2350bee21bc6768225d70272add58fd264205ee034c5b8c17589294ba93b9010

Analysis

user interaction
yes
max time kernel
899s
max time network
897s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 295KB
Sample260620-ltppvsft9y
SHA256 2350bee21bc6768225d70272add58fd264205ee034c5b8c17589294ba93b9010
MD5 0077e0917fdeb3d8d5fa42d113d40c04
SHA1 17b2456f289a8db789e0480b36f42b9d821ae374
SHA512 d5fa142e8653eb56c7aa3732dc03b12210b786ee263d395d37d9c52abe8c731a1d41b8e9c4e23c61a3d78fc2678cdeda4371638e0fc426edc2cb97711a008fe3
SSDEEP 3072:1B1k4QzqznLabIVNDXyl0sI0ImHhBbPjQwmzILWXFhK5u9R/:1B1k4QzqznLSIVNJs57LjIzIsD91
TLSH
T1FD545B326250B53BA413DEA0E6FE6E4E3C36E12BDC0646F8A5A1E530DFE2DB1111535E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
61	raw.githubusercontent.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4860	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264226195247565"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
6064	chrome.exe
6064	chrome.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
4	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe
Token: SeShutdownPrivilege	5696	chrome.exe
Token: SeCreatePagefilePrivilege	5696	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe
5696	chrome.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5696 wrote to memory of 5664	5696	chrome.exe	89
PID 5696 wrote to memory of 6560	5696	chrome.exe	91
PID 5696 wrote to memory of 4860	5696	chrome.exe	92
PID 5696 wrote to memory of 6560	5696	chrome.exe	91
PID 5696 wrote to memory of 824	5696	chrome.exe	93
PID 5696 wrote to memory of 824	5696	chrome.exe	93
PID 5696 wrote to memory of 4908	5696	chrome.exe	95
PID 5696 wrote to memory of 4712	5696	chrome.exe	94
PID 5696 wrote to memory of 4908	5696	chrome.exe	95
PID 5696 wrote to memory of 4712	5696	chrome.exe	94
PID 5696 wrote to memory of 616	5696	chrome.exe	96
PID 5696 wrote to memory of 616	5696	chrome.exe	96
PID 5696 wrote to memory of 2956	5696	chrome.exe	97
PID 5696 wrote to memory of 4756	5696	chrome.exe	98
PID 5696 wrote to memory of 4756	5696	chrome.exe	98
PID 5696 wrote to memory of 4780	5696	chrome.exe	99
PID 5696 wrote to memory of 4780	5696	chrome.exe	99
PID 5696 wrote to memory of 3832	5696	chrome.exe	101
PID 5696 wrote to memory of 3832	5696	chrome.exe	101
PID 5696 wrote to memory of 7152	5696	chrome.exe	102
PID 5696 wrote to memory of 7152	5696	chrome.exe	102
PID 5696 wrote to memory of 788	5696	chrome.exe	103
PID 5696 wrote to memory of 788	5696	chrome.exe	103
PID 5696 wrote to memory of 6152	5696	chrome.exe	105
PID 5696 wrote to memory of 6152	5696	chrome.exe	105
PID 5696 wrote to memory of 1844	5696	chrome.exe	107
PID 5696 wrote to memory of 1844	5696	chrome.exe	107
PID 5696 wrote to memory of 124	5696	chrome.exe	108
PID 5696 wrote to memory of 124	5696	chrome.exe	108
PID 5696 wrote to memory of 2572	5696	chrome.exe	109
PID 5696 wrote to memory of 2572	5696	chrome.exe	109
PID 5696 wrote to memory of 2892	5696	chrome.exe	110
PID 5696 wrote to memory of 2892	5696	chrome.exe	110
PID 5696 wrote to memory of 2384	5696	chrome.exe	111
PID 5696 wrote to memory of 2384	5696	chrome.exe	111
PID 5696 wrote to memory of 836	5696	chrome.exe	112
PID 5696 wrote to memory of 836	5696	chrome.exe	112
PID 5696 wrote to memory of 6912	5696	chrome.exe	114
PID 5696 wrote to memory of 3456	5696	chrome.exe	115
PID 5696 wrote to memory of 6252	5696	chrome.exe	116
PID 5696 wrote to memory of 4256	5696	chrome.exe	117
PID 5696 wrote to memory of 4256	5696	chrome.exe	117
