b28765c7001f194643464781000d7795c
SHA512 9bae6f32e3e9886727aad69019e62b5633c9f65c3d67b6d199235765d60c29af8d005566b39f2aeefc2b08051b483794c241efa9e59a35b9d18c6f482076f638
SSDEEP 192:9RqWhXVAhqv7WghMPRpaGHth9lHsb+WNn1rgL4YlBnP2C6RkkkwBRUai+8yIsnAq:9RqWVMmloXr3whjYTnP2fRzhRUai5e
TLSH
T1D752E52EB814793F5CDAC22AF9527B67E7F5103225942E48EAFCCA2C15E75CC621740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 880683a40aaf1a3d35e8f238be3b28649ad310bf3c01c2c2b358554c91ee1359
MD5 c4f44abe095390f3922b6f2a78277ea8
SHA1 598b470b6b2dfbb558638b9193a6f2475eb61d63
SHA512 7fbb28e6dca5a158a7b1eb41bf5588dedd90034bf5d0a8990131c7bc2a31ff33d56e6a0c35f2c616564c83217c83c216f9ef63dcabdfafb0d19d7a1d23071fb5
SSDEEP 192:9RKWRXVAj8v7WghMPRpdGHG9lHsb+WNn1rggPmuBnP2C6RkkkwBRUai+8yIsnAUp:9RKWFWoloXl3wh3mWnP2fRzhRUai5e
TLSH
T1E252E62EB810793B5CDAC22EF952BB67E7F5103265901E48EAFCCA2C15E75CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 434dfd5c97a16431905fe223d3927a11d6531122c270c2f6613b20a2bb9b2556
MD5 f5e89645c8bcd0b2154971e053a1e134
SHA1 2ec0d689e81c164b5b371b773f7d8c550bfe5bdd
SHA512 116ed2082329cebdfb55bfd8c1287c2b41a506748c9fcbf398684c27b93ddc8b099e7d513f4318ecca829149cf7be334d67ce73da147f67391900deb0b199299
SSDEEP 192:9RqWhXVAwCv7WghAPRp2R9lHsb+WNn1r0/sBnP2C6RkkkwBRUag+VyIsnAUgtaJ:9RqWV5Ol8XG3wh0/gnP2fRzhRUag28
TLSH
T1E342D52EB914743F6CCAC32AF9627757D7F5102124942E48EAFC8A2C15E75CC632740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1edda283b473b905a91fc671833be398413cf53e20b74a406af463be7968f762
MD5 1c21a8b8a7f957a1bccc0fc2de6d9604
SHA1 6460f77a9cb5c9e58e382bb63ae2e8a74b42d2e6
SHA512 61260cdc707837170c8505f9fc7fe5f5a40c7a8a68cee5ee26ae4a5ad7ac2f11c6c1e777c64eaf086764ffe20f2af76dd9eef920387fc3790ffc10591ac0b7db
SSDEEP 192:9RqWhXVAhCv7WghAPRp2GjP9lHsb+WNn1rgrJ2hBnP2C6RkkkwBRUa2+VyIsnAUp:9RqWVMOl8XT3why23nP2fRzhRUa22e
TLSH
T13D52E62EB914793F5CCAC22AF9227767E7F5102225942E48EAFCCA2C15E75CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bed0f8e012c0e6e0db3013be3a40b492ae0a8c422188c15e0f18f387a286752a
MD5 3c9248360617a80f83e4aafcda7b1bd1
SHA1 2dade3fcd2c1d3db669130f573cbdb7cbd61c783
SHA512 69e77def3a5b308e1e02054670f4f665a9235898e9dbd029482881d047ba532400cf0686a7ca4c78b89ece7c02b1289a513d8d473163bbd378bd9360c2b26db5
SSDEEP 192:9RqWhXVAh6v7WghMPRpaGjP9lHsb+WNn1rgrJ25BnP2C6RkkkwBRUai+VyIsnAUp:9RqWVMWloX/3why2PnP2fRzhRUai2e
TLSH
T12752E62EB814793F5CCAC22AF9527B67E7F5103225902E48EAFCCA2C15E75CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 eead3548a15610f890614edfbafb1eee3b1eda1e8f4197f56d12c4e978140826
MD5 27a450d12449cb727e9ec769e3af752a
SHA1 5dc6334dcba2f5f3de7f71cd413dbbf27bcf3c4d
SHA512 52d9863068325f04686c67565f1f3f0bf6990331b84a27db2b4360b5dbf43a9c0661557ef430a78c49aeb3c61470c3f943593711fab62e6d9398a2c6a07711d2
SSDEEP 384:gGj8D7KxkXqKf/pUZNCgVLH2HfgslVM7pLuLcifOPXOD8/+ErU39nHG4F5KvB4tG:gm8D7KxkXqKf/pUZNCgVLH2Hfgs7M7pj
TLSH
T1FB7208676C4C9D3B0F94DACCCC167A4FADB5024B61E98C6883FA982503D5ACB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 911ab65c778cbcd362f6220af4928021f0bba31172231c2d8f07f1bbd001cbca
MD5 2e08e805423cca22b111e811512bfa0e
SHA1 7175f40fa8c38f7205112af8835b0be93eea9cf4
SHA512 4c4c830a9b36a1101e29c6d91597b180e3c620c8a5c2f382d22293d452981a1fdb841c119d3954d91810f862544bf94e9cb70513af0f9ca1d232cb9535580054
