hxxps://0thefallenangel0[.]itch[.]io/dark-of-hemi

Analysis

user interaction
yes
max time kernel
1800s
max time network
1799s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/05/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://0thefallenangel0.itch.io/dark-of-hemi
Sample260524-v2v2aact7r

Score

3^/10

discovery pyinstaller

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000200000002380d-250.dat	pyinstaller

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
864	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241173854830070"	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{D8F1766C-C925-4FF5-A842-355447CADF54}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
944	chrome.exe
944	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
636	7zG.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
684	7zG.exe
4392	chrome.exe
4392	chrome.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4844	4392	chrome.exe	89
PID 4392 wrote to memory of 864	4392	chrome.exe	90
PID 4392 wrote to memory of 4380	4392	chrome.exe	91
PID 4392 wrote to memory of 4380	4392	chrome.exe	91
PID 4392 wrote to memory of 648	4392	chrome.exe	93
PID 4392 wrote to memory of 648	4392	chrome.exe	93
PID 4392 wrote to memory of 3940	4392	chrome.exe	94
PID 4392 wrote to memory of 3940	4392	chrome.exe	94
PID 4392 wrote to memory of 4352	4392	chrome.exe	95
PID 4392 wrote to memory of 4352	4392	chrome.exe	95
PID 4392 wrote to memory of 684	4392	chrome.exe	96
PID 4392 wrote to memory of 684	4392	chrome.exe	96
PID 4392 wrote to memory of 1724	4392	chrome.exe	99
PID 4392 wrote to memory of 4888	4392	chrome.exe	108
PID 4392 wrote to memory of 4888	4392	chrome.exe	108
PID 4392 wrote to memory of 5012	4392	chrome.exe	110
PID 4392 wrote to memory of 5012	4392	chrome.exe	110
PID 4392 wrote to memory of 3424	4392	chrome.exe	111
PID 4392 wrote to memory of 3316	4392	chrome.exe	112
PID 4392 wrote to memory of 3316	4392	chrome.exe	112
PID 4392 wrote to memory of 2600	4392	chrome.exe	117
PID 4392 wrote to memory of 2600	4392	chrome.exe	117
PID 4392 wrote to memory of 4104	4392	chrome.exe	118
PID 4392 wrote to memory of 2476	4392	chrome.exe	119
PID 4392 wrote to memory of 1952	4392	chrome.exe	120
PID 4392 wrote to memory of 368	4392	chrome.exe	121
PID 4392 wrote to memory of 368	4392	chrome.exe	121
PID 4392 wrote to memory of 820	4392	chrome.exe	128
PID 4392 wrote to memory of 5840	4392	chrome.exe	132
PID 4392 wrote to memory of 5840	4392	chrome.exe	132
PID 4392 wrote to memory of 5896	4392	chrome.exe	133
PID 4392 wrote to memory of 5896	4392	chrome.exe	133
PID 4392 wrote to memory of 5980	4392	chrome.exe	134
PID 4392 wrote to memory of 5980	4392	chrome.exe	134
PID 4392 wrote to memory of 5084	4392	chrome.exe	135
PID 4392 wrote to memory of 3688	4392	chrome.exe	136
PID 4392 wrote to memory of 5084	4392	chrome.exe	135
PID 4392 wrote to memory of 944	4392	chrome.exe	139
PID 4392 wrote to memory of 5368	4392	chrome.exe	140
PID 4392 wrote to memory of 5368	4392	chrome.exe	140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://0thefallenangel0.itch.io/dark-of-hemi
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff08e5c728,0x7fff08e5c734,0x7fff08e5c740
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1928,i,10663161108968490650,18112481356225887964,524288 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,1542787068069401769,11011181512215859139,262144 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,6940960593077485360,10029110779741824102,524288 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,8179101368758509049,485382720078060219,2097152 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,11077480163801837120,16947661820531305107,2097152 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4392,i,2656293329414867715,16451458672436869638,2097152 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,8373831467421441099,18350651354527349843,524288 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5712,i,17864072035554459658,9840922967533773841,2097152 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5964,i,11432512240667604298,12091445374089781287,2097152 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4456,i,2360545365016148511,2996747639254551227,524288 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6040,i,12778624329838233008,17329959349193462907,2097152 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5452,i,12115899084275295441,16974007531034364455,2097152 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6316,i,11188895081668793135,2024489372984436525,524288 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6320,i,2159909270934675932,2105548303315296596,524288 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6324,i,2382921214467451128,17821061500236241976,524288 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6008,i,5296384947883539043,669780362324093249,2097152 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,15372239824089997911,4890400398267279535,524288 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=728 /prefetch:8
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6116,i,3018376890883460643,12936729612405560514,2097152 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5792,i,9536494229437790414,7750181609275516046,2097152 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6388,i,14879030950311623092,14764277819088330172,2097152 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6664,i,6062444159939660515,13387024588900451620,524288 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6616,i,5900259797976340143,7493175605117686727,524288 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6760,i,15057747172050651739,15873998454877370906,262144 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6988,i,7036334426786996017,2287915765681206643,524288 --field-trial-handle=2148,i,11908744688543459153,17752033124162965883,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  PID:5368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1504