PID 5696 wrote to memory of 4396	5696	chrome.exe	118
PID 5696 wrote to memory of 4396	5696	chrome.exe	118
PID 5696 wrote to memory of 2856	5696	chrome.exe	119
PID 5696 wrote to memory of 2856	5696	chrome.exe	119
PID 5696 wrote to memory of 2412	5696	chrome.exe	120
PID 5696 wrote to memory of 2412	5696	chrome.exe	120
PID 5696 wrote to memory of 6456	5696	chrome.exe	121
PID 5696 wrote to memory of 6456	5696	chrome.exe	121
PID 5696 wrote to memory of 1072	5696	chrome.exe	122
PID 5696 wrote to memory of 1072	5696	chrome.exe	122
PID 5696 wrote to memory of 7060	5696	chrome.exe	123
PID 5696 wrote to memory of 7060	5696	chrome.exe	123
PID 5696 wrote to memory of 6888	5696	chrome.exe	124
PID 5696 wrote to memory of 6888	5696	chrome.exe	124
PID 5696 wrote to memory of 3096	5696	chrome.exe	125
PID 5696 wrote to memory of 3096	5696	chrome.exe	125
PID 5696 wrote to memory of 7096	5696	chrome.exe	126
PID 5696 wrote to memory of 7096	5696	chrome.exe	126
PID 5696 wrote to memory of 6064	5696	chrome.exe	127
PID 5696 wrote to memory of 5192	5696	chrome.exe	128
PID 5696 wrote to memory of 5192	5696	chrome.exe	128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa1610c728,0x7ffa1610c734,0x7ffa1610c740
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,12700306978066660627,4735389316227047755,262144 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:6560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,9073945722551793574,17517375888250042578,524288 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,14592716020298654084,16045008653578345489,524288 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,439311536526820642,17157528194178696843,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,14935190000319084288,16736850259947809567,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4976,i,10525420583308451767,11225484931002635549,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,5390029837431688056,13971768322673700375,524288 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5572,i,15198994800888565529,12276285214861585953,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5612,i,13247936098684304060,12406170839661458909,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5860,i,4241307011228596374,16868311978636339300,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6004,i,5226854232989147699,8510312751160030952,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:7152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4936,i,10993283376442993308,9220390815914899125,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6140,i,7521497612804899580,16847652669323577781,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:6152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6372,i,15943601458123806054,6844695246846843850,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6376,i,13982422372516359732,18154947427888032661,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5660,i,7377886297145121156,11766500157256901167,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6172,i,16456801665122539987,15294782189113013333,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,3235271293232122005,5871614995711354568,524288 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,4568454264802621961,17203604048731974706,524288 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,5828742907479051597,811503799387071858,524288 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:14
  2⤵