TLSH
T158B012B084015551C44702F5518664CC3764DF1087052301D3E46D71982A9A04114261
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5857c0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5857c0.TMP
Size 96B
SHA256 1dd13859745b2d8b6c0187b5f3a4975d2662c21987742f8aa07ad0dbfd86150e
MD5 2b74f597c661205aaea189deec310082
SHA1 2e697a9cb8c6daf8e1da8a14ccb83d6a868d1e5e
SHA512 493147441f35af221c536a58d38a4067ca4462cca9cae1f906bc6ae440d91d3783109bc1a19939aa11b824e830daee9e81fd7df9fd434d9de5d3b63b4970ea80
TLSH
T14EB02232C0032223C22203F0BC80F2E8B020CF30C2230202A2F00F22EC382B002202B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 b47823d8dceb069f130f38401b91d6cffe90c52adcf825a35c0efe9d7fb46c10
MD5 89416641a6e96a11a98669657a8b09d8
SHA1 8c34187e3e8e70b0b775e219a2fdb2bc6a3ea607
SHA512 31d75ba869360d13cd3f1d3b7474f75676adc4d507598e9ae04c67571f7bbe8dbda4b1746aaeab1b6267d56f8e5dfcff1b49855de6e16096db78499da903fcde
SSDEEP 6144:ivyIfzna+DALOQhYifeO6ZZwINsIrS2uB2v:ifzna+w9Ki9upNPS2u0v
TLSH
T17A1423A73EE9CC77628CC10DA63D2D0DA6D1D4A2C49CBB57464A577F19F9A34270320B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 23898416a28f09e0f32bde2d482fc31decc941edda4100bac9fc53b2351e3dd5
MD5 d967b019d4e876bbadf766452c2fdd9d
SHA1 fc6b278827ecdd1ef6d8b6c7a597c50fd1d21830
SHA512 5ec16034626546cafd7c1cdf7d3f417065289e92adb1618c476cd7d5a4424f353b08de34e3d2d8617cf53b1660505b7253b55235fb0fc2b4ce295365d9b17a42
SSDEEP 6144:MryIfzna+DALOQhYifeO6ZZwINsIrS2uB2v:azna+w9Ki9upNPS2u0v
TLSH
T1F01412B73E9ACC7B668CC00DA63D3C0969D0E5B3C49CBA16954E676F19FE9341A0310B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 6500460946c794ccbe704161ac0200ce554dcd733654b194339eab2dcdab890b
MD5 257cbf95520c309cc17a8e6679a85653
SHA1 f2c57ac2475775f769157d51d197d3c5dd8e5217
SHA512 135f2c4ce224947129c5ba7de1849f55e3230080bd74174e8c9a1d319fe26715e888acb9a1754f8bd951a6d4b1ea69203a2bf017b3d51feee93cc7cb3f88af04
SSDEEP 1536:IAKWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPr:nDlBshIZZwINsIrS2uJBLpAkLQqr
TLSH
T18B9302B73EA6EC77C49C4102B93C2A4D6FC4E5EAC818B66559CA277F41F1BF99203502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 43235f3f5c28e4dbbb9ca0ef18859e03f1c6f126b1e1481fa54b95877dc233f7
MD5 585ad4a4ba6d9cb17a4681ae11e04fb9
SHA1 9bdc6213ea32715c7c6649b628f8bc9b4be3cb0a
SHA512 71376d6b24f5495756310ae03bb19d3a1ea66317f32e381f63bb15edfdb0cb8d41485347ebef7eba9adddb90c48c43e5acb1df86cf072680062dd3a07e4fba3d
SSDEEP 6144:jvyIfzna+DALOQhYifeO6ZZwINsIrS2uB2v:jfzna+w9Ki9upNPS2u0v
TLSH
T1041423A73EA9CC77628CC10DA63D2D0DA6D1D4A2C49CBB57464A977F19F9A34270320B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 6f4c56962a5790f37d00fb929deeb553a23b27fe85f073037514df13bd4f9fc0
MD5 e5027974464759abd7b60cbaf3d9fee6
SHA1 fb1d47aa5cb6d58462406ece7e38c1fcc2c46d65
SHA512 96239b209ffdbea54f69d7915f6a5109503c5281a56948134258323d6616dc003919556a269136ba1d8a5ce14adf8b63f77329eacce163a7f2547eca0000b0ea
SSDEEP 6144:gryIfzna+DALOQhYifeO6ZZwINsIrS2uB2v:2zna+w9Ki9upNPS2u0v
TLSH
T1991412B73E9ACC7B668CC00DA6393C0969D0E5B3C49CBA56954A676F19FE9341A0310B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4744-42-0x0000020625220000-0x000002062524F000-memory.dmp

Download