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\DarkOfHemi_v1.0.1\" -spe -an -ai#7zMap20725:96:7zEvent27656
1⤵
- Suspicious use of FindShellTrayWindow
PID:636

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\DarkOfHemi.exe_extracted\" -spe -an -ai#7zMap26766:110:7zEvent30078
1⤵
- Suspicious use of FindShellTrayWindow
PID:684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 39f188b782b9b1518c93d8c3cc617d4081ddab25ef130bf9c1abfb01e13fbca8
MD5 25c3619e14518e81f7bb5cece0005a8a
SHA1 723fad4562fed3e824144cb8e2aa968a5ed9fc3d
SHA512 1e895c1a967a1e2b1fcee2cffd5fd104964c27ea769566263b10ce159793979a1db7acc51648183a69c18894f6569cd10e18871298b009e55414d66c755379b9
TLSH
T165F0F9AAC821AC3718FD1B6930545747F795131B3B90885F3A3E830D8FB5A3B855692C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 a68e4aa2513111a3b190296a808b19d029894026d420633cc2bcac5519fdd035
MD5 c0c1e08a6a4d08663fdae55607193da8
SHA1 af605a4c5018465765278579373086554d4c861b
SHA512 46efbf4c3e7fd95a37578e9be20ccc5373050d4d2e13ae45ea24b2ef52ef309a9b955401f70e47c8bc9d4792add9202063b7f9bef15c6021b702ad05d65129a9
TLSH
T159E0C2234EB11042EB50247A1A5528842C7416A98D4727FB8390201660333B773C3F36
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 a4e3a38a4fff4f880cefcfca059e53612e56bcdc9f74d9f26a83064394eb9f32
MD5 36176706f88fe69cc3aca2e0e6643cdb
SHA1 978c4459f6a36e969ef266651f4e4c86f4ee3652
SHA512 73bd101ef67d77b1df009f517638b6fcd1aa6b6dfdf38c4eb99e022ffe41aaffb24780ae85daa33adbe64926d28b1e7202dd50c18b8d66fcf5ee8acbf9f7afad
TLSH
T1C9F027228EB01C82EF90187725A92EC1397119549D97AFF76365282624233A767C7F3B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 959ec83e0be21ab4c62e25e877b1bb9741d5b14c3d3465a64918bd59eacf77dd
MD5 3f271b308a6cde2ab6c215b24afe1380
SHA1 2a2e1ebec7349c15b50cf5844a709c3a23443bfc
SHA512 4a7a6171c96d1e71138f4f1537a72adb9e99ed731632bfbc8418e169d6aa99b6df8127e8eede53814cce496b45ee3bd72511c2d349762d9e3fb7fe00e08085c7
TLSH
T143F0E5229DB01842EB90047755A42CC02D711988AD831FFB6361342210233A377C7F37
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 2a094b170c305e95bebae6c58cac49f483e30eeb86a727106c509b275172750e
MD5 5c027c99ab5fbe44960f59cdd1d28b6f
SHA1 5f9a927b82a60e3cd3007bc1227ba5c8b2d250d5
SHA512 8dec3254ac61fbc2119290023f9f13db83ec66d2a1308a50580253598251c77cb913370a0afa75c0576ffc68f9e9f3267c7faa79452f4f6871f9f626bc9267af
SSDEEP 192:D0jCJj7T87OQNDeQKE9O3j+jXjhjhzjhFjhgjBbjwjtgjwG4F7jKjjjAIjqjVjgK:D0j6j7T87OQNDeQKE9O3j+jXjhjhzjT1
TLSH
