ce6a97c8c8a0fecb1383bd4a6e7ccc7812cd17d06bf0a5a9724f45853469dc6f

Analysis

user interaction
yes
max time kernel
177s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lua_injector.exe
Size 271KB
Sample260528-2gexwsdz6z
SHA256 ce6a97c8c8a0fecb1383bd4a6e7ccc7812cd17d06bf0a5a9724f45853469dc6f
MD5 f43ec27f26dcd3c837d4a368a47ba92c
SHA1 529843c158b0ffc408a166a44c436ac18c671acf
SHA512 2910fd0d11a584468218cffd2ed65ad01687a8582965acb35385e75bc70fe6b36ab8cb300cb5c9bc3735c491c552edc951c4870f7dbb327b363f1258315819c3
SSDEEP 3072:qPPp3FUakwxXNE9ymmQ7Oaqrae+jkrc+TsB1UQULx6mwDcFW8ujr8ibjHbXOxWyJ:iB072rnrlwB5XrbjHgZ+FjVOtsc
TLSH
T122446C85FBC6ACEACA161235899F43793338F7D117879B170D29B2381E236C1ED86647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
174	3756	chrome.exe

Loads dropped DLL 1 IoCs

pid	Process
4376	chrome.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
145	camo.githubusercontent.com
156	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3756	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244812303240066"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1280	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4376	chrome.exe
4376	chrome.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
340	taskmgr.exe
4376	chrome.exe
4376	chrome.exe
4828	lua_injector.exe
4828	lua_injector.exe
3748	chrome.exe
3748	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	taskmgr.exe
Token: SeSystemProfilePrivilege	4136	taskmgr.exe
Token: SeCreateGlobalPrivilege	4136	taskmgr.exe
Token: 33	4136	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4136	taskmgr.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeDebugPrivilege	340	taskmgr.exe
Token: SeSystemProfilePrivilege	340	taskmgr.exe
Token: SeCreateGlobalPrivilege	340	taskmgr.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: 33	340	taskmgr.exe
Token: SeIncBasePriorityPrivilege	340	taskmgr.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe
Token: SeShutdownPrivilege	4376	chrome.exe
Token: SeCreatePagefilePrivilege	4376	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4136	taskmgr.exe
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4788	4376	chrome.exe	109
PID 4376 wrote to memory of 3064	4376	chrome.exe	110
PID 4376 wrote to memory of 3064	4376	chrome.exe	110
PID 4376 wrote to memory of 3756	4376	chrome.exe	111
PID 4376 wrote to memory of 1244	4376	chrome.exe	112
PID 4376 wrote to memory of 1244	4376	chrome.exe	112
PID 4376 wrote to memory of 2584	4376	chrome.exe	114
PID 4376 wrote to memory of 2584	4376	chrome.exe	114
PID 4376 wrote to memory of 680	4376	chrome.exe	115
PID 4376 wrote to memory of 680	4376	chrome.exe	115
PID 4376 wrote to memory of 4752	4376	chrome.exe	116
PID 4376 wrote to memory of 4752	4376	chrome.exe	116
PID 4376 wrote to memory of 1868	4376	chrome.exe	117
PID 4376 wrote to memory of 1868	4376	chrome.exe	117
PID 4376 wrote to memory of 5064	4376	chrome.exe	120
PID 4376 wrote to memory of 1776	4376	chrome.exe	124
PID 4376 wrote to memory of 1956	4376	chrome.exe	125
PID 4376 wrote to memory of 2636	4376	chrome.exe	126
PID 4376 wrote to memory of 2808	4376	chrome.exe	127
PID 4376 wrote to memory of 2808	4376	chrome.exe	127
PID 4376 wrote to memory of 4192	4376	chrome.exe	129
PID 4376 wrote to memory of 4192	4376	chrome.exe	129
PID 4376 wrote to memory of 520	4376	chrome.exe	130
PID 4376 wrote to memory of 520	4376	chrome.exe	130
PID 4376 wrote to memory of 3480	4376	chrome.exe	131
PID 4376 wrote to memory of 4280	4376	chrome.exe	134
PID 4376 wrote to memory of 4280	4376	chrome.exe	134
PID 4376 wrote to memory of 4412	4376	chrome.exe	135
PID 4376 wrote to memory of 4412	4376	chrome.exe	135
PID 4376 wrote to memory of 3748	4376	chrome.exe	136