  PID:6912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,5801856447623840343,3949756684254717703,524288 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:14
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3432,i,12661766818810159684,14280816068742818913,524288 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:14
  2⤵
  PID:6252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3196,i,16387568966248529329,14167971630251435183,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5604,i,13035715140083284162,1093513036411250261,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6364,i,1327901975614987372,7689041639332339698,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6232,i,11315048810914134396,16426727948270863486,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4952,i,1631545844380021596,14985814105234627494,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:6456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4744,i,2393609986738703718,2883120517703059878,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6264,i,16953585667573063023,17452810999571412712,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:7060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5008,i,13736780371248433,2918904974733564935,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:6888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6116,i,4458101852331213427,8973906103548434661,2097152 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6592,i,7329982878520251918,4558228834017535270,524288 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:12
  2⤵
  PID:7096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6188,i,711086599415083093,11639500128781549752,262144 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4440,i,4344023716212543609,16020895126282240306,524288 --field-trial-handle=1916,i,14354298903340884240,14373037997018992772,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
  2⤵
  PID:5192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2784

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:7000

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6312

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 33ae925eb9e42e7dc4daa32e26578e563210adceb821fb32f77da0b60072005f
MD5 c8a56f7cdd8ba5999b5d6cbc2c1afc98
SHA1 2e810de3b9ca18df413fe94b4a45431a35a2adcc
SHA512 4a8b915d11df7721c8c309944dd427df156b99d47d9dfd880a83687abb47e9c379983e451bbfd33a6dfae365fa3a172d29b391777a57552d1b9ad08af592dd7d
TLSH
T1CE414137A48C3245FB516E7A25D34844E3F2BB44C4466E1FC3E48B66AA077E302996A2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a29687314e4d308c61559fa08dca9b98c76439bc5ab6b934adb1c0e16080f5c6
MD5 e26045db131b4e4fea408a6ff63d9d75
SHA1 90b10714ebc68ae59c92bb9802ebf2c45ac403b2
SHA512 b2025c70326874fe6b04176da1a2506fdfa1cdd167bd4b4195c88a90e2ba390627207d54b085ba54df0d8d31dad32e98ea0d84511ff11699048061a122a4830c
TLSH
T167215437448D6345FB55AE7E26D3081173F28F84984A2E17C3E8DB69A1037E5032E293
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 6a682993bc95d6247715749d2484c8773f433ef27744564c966fa06830df75d3
MD5 e27ede0055deb792d98c1ea28ae6713c
SHA1 e3002c5d16056d482f7ad03f033caaedea4207e5
SHA512 683884280c9e2bb56b9f28508846cbda8be15ca8872a3d179ab6384a572aaeccd67a803759e5e00b02110db9e3a37e4ae6bb2cb352f46be1c41994ad9ba5a1c7
SSDEEP 384:DUk01itxkcQ4FUDx0wljYEHlrxJGmLDEd5OSZqc/NTa0f6SNBIXY1VcuKMJdgR6f:xOonHJXZ
TLSH
T12D42ACF783E89A6DD91196F0EB156E1FCE690918432C3C7AC9D4AF1B93E2471E20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 948e99cdc3b47ac4fb720fc2fe4e0abab3d2ced5cf1fc462f35a2fbf9cfed27e