T1D122ADF3C3E8892DCD1152F5BA152E2BCD290D55532C3D56C9E9EF4BA3E2871E24094E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 002775a621cb2222102d063ab194f0fadba38c5a8e9b27a1549c3a693ba32269
MD5 f4c7e06db14ebd52397850c49ebc3a2d
SHA1 e6ae1f48ffc39fc0776d049f6d84535b831e2434
SHA512 916d3aeca40b354d3ec8bdd619411b718ec7ababc5a36c07c2dad66a63cfd2fe6273ccbf0e8233ce719aa076591ff04e6a30a2c923aa234aa032646457a2e7b7
SSDEEP 192:DjbJjvkBh1mNLehbNqNE9O3j+jXjhjhzjhijhqjBbjwjtgjxNEd7jKjjjAIjqjVA:DjNjvkBh1mNLehbNqNE9O3j+jXjhjhzv
TLSH
T15B12ADF7C3F4896D8D1152F5BA156E2BCD290914432C3D66C9E5EF4BA3E2871E240A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 b662c315ca45dfb67d99db880fae974e9b57619adcd6438534964fe5c595e16a
MD5 febca87dcb08c3d590fd68dc94d24186
SHA1 dc90c752c0ec6c5ea7463866b787ae9921907fe5
SHA512 f7fab614fa751bfd4ee9d186e6e5336120bcf2e5476b340fdbc558385a2c9f2b666f29bbed405e6cada3f65c4a2f2d6e36152302153dc42758c1d657314a5552
SSDEEP 192:D0jCJj7T87EE9O3j+jXjhjhzjhFjhgjBbjwjtgjwG4FcHjKjjjAIjqjVj0:D0j6j7T87EE9O3j+jXjhjhzjTjajpjw5
TLSH
T1D8E1CEF3C3E8452DCA1256F5AB153F2BCD290959536C3C56C9E4EF0BA3E28B1E25064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 8783bcb9ee7fb3ca271ef0fc894a697ebeddd7908b88c9097e0aa3be67628bf8
MD5 d24bddbbb2fa65cf897a780b0f6aac4a
SHA1 f5f0e855f3dc63b234ef2c69594fe1899a6c83ce
SHA512 63cf721d61562bcd7d6eed91708bfe142b13552207d2ae71547e7d872a56b94ad0787e10da22875b790d0f7bf01c21a2eb584742e9165c8c7d8b908bddbd6946
SSDEEP 192:D0jCJj7T87OQNDeQ4OE9O3j+jXjhjhzjhFjhgjBbjwjtgjwG4F7jKjjjAIjqjVjA:D0j6j7T87OQNDeQ4OE9O3j+jXjhjhzjI
TLSH
T1E722AEF3C3E8892DCD1252F5BA252E2BCD290D55532C3D56C9E9EF4BA3E2871E24054E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 afb79a190ee77a54f8e1e8cf3b2ed290e4010c57cec43156c06c0afbb503df27
MD5 29797245c7576432deae7879f79881de
SHA1 5290fc97581b982b9dc8e6b8bae7ae51c8dd1f4c
SHA512 5334689a2b8e05e959b823a34652be9f6e181f958e80262d6c666d57f7c1f7cffdca189f3044cbdd2b9802971efe1d49956bf9a32a4cc8b2bf3a96ac9bc205dc
SSDEEP 192:DHjbJjvkBh1mNLehbUmE9O3j+jXjhjhzjhijhqjBbjwjtgjxNEd7jKjjjAIjqjVX:DHjNjvkBh1mNLehbUmE9O3j+jXjhjhz4
TLSH
T1D322ADF7C3F48A6D8D1152F5BA152E2BCD290915432C3D66C9E5EF4BA3E2871E240A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 fa93a0e21b01bf0cdfced696c988985a3d8215a5fec43a19e86b8bca15afd2d8
MD5 07209aa00a88273368ce1447bf8c1445
SHA1 be7f9248f191a645565a8a134afc309d9177a410
SHA512 b68bd02328c5fa365c9e06470f5e37fc3d910f881b4d3a85e5f22dca9a0cb58b01f4a4d562ed22d6a0f60538dbe9d4e82b2a4f534fb8a5598564bdb1b6866ab4
TLSH
T1F931CEA786BEB86B103D08FF0E04B80D55B7A83651D071F8CEB7856DB0919F72B16067
MD5 SHA1 SHA512 TLSH