C:\Users\Admin\AppData\Local\Temp\lua_injector.exe
"C:\Users\Admin\AppData\Local\Temp\lua_injector.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4828

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffbd08ec728,0x7ffbd08ec734,0x7ffbd08ec740
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,13446411817152275101,16870266502474858562,262144 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,10020537280389301251,15387801135964263610,524288 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,18437890589365675048,6712215192891238820,524288 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,10003582220788033384,10188625613520897673,2097152 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,4312206039242104553,3054026594367785485,2097152 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,14382716358493964921,7266456592135750970,2097152 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,14194245979769504528,8318374193595272677,2097152 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,6880834146879252773,14548954514013019789,524288 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,17876873805897355114,3198722904073133360,524288 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,15359607865053023521,9418645388481783019,524288 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,4060565340608005942,11799674866851414170,524288 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5876,i,7790192675942829799,1442479034602147705,2097152 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=252 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5552,i,5915609980226803853,11362401933945606768,2097152 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3520,i,15911564823881388452,9725725803730768468,2097152 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3540,i,3523603370283833126,860749769807790951,524288 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=864 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3540,i,16560202678303352913,17956099120849637865,2097152 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=868,i,8343538719601317576,17385360621632147039,2097152 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6080,i,4035231298783641146,16455520577594251116,262144 --field-trial-handle=1936,i,8360196293437147216,17667894259770610553,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3576