MD5 5826034d5c20dbd259ad6fd434f7af4b
SHA1 e83c0d89c8885c79638d10186de0cfea5f918fa2
SHA512 2fd663267953fcfdab2bb22ab3f11ee647c9736c594f73e39247a659483f4b683b67a462aaf750825b119d393dfb08631325c2c345c0bcbb62161baf9e1b4e09
SSDEEP 384:D6O8F3xkeexemHsfK0bKrxJGmXDO85Optkc/NTa0f6sNBIgY1VcuKMJJgRV1PLem:WOohUiuk
TLSH
T11F628DF7C3E88A2DC91156F4AB256E1FCD590958933C3D6BC9D8AF0BA3E1470E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 78a743d8dc786f42cdc339846064f25bd2451370507998026cb01eada55bbcf1
MD5 e7e246e058b25a5874c3ef86d93442f4
SHA1 38823e81a896b7c92122faee8a248dfa25cbc3af
SHA512 3f51cfb9c354627bf64c2c45d1e5abb230124def08c210c3da5e8a84bbaf1f24dace89b29ec97fc8507b4d8553cb1e8640b8a1b4b3d02704c8f636bb43de6613
SSDEEP 384:DUmk01itxkcQ4FUDx0wlAX3ZrxJGmLDEd5OSZqc/NTa0f6SNBIXY1VcuKMJdgR6h:lOonHJXf
TLSH
T10352AEF783E89A6DD91156F0EB156E1FCE690918432C3C7AC9D4AF1B93E1471D20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 c45f1a3e5553ae7ee38312f9082ac7630040f2b701a6d1ac1229f5cc6c98b5cf
MD5 faa2eb6cbcb498d0d3318c20569e2885
SHA1 b0073e6bd89ee7d33b773d410fd902da3fe7e383
SHA512 f2de8692fad1d0c3db9d271df38296b42e12b4362a9a45b33371d55ee7f8115662fe94ac177e1570fb987489132e8a27d595698bf68c2b2a6184029087d53374
SSDEEP 384:D6O8F3xkeexemHsfK0b+ErxJGmXDO85Optkc/NTa0f6sNBIgY1VcuKMJJgRV1P3E:9OohUidi
TLSH
T192628CF7C3D88A2DD91256F4AB256E1FCD190958933C3D6BC9D8AF0BA3E1470E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 5aeebb845cd84011f9c83c50fc5b279579a0f51c3c18854141174288edf2b188
MD5 8a84d7e4e79107efb74e4029a0772e7b
SHA1 d48b49585e9ef13eebea1e724b0d8bc76a5d314a
SHA512 e8350e0070ea727a6f6fbad4bf4bc0458b057456245f48404036483edbf1bb33168a16cc41bbb71c0de9d9042360a6968023903f9ca8009a48eda440d3e87c57
SSDEEP 384:D6O8F3xkeexemHsfK0b+AXTrxJGmXDO85Optkc/NTa0f6sNBIgY1VcuKMJJgRV1Z:BOohUiUg
TLSH
T1A0628CF7C3D88A2DC91256F4AB256E1FCD190958833C3D6BC9D8AF0BA3E1470D21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 7797531743c9d68f963792357117bda08e1ec9347528ba63dd5751a12a56edbe
MD5 1b543556f98a44805f81bb503acea2a0
SHA1 22bbd5d2fab9828ceaba8f6f289cfa20f9126858
SHA512 407073265d2d58747d15d9a68f68e57f83a8a1fe09675169b7e32306cc331bead27fed6f82ba31c0c33a29f58245866bd22f7449ccda0736fe9340ea4a71bce8
SSDEEP 192:D6O8F3xkeexemDrxJGmXDO85Optkc/NPLaP8fPCvcfNBtBgY1VcuKMwMJgRSmM1W:D6O8F3xkeexemDrxJGmXDO85Optkc/N0
TLSH
T148327BF7C3D89A2D891156F4AB257E1FCE190958833C3D6BC8D8AF1BA3E1871D21064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 518d2c359558172d8865f8126106a8567b51d3fb70cccd10b262d35e6bc1f6b5
MD5 34f9e8d1924b058a6817f9e7b395f2f0
SHA1 0db4e4a2e140292c14125fe7e7b63db4b8d425f3
SHA512 c3c2eecf5c1a13a10ac0b80c1d83a9904c1fcbb2ff3198ea9450871a033e33936dd7fd7994010748ddfa122b925b4b870fec68df1d28f806cc1ff40366da7d88
TLSH
T18A2157AF9A6FF46B503D55BF0E657C05297AA83011B26CF9CED683BCE0814F71B02816
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 3b2f9b7b49e860e9b81cb394fc4fc07987b648faa764fab7fb3afcec2e3c4aa9
MD5 878089cd88a868837ff8ccbe883a1d23
SHA1 b772d3537094e0d4271eb1a90d4b5dbef426863b
SHA512 30a329ddd47829c7197ae84c58927d7bef89607e6026de86ba0ad328da29b95fd38d9585b94b2786d167274d18ed694583ea364586564e33fe3abbe85a0baecb
SSDEEP 192:FREbuw4Lm6v78NvAPRp25EX94Hsb+WNnf1FPxFeOVyIsnAUgR:FREbuw46WYN6XLWwffP9R
TLSH
T17822B42EAA50743B9DDBD229FE21B753E3F5102275942E80EAFC8E2C14D79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 342f1b135e6dc6bcd9df1a536d7c3f85c807b2ea0a97578d2f5609c4731668cf
MD5 ea8d3f062b99bf0af0ab66cde5d60e4f
SHA1 47ddddd5