Submit Download

bbb20dec-3eb9-4293-9b9c-a8ba6f7bf467.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bbb20dec-3eb9-4293-9b9c-a8ba6f7bf467.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 97346002cc94fc275d4d0ef11e95dc8e7aa88132caade78da76335061f8ca1a7
MD5 ffc2d0ba7e909a9dffa36d502717a142
SHA1 11304fee940398906703b44516ad36c4129d0e2c
SHA512 00cccbe454cabca4b4adbdce7be75da23e72397eb588156a12b80d418168a93775e714742b9390e99734b670b18fd0b5a6db0abd837d71fe6f8c81116c7dec94
SSDEEP 192:4RB57OxXAlv7cpAPRp2qAlR9BHsb+WNn2dqiip2JVUMkwWAVyIsnAUge:4RB51VwUXlArwbd2b2Ee
TLSH
T12D42C72EAE24257B4DDBC21AFA167B53E7F5102235942EC4EAFCCA2C15E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 da13980227fa8b7899a8cbc38886214c37bafb27ddae1448669fe6d5c67670d6
MD5 7bf10874ca6c756bab769ecdbff1b9f8
SHA1 45ca609cb592c4e651060ceac2721534a8adea4e
SHA512 96cd076f6e6eb523b799cb1f5ab7d5438eee215f470c8504fee1182137425f97cfb803edd8fc64acdc04cec854c0b2273b388443a8f25749924528e77d967097
SSDEEP 192:8RBh7OxXnRv7cpAPRp2qAlR9BHsb+WNnRGDi5ecVUMkwWAVyIsnAUge:8RBhABwUXlArwsQeg2Ee
TLSH
T1D542C92EAD24257B4DDBC22AFA167B53E7F5102235942DC4E6FCCA2C15E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3b8659ad4b6e58eff0babfd5c27b4a3ad98e6726a4ec2e6835bff912f1a5e3d7
MD5 c7b509d13e49bcf4594786a3b3a0465c
SHA1 9bd32fcf5d21ff545d9a237a1363168d4829aad0
SHA512 ede1351aa45ff1c8eae668bdb0e3694b6687fd6627920b3ff9263f5f13416029e74d724c094d9b6dca3ee8fd832d01162699d9697c95859b31f23f6b22300251
SSDEEP 192:8RB07OxXn2v7cpZPRp6qAl4T9BHsb+WNnRGDi5YeVeUVUMkw/AVyIsnAUgE:8RB0ACwHX5zrwsQ3eYfEE
TLSH
T19F52C72AA924297B4DDBD22AFA197B53E7F5102235901EC4EBFDCB2C15E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 177a5f6f1ef4251b9d447fa683bb63b4aef8b291b6a60318cf7cf88026ad6a04
MD5 00dd632b92c2371d34f4bff4a403cf24
SHA1 ccb64a6e091c4413b6f8100ad12f05193c6c88df
SHA512 09629a4e2c41c20c2d2c4ad27e66942a3360917699f439897d86751284c09e587bd90fb923fdabd2b663158f4158100be5b7edfa372d687162942cfccb714d5d
SSDEEP 192:8RB07OxXX2v7DpZPRp6qAl4klF9BHsb+WNAtRGDi5YeVaJm2LVUMkw/AVyIsnAU3:8RB0oCnHX5crw/Q3F2dfEE
TLSH
T18D52C82AA9642A7B4DD7C22AF9197B57E3F5102225902E84FBFDCB2C15E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b5160f0e0d63a022d8352578be107d37a2c38788d18f0b76ea00b25b8cb629f2
MD5 320812510479a572675a1d514f8b1f5b
SHA1 e5db694d79ba781ed67d2967630c8077af8bbb59
SHA512 76c5cef042e79fbdbc95acd314b634a6972a2105e5637cfc260d5a4d39f5f9134bf7798d2a028c4a913939a0b11bacac00e4759860ac6c890f142fdf614a3759
SSDEEP 192:8RB07OxXXxv7DpZPRp6qAl4klF9BHsb+WNAtRGDi5YeVa5/YDVUMkw/AVyIsnAU3:8RB0ohnHX5crw/Q34YVfEE
TLSH
T1B952B82AA9682A7B4DD7C22AF9197B57E3F5102225901D84FBFDCB2C15E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1060a62cdf82224a474efe5283d3ba901fbba9db54c4f622d17037dac78c5a1b
MD5 b923e5e758c6072779db0f46d3775659
SHA1 2c7d019340660a53c88cbce01f0e90f3a940dba4
SHA512 3969d928362c503ff061d89f5a1fb0ed3ffdf80aa58558f0b3093ad4222de2cfdc8f5fda3b3d7a322a8027b145b97b8076534b85f18a8b897b9f6dd7db2aeb0c
SSDEEP 192:8RB07OxXnRv7cpZPRp6qAl4T9BHsb+WNnRGDi5YeVeUVUMkw/AVyIsnAUgE:8RB0ABwHX5zrwsQ3eYfEE
TLSH