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4136

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\gluasteal\log.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
MD5 d2fb266b97caff2086bf0fa74eddb6b2
SHA1 2f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA512 c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
SSDEEP 3:mnlllGlll/l/lXp9ZjrPBY06llSl/gX/ZP:mll0dPBY0O0uXJ
TLSH
T1D053019562930667C852033848CB0BA63A7A9619979345A282A49270D8A9B6584A2299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 944B
SHA256 878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
MD5 6bd369f7c74a28194c991ed1404da30f
SHA1 0f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA512 8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
TLSH
T18811924A3AC71DB8F37A6D71006991242202B2275CC2D61C4AC4C6A98B35618E476FA8
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 5242b0420f3a6fbfac1e057fca678104038310cbcc6c3dd09c893ec031615b2c
MD5 c37622eef5ac0e522b4d53830ccc5284
SHA1 657d70e2bdb7dadb6bc660a1d457700d421fefa1
SHA512 8a8421c03b3a775c702dfd8203f6834ab9b3b074ee98594c16f2b760a28d92b23c80e0f472a479401ecc2d7eff95b485f777f1af5272b8d5d268533739d922c2
TLSH
T13AF028B6D821EC3B1CFD4B6D20A44B4AEB6113672790889F3B3C920C8FB167B4685C1C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c29cfc44f4d857e5b97b5bd1168c5f592e8587782322eb497f15371ed5dd9fe5
MD5 8feab3188c1145d37facb32db9382503
SHA1 e04f4dd16e39076de54253106bc521704e401e1a
SHA512 9d52a8828cb234323fb18be55b7db382483ec71399c1ff4f8e00361349be8f41957a19ad592f7826db84149e3224afc377a3e8fadd864043cdf2577904267fb5
TLSH
T1F7615FC40898EF15DBB4587D86E4DE98F6781499ABF30F8353AB0F754913BC2D802CA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 91382b6de1033704fbb0255cae129099b53291268bf1a7648ec57b6b2b64b998
MD5 0a9250dee701f63121f650e336bd73d1
SHA1 bcd73977770993f2ee5fd8547ed487b4fa4217ba
SHA512 33daadb0cb2447dbbfc02617c1d4bdef38ad17cd8cfe4d1a1403cc0a0fc3b3efd9094de67d35c4c9888ecccb45322cd887c1be69c2bddc73c2985cc4ce60a2a3
TLSH
T10E716FC44894EF15CBB4587D86D4DD98F6B82499ABF30F86139B0F718A137C2E802C67
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 c2f36219714bdb94181f586232863843e0b6c8893529f44840ccd2a5fe514171
MD5 f3fc232926cfe7f56bed4505e64022ca
SHA1 265229533150f689e1987b9a433dbbbe88d58709
SHA512 871a82cf122d8aba64c0f1a6f8a8fecc7fd28398580c65c4ce5de3364896d6a131c53b85c99ff6cfc5b9841ad1100002eac88ac7c05d474dd6e3f17d2dfeab0d
SSDEEP 192:DCxX625UmbmfIvu0I6P0R0aFsUm9mpmTmDoXHmtm5VbmnjdY2:DCxX625UmbmfIvu0vP0R0aFsUm9mpmTK
TLSH
T1A3F190F7C7E8C66D890156F4EB156E1FCE290A14432C3C6AC8D4AF4B93E2972E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 a3861aa896a4580b788eb8d359f7f92c1845bfee58078d2ed6ef9a2dda0b3507
MD5 b8be118f86e8f902694c05d10dbdc1d5
SHA1 4dc95134a567d782705dbdf9e6201501e1ab2763
SHA512 f494853823421808ac7d5c9b65b8965e62703c5281094e476ef8f28fab3a245bf3235c3b9d87f703f0d6586268284bcc13b0e7bd880202b569b818edbd8363df
SSDEEP 192:DCxX625UmbmwsnIvu0IsR0aFsUm9mpmTmDYHmtm5VbmnAZuPVl2:DCxX625UmbmwsnIvu0BR0aFsUm9mpmTD
TLSH
T14A029FF7C7E4C66DC90156F4EB156E1ECE290A24432C3C6AC8D4AF4B93E2972E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 4e97ff069d186f4d7c5bf83f3e77632c8ba4673e8d5de16bf58fbec1aa31a30f
MD5 d116068dbfc91bc296b002e66a0237e3
SHA1 01e995fce42313e05c78ffce1e80d41e83c6cd8d
SHA512 275f75e950e3d7bc01d8388c138aa2841225194f4f1224a5e23d95b6a0a757ab7da42548c068b858e4d938c41b77aadbf534c498a0316d47da8781b63755be6d
SSDEEP 192:DCxX625UmbmfIvuNlXpI6PVyUR0aFsVHNm9mzmhmmmgmMmDj:DCxX625UmbmfIvuNZpvPVyUR0aFsVNmw
TLSH
T1EFF18EF7C7E8C66D890156F4EB156E1FCE290A24431C3C6AC8D4AF4B93E2972E25134E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 51571fdbfde5ba1c64816e456419b7ababb6daba0caeda7ea7ea5b1bedbffe89
MD5 366efd837cf44d6926813168a85ef7ee
SHA1 455135acedb845d6298665a5a2d7d7d9ab69d7e9
SHA512 65f2d5cf61d5b45efc2d364bad10a742b9445c9af29d6fb29fd727d03f66e24291505738aa9ce9c50113ebe515c0a4253c179aaa9d7ee736a9067522c23bacfa
TLSH
T19C31AB97E6BEB45B117D88BF0D14B8056DBBB4364241A8F0DF5AC16CF2925F71B22422