T16152C82AA924297B4CDBD22AF9197B53E7F5102235901EC4F6FDCB2C15E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6a6751acf4402cd106bea3cf07d30182ee8cd7b585660b75bd8235434eba3fbb
MD5 146b07d433213523303aa3eeeb6c1f70
SHA1 f9283df937988d46faddf6a87277604e927ac7a3
SHA512 a342e251e7794e3dac7474533f8a42a9381d8b5d64df343d221b3c6a22020feb9a8449acd523c7ae1bdbefbb0315b81653cf1c5a2db279f38c37be8854f6c3fa
SSDEEP 192:8RB0nOxXXxv7DpZPRp6qAl4klF9BHsb+WNAtRGDi5YeVa5/YDVUMkw/AVyIsnAU3:8RB0EhnHX5crw/Q34YVfEE
TLSH
T14A52B72AA9682A7B4DD7C22AF9197B57E3F5102225901D84FBFDCB2C15E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5af0717230a4e27292c907362ff4b44cc56857a519596c13e2e7c37c10727144
MD5 a1183d66e7162b7ea52e31c316155188
SHA1 f14b5d4bb31d7f6649a8d81c7b99c6822cfb897a
SHA512 12d6170e88d79a77832699f4a276afd2888ee014dcd6ea0764882084df0f919b20c85ef086c44ca57ba7129e314498c4616cf4440e858a3a2c4a2465a2fc5f62
SSDEEP 192:8RB0nOxXXtv7DpZPRp6qAl4klF9BH3DHsb+WNAtRGDi5YeVaPUg1VUMkw/AVyIsv:8RB0ENnHX5cLrw/Q3Vg/fEE
TLSH
T1D362C82AA9242A7B4DD7C32AF9197B57E3F5102226901D84FBFDCB2D15E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f845e632aa95cf746168a84a1f808f28ec504e4c9c343e1ab0748a50b29f0763
MD5 a6609295fe8fb3a6ac1fe8028e6b8e4f
SHA1 0e55c4289a93f23ec4c0c8ba6c4f896020d2e2e6
SHA512 a2eba54cd9eadf5e1f1e3653787801ced67222fb489d0b8af49e634b88ef67189fdd9e7752c32788d834872762fc6156c8a427e93981a9715110d1e59ee0b06f
TLSH
T1A8B01240C4015153C04703F41143548873549F20AA0A170283E07A2288291A5C615060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590e3f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590e3f.TMP
Size 96B
SHA256 2f1913a2a48a689a6cbceacef3229e044858fd354632473cc453f19220ffff03
MD5 936f6a9291bcf6b622173285e5741810
SHA1 c399b9a446a4d11823759e20e9403c88a782fc5e
SHA512 25d053a2e6511e8f112ca70813cd2a63e20e509728b378dfa614f2f4a6fd900cc6f0b268f62794c1a2e9e388d5f9c67ead4252ba620632024c0891dfef526ff9
TLSH
T1F2B02202C2022323C00203B0288CB3EC3220CF20C3030332C2E02AB2CC2A2A00030230
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 152B
SHA256 50a9010e1dc71fabc916713925c8f9c9198753916e704015b1672a322fc80331
MD5 461f3971edc074f98b420868c80f4f74
SHA1 2ddc0c0a58d87fc7bfb9fba6781342240332548c
SHA512 0b581ea3d9efa98d1bebaab506acdea3850ee442645e46e10cca72631c06f2525c418d6887b45f11c77171bd80b8425f0f2cbbe874b8547a89bf8312e29edd18
TLSH
T1D9C08CE304289A9AA730ABD820F83B2CC12FC5898CD0CDF4C40AA0A220348124C43674
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a9924.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5a9924.TMP
Size 159B
SHA256 e26d73f4de697baf49ab580d1f9462f0acb25b945d606ad1be1c56c2e89d8b1f
MD5 f6f24cd0502c96fb75c9b32150c1ba8e
SHA1 4e4672aa9303512d9e5a644feb54f1433c11dcf1
SHA512 e6c6e071e95a906755ee7e61ce30f60107c95072e866d7bbe963d47b499c72ff2e8a2d5676a50196b809c7662afbfbb4e892ea4fe0c4261d1f1e264931235d1c
TLSH
T1E6C08CA304288A96A7306BD420F83B1CC13F8C8A8CC0DDF4C50BB0A220348128D42670
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 da99277d870b7980f8e2ffd60b0c5f48bcaf858ab884386c65a93920f11b3976
MD5 b61ddfe8a538e1ff358e63f7c572a054
SHA1 dd2dcb330ea830515e8f38c11900a4df32ad310f
SHA512 bf94e688d8de9350d9362afc14c008282ff88195459c070d45a14e632f97b8474b00dca135fa21890bc7374004f43bbc81689ed4701a08c029cd72b90c569749
SSDEEP 3072:S7FUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:SFmUi21rSm8uUVNSlzY/
TLSH
T16EC313007AE7F8B2EF99304476EE2A159D680D818291C54157739E419DEF3C62FAAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 e11cd987682b6121c46eb72e7ef439565140c653b1d36b4ce5a6bedd367919c2
MD5 38613d3ce572b4df6a9678a80ae5af5e
SHA1 7f98747e335fa60d68c7facf32f334604c1f85ad
SHA512 4bdeb0488ff3b11581d50d1cf590f0b1b13aceae20087c0bd6f621696455b1c5197aa183e99f71d6cdf57c6a2df705033fe9fb3d06fc19c9be9943da6dc1bb62
SSDEEP 3072:SShFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:JhFmUi21rSm8uUVNSlzY/
TLSH
T18CC31210B9A7B8B3EF9931447BDF2A145DAC0E418290C50156739E415DEF3C66FAAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9e66cfa5cd3fbf25ab53925e226d40df8abd6438c63690cbc18b675b85361505
MD5 14503eb0c9bf5f3e2b60e8695a94a783
SHA1 e446aff2969d07e0ec392f2ab7509dc03ae5ef6f
SHA512 e3013cf65ea25a1e39a67692419d4749e070134266fb2bae9c119357eb9b69b8e3ffffab78607c7a399d13e998fd8c77daf35da869c38ff006ac6424d130d1a0
SSDEEP 3072:SSFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:bFmUi21rSm8uUVNSlzY/
TLSH
T1ACC3130076E3E8F2EE5930447BEE2A145D6C4D818291C64156739D419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fb64090c216389f11c6d5dfb4edf07f60d419c64b384a0da06360c62bcdb6737
MD5 ebf35510af8791419650470f1f9c18c7
SHA1 3ae4acf496db6b261ffa60a0f55db0ac59f6aa24
SHA512 51e98d9cfc648fbaf9f526d6b381abb9e2d663c258f8108baf96d2f3863b617a78f88d160ef4eebd00c0a6e268b9bb385e24e2c9806f686b79000c55a30df701
SSDEEP 3072:SwFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:RFmUi21rSm8uUVNSlzY/
TLSH
T1D3C313007AE7F8B2EF99304476EE2A155D680D818291C64157739E419DEF3C62FAAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 47e9b795f85409fb4f6bcf4d60e625e0e7e95d3c29d827d9be4a8ccd4c38aeb3
MD5 5448c327377e0d43a2e020795775dfca
SHA1 5446be07067d299ca1c9c37a11c33b71acf04477
SHA512 81aef8a7dcd7373adfa6a5ae4560503d42d68a26a9bca6900d89c907dc13400683ef50094a6f6c998901c886275e189a032099023e341d25ebd7ff035b81a246
SSDEEP 3072:SihFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:5hFmUi21rSm8uUVNSlzY/
TLSH
T1E7C31210B9A3B8B3EF8931447BDF2A144DAC0D418291C60156739E415DEF3C66FAAF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4f3bbdc-03a0-4eba-a597-2b92cc1b3a69.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e4f3bbdc-03a0-4eba-a597-2b92cc1b3a69.tmp
Size 116KB
SHA256 f1cc8c7afe3531d2bd41a55562efacf70a101314ef90dd34aaab41cf8cb7127c
MD5 fff2c7a04698508a1b0384b356e2c62d
SHA1 9d106af1879776447f57ceaf8b82f36a06c76e25
SHA512 d8c0f9cf99f9805594a2fbc3e22ae0adbff280e29b841639660ff79cd6cabc1930c000e765109be1bed770db42788eaf76371b7a7c057804646ff1993e205e8f
SSDEEP 3072:SIFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:PFmUi21rSm8uUVNSlzY/
TLSH
T1CCC313007AE7F8B3EF99304476EE2A159D680D818291C54157739E419DEF3C62FAAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DarkOfHemi.exe_extracted.zip