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 63295895e56b8d43fd1710910641187535d167c40002efde4e45f79a78265c21
MD5 dd18c599902da31ea96b1305364251c6
SHA1 0dc202dc01df58f47be58feb31537df2d66b8e94
SHA512 14ac68a2d273b3b535a7fb932fe28ec1a9f07f550af2afe646396894a44f90dda3809eed52d2846e2a9d5feda9130f8802fd673316f93d1322818c6ec15b2e69
SSDEEP 192:5RLYuhd8jnUv7ApAPRp2l9qHsb+WNnDJ003ckwNgVyIsnAUgtaJ:5RLYnQkUXmkw90B+8
TLSH
T15B42A42EEE10693B9CDBC229FE667B57E7F5102421942E84EAFC8A1C15D75CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 05956e6fa5697e140401928bc7576e488dfa01c2b36a7908134eca2874eeae00
MD5 dac8b99de79640ad26a2ab40e794f47f
SHA1 24dbd2fefa1d3921e579e518c9d5e65c416f458a
SHA512 36640252d6b8d7eebd3902e18429cf3b7b9f57ae51e8a840259a38919e047f95c8216b82f3faed7656faf2f7e2126bf08151d9c7c103879fec30f4ab895c113b
SSDEEP 192:5R3cBzMuhd8jnUv7AhVPRp3aPB2h9qHsb+WN0UDJvL5+3l2z3ckwNfVyIsnAUgrK:5R3mzMnQk/XzkwnVw2I/e
TLSH
T11152C52BF910293B9DDBC229FD557B6AE7F5202561E02E84EAFC8B1C15D79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9113b16911f45c8b0d08731a49f5a4de5da13c831bae129911465a1a6a6ebd24
MD5 6b04a00427c2c0677aca81735e18fadf
SHA1 efbd54b6b96facf9e4e556e51f7b763169c6e2fd
SHA512 950c56fd067662c5e7ce4eb87079b8299fb35e4c038f407975b3cef57b489bb575c9d37f23d8f041c41e3fadd77c49976d47e78af5e00a4391c0e934f04dc74e
SSDEEP 192:5RicBzMuhd8jnUv7AhVPRp3aPB2h9qHsb+WN0UDJvL5+3l2z3ckwNfVyIsnAUgrK:5RimzMnQk/XzkwnVw2I/e
TLSH
T11E52C52BF910293B9DDBC229FD557B6AE7F5202561E02E84EAFC8B1C15D79CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 91f020136e3c4a41a15b19c9030ceab6c1a6d525ceab7215e5adc0b64024dc43
MD5 a0b43b039781c0f82ad1f8976263e2cd
SHA1 3e78ae4d75d599e6bfab3364bc541451d29bc79a
SHA512 59bf04c601bcba882eb647a01899799eb552080b311313e28c51cd9309597cf4916256fa4a53bc82edc6771c39a5d21b1210fb280f5936fcc27f5a2fa45661ec
SSDEEP 192:5REcBzYuhd8jnUv7AhAPRp2aPB2h9qHsb+WN0UDJ43l2g3ckwNrVyIsnAUgraJ:5REmzYnQk8XCkwnK2NDe
TLSH
T18E52C42AF910293B9CDBC229FE527B6BE7F5202561D02E80EAFC8B1C15D79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 54779876237b880fcb788d9b85fd9bb107c1d02de29bacf545efe568f856358f
MD5 5c3b25761d1d9cd0c7dba02dc2ea9189
SHA1 fac51904cb5569c355fa711f07b4144e526018f6
SHA512 22427de80cc732de6ffa00a13836a5602cd3bede1066335e9530fd3f0ceee83d7d9227f035d4a5ff161396e4d1e4cd742d9e4e0c2343554730922341130a148f
SSDEEP 192:CRTcBzMuhd8jnUv7AhVPRp3aPB2h9qHsb+WN0U22+L5+3l2y3ckwNfVyIsnAUgrK:CRTmzMnQk/Xzkwxgw2r/e
TLSH
T17952C42BF910293B9DDBC229FD557B2AE7F5202561D02E84EAFC8B1C15E76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 75168e3070761b0e84757e468499cfb8b42cb6caa53e2cf66d7284147ec6b372
MD5 c34758b752398a363d48f643313c4c69
SHA1 fee38b7aa04c6b1f8031f905ad88e67e0a55cbdd
SHA512 6647f8c90f2f59e1f7a4eaf2f8462dd47bd186574cd924c0a198f433d91b64d59d991f214c688038c428a80a9854e849ddf8305aee5517317fac77137323839c
SSDEEP 192:5R0Yuhd8jnUv7AhAPRp2l9qHsb+WNnDJ0E3ckwNrVyIsnAUgraJ:5R0YnQk8Xmkw90RDe
TLSH
T1EF42B52EF910693BACDBC229FE667B57E7F5102521942E84EAFC8B1C15D75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2f575226b4cce687d032abbdb5567201bcb3df402cac91f0e5c6641238e19097
MD5 4321890888f174cdd1ac52aa915ffb19
SHA1 fed24595aef0aab42434c104e1efd456633ccb02
SHA512 a5dfed57d55d328975e0512f3796dff154248ead3938c66db67f03b3618438f06ddab890ad47944490934ac4dfa48a4bf1098798e0eab18d37931eab60645914
TLSH
T159B012808501D502C09206B411D21488B16CDF76D68A170243E06E22C8291A18514051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5958d4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5958d4.TMP
Size 96B
SHA256 f4d8f95df940bce56657faf614987a23f3d7e73e169c0b752018101e9e29fe26
MD5 256e95832b808e27556d2c5965331ded
SHA1 4a34d1d52ba67f63d42c265a8e7c3561f0d960ea
SHA512 896092e714a0e39fce4769090c67ac2a83055e82f5037f597d4754296153e3292a8560954c36818113c9e506344a98c47efadd81396fd7553cdde6ec6f014e5f
TLSH
T1CDB02202C0022203E08303F02AC282C83028CF20CA0302A383E00E22CC20A300038020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 f3bc42ab4a08dc3c6ca4f17ad42656a411ffd422fd527658a484d1509d1d3188