Path C:\Users\Admin\Downloads\DarkOfHemi.exe_extracted.zip
Size 18.4MB
SHA256 3803071a65ee8e84ba233ac7b4464643ecdec9cd1fb0c3770f881ef065ca0c1d
MD5 6433c191e7c61bf1206713a9878c334e
SHA1 82c0d16878a8c300a48f972296fe4f4a22ad5c73
SHA512 7d80982f1a9ed1f9e2545414bc8917e23a43d6480308d675ab4fdc72c8d2ae95118d0d21ca78ccd5f5b72697dd54786f1c9c5abbd400c80cd71d3024e3854053
SSDEEP 393216:HiG+u6fb+SJ8aqq1CPwDvt3uFhCACCX7zyBXDgSu:Hi0uXDgSu
TLSH
T1CD176B0576958076E867F1788853464BE371BC227B2083CB30AEB26D2F777E15E796C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.pyc

Path C:\Users\Admin\Downloads\DarkOfHemi.exe_extracted\app.pyc
Size 92KB
SHA256 692bdc862bec06d055a88b8fa8687f7aac21e8ab5b972a586fa51a22cf50f56d
MD5 8eb342ee2b2cd0fd6343911f29d0a508
SHA1 99493b2e5c6295dbbf12b3d099187d08c5d4b113
SHA512 4447c5b34a2a6abcb34f3f3f98e48fe1b6ba4717ed57ded4a193a90aeff53c169a18e1d7b35d317a67fa477d4ac92e6bf05f6c8e58c32c87aac02012b3d6d92a
SSDEEP 768:xQEK7r3eWzOcqMTHkrSrhfkgNJHnAj0V6gwfUzz87tZbi2roMFClApNHj2C9hT7C:xQEKPqa54QV6AMPbicBYo2JKve
TLSH
T104936084B7A2C17BFC94F9B444A52B9BB671A572B202C30721BBD0B13EA7365AD510CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DarkOfHemi_v1.0.1.zip.crdownload

Path C:\Users\Admin\Downloads\DarkOfHemi_v1.0.1.zip.crdownload
Size 7.1MB
SHA256 b3e3be064788cddceb0479ddab6b4a68a67d1aa9bac066a45a1ff5264d2a7653
MD5 93b549778aceca0e42074a696eafaae5
SHA1 de62aa72406cbdfeb0d9a3afe36d51f156f537b8
SHA512 2cf87269a47c9c6cf567e7fe7b43bd10b3502f656c5a19711b25207fa87c589925debb657d4db046c13b4261c2b3a64f928531b1e27fd5d4361c53938a2d9b71
SSDEEP 196608:Stao/8PVZFkau1HJ+S3VNZOXnD/uLK70Xrqu:St/0PjuayHJHNc37k
TLSH
T17D76338863B79AEDC43A5371B1D20DAA6DC6C8CC77B3CB829A3915E75F8A14744F1870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DarkOfHemi.exe

Path C:\Users\Admin\Downloads\DarkOfHemi_v1.0.1\DarkOfHemi.exe
Size 7.2MB
SHA256 9a38df0e95afbb5a38349c02cb0b7554e08616b77365359a7ed2b09e750e8fe5
MD5 ff67f8a2fef906ff6bc721777b9adb25
SHA1 668581c202f3eab1b2ca5e3f17697e1cd89c2fb1
SHA512 f028ab3f79d542fe9855df89212c208e4c90fa8d9659d27c8a57bba9a04a4646da5e46fd4a61d9c502d72dd0a64c2851c07a82ccb1a45fd211b124218d8229b0
SSDEEP 196608:XARAA1HeT39IigDvKub75bcjWgbkzfK5kjKBl+:G51+TtIisvB5IjWqkz7
TLSH
T15276338473FA19F9E9B3423896E2C587EE71B4855772CBCB03B811D21F172924EB6760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download