MD5 5ed83a005f9fd6eb707842a579bf3467
SHA1 0c158607f6dc546594e86bc1e209b0b4c936b247
SHA512 317c708484700b265bab928b23f638db4a6a18db351998a752e87701f5812e2db86aaf2284a4f77a5c72fd0e28bf29eb2217912b34efe43c12773ab1d3c48532
SSDEEP 6144:cjVyX3RDzGbEbYIybJIm7Rkm1tYpBeh2BAoY:coBLbM9oBGcAoY
TLSH
T18A3423735DB98A7648BB7B55704E665F2CF186B1BA29EBA0C4C5AB0033DD78A4C07D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 9ee90db93fb5045873731a614aa9dc8a6b3f100e4b6919cd72e7d94ccdb3a967
MD5 e3d70a19b6f3528448511d27abb3d068
SHA1 443eae3ca374f982e090cf54ab7a54d0416641b0
SHA512 b5f8b156ddfc57a163ffe15caf2bd32df6f17d3ab8f57d032857e71669e16864d9e949eb9f9b4f4a4bcf589e8fdef6e327152dff9e690bacd7300ff69e993db5
SSDEEP 6144:1yjVyX3RDzGbEbYIybJIm7Rkm1tYpBeh2BAoY:AoBLbM9oBGcAoY
TLSH
T1623422735DB589764CBB7F59700E755E1CF19BB2EA29EA90E4C87B0032DE6858C07D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 95935e65ed067798891dc4ad0da7db49250d0d9c550b4f829fe4fe41bd8b3946
MD5 1c4ff819dad5c1a106f3f5b650fb322c
SHA1 c193385a8d32111dbc94b1e07d36c95c0ea227b0
SHA512 87cb3a7fe483545cb846c73913973752b40ecff7d91ca2b741590c933efc2da80569420ce268e85a22988b5a04251004d5b3559b0876a4783abb06943726ad22
SSDEEP 6144:PjVyX3RDzGbEbYIybJIm7Rkm1tYpBeh2BAoY:PoBLbM9oBGcAoY
TLSH
T1C63423735DB58A7648BB7B55704E665F2CF186B1BA29EBA0C4C5AB0033DD78A4C07D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c1351b9dff2fade7526978cd6728ce00d2eade37e376525b605b4c93f5fa730d
MD5 1cbea455895d3b8808b16a5365946690
SHA1 79cf530b72897106da8a5a5e1a420d27ff45abef
SHA512 db443453c94dc754744f1b19dfc4d1ce1e0cf5d88ee662d71f0d379a3a3776b866b09eb2edc3d06457b59fe2bca8a2ea2198ec0f2d6d43c009db2a3492c080c3
SSDEEP 3072:AfGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:9m7Rkm1tYpBeh2BAog
TLSH
T145C3022B5D75E83B5CB9A74EB48E0B1E2EF149A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 100d562b23ce8a6455d8b0787734430073fa3948ea69f453aa613fedd9477107
MD5 f7994045f06844de6a86f8a9c13c94aa
SHA1 d5c6fc2d77ce1a6a41a361b8cac932e4168108bd
SHA512 7b7811a1be18d9312469bfbb2666ba005314dc43a7a87c04347f6abf4f62b1c9f9849f0931042ec840338ee732a905aef114df9309db6988a79d3fe125e0276e
SSDEEP 6144:kyjVyX3RDzGbEbYIybJIm7Rkm1tYpBeh2BAoY:loBLbM9oBGcAoY
TLSH
T1A03422735DB589764CBB7F59700E755E1CF19BB2EA29EA90E4C87B0032DE6858C07D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 1336b7a465a09aa3719a74df6664cb52d6610699fcda898975a80896f54588cb
MD5 1660ea943cb684096a0107a91d571bf5
SHA1 fc4288e7b0a44e65035fb04a7c68f9d8882079f7
SHA512 5597bbb40dd41f7b0b21a9fd2ad2d21ee999f3de0cdb67ddf259e32b4496293b82606e674f4f4bc22a64e1db41447ab9649e52a50d9a0b1c289c92500fa906d9
SSDEEP 6144:kPjVyX3RDzGbEbYIybJIm7Rkm1tYpBeh2BAoY:AoBLbM9oBGcAoY
TLSH
T1EF3422735DB589764CBB7F59700E355E1CF197B2EA29EA90E4C9BB0032DE6858C07D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 a8df2ab33b4ddbdbf66e8d5d8aaee4121fafd4de1e802e757b9ee6602bde0698
MD5 19258944f305660c8879311105cdcd78
SHA1 8314d799eb3bd3a988ee6a07afb39f223c60dfb8
SHA512 37ee4074c5725ecfbc05677c61155a91f115d92f9cd6ff8bc603c73d06d15e0e22a988382045b22fa6bff1b3bf58418fc1eae0d40a74840a5ab748c64a23838a
SSDEEP 3:MsEllllkEthXllkl2zExll3UKt:/M/xT02zITt
TLSH
T185440204AF890406C6401431805283940364F41106215743259104136D8A5400C11508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 143561.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 143561.crdownload
Size 645KB
SHA256 48833e6ddbc40fce5b75a09813b9c7b069a45b92f67ab0c6684bf86552a2fe54
MD5 bd7e798a6f7acae3b32bf69d0f7229d1
SHA1 5752bfab2583ad80e9cec758eda805ae0459894f
SHA512 a8f5c99c34eaa7fb3ef0025b4a1f59a0837fe47e496c93a01b7cf09bf00e179242b07cd4b055012e8916ed5512d8dd838eaf92dcb933029605e23a92fc340875
SSDEEP 6144:+DSmzd7h8ywNBkBisr+Sv1U/SDKE+hCimyxpo2roRTbO+Zb8IeZvnQ90PQfuFApN:+Jh8yyBb/SDBbyxpo2ro5i+Zo8dn
TLSH
T16CE43A5672A802BCD47BC27CAA4B8D12E772744653359BFB42D286931E47AF09F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/340-51-0x000001DF023A0000-0x000001DF023A1000-memory.dmp

Download

memory/340-62-0x000001DF023A0000-0x000001DF023A1000-memory.dmp

Download

memory/340-52-0x000001DF023A0000-0x000001DF023A1000-memory.dmp

Download

memory/340-53-0x000001DF023A0000-0x000001DF023A1000-memory.dmp

Download

memory/340-61-0x000001DF023A0000-0x000001DF023A1000-memory.dmp

Download

memory/340-58-0x000001DF023A0000-0x000001DF023A1000-memory.dmp

Download

memory/340-60-0x000001DF023A0000-0x000001DF023A1000-memory.dmp

Download

memory/340-63-0x000001DF023A0000-0x000001DF023A1000-memory.dmp

Download

memory/340-59-0x000001DF023A0000-0x000001DF023A1000-memory.dmp

Download

memory/4136-7-0x0000020CDEAC0000-0x0000020CDEAC1000-memory.dmp

Download

memory/4136-8-0x0000020CDEAC0000-0x0000020CDEAC1000-memory.dmp

Download

memory/4136-9-0x0000020CDEAC0000-0x0000020CDEAC1000-memory.dmp

Download

memory/4136-6-0x0000020CDEAC0000-0x0000020CDEAC1000-memory.dmp

Download

memory/4136-10-0x0000020CDEAC0000-0x0000020CDEAC1000-memory.dmp

Download

memory/4136-11-0x0000020CDEAC0000-0x0000020CDEAC1000-memory.dmp

Download

memory/4136-12-0x0000020CDEAC0000-0x0000020CDEAC1000-memory.dmp

Download

memory/4136-0-0x0000020CDEAC0000-0x0000020CDEAC1000-memory.dmp

Download

memory/4136-2-0x0000020CDEAC0000-0x0000020CDEAC1000-memory.dmp

Download

memory/4136-1-0x0000020CDEAC0000-0x0000020CDEAC1000-memory.dmp

Download

memory/4828-670-0x00007FF6B07B0000-0x00007FF6B07F5000-memory.dmp

Download

memory/4828-13-0x00007FF6B07B0000-0x00007FF6B07F5000-memory.dmp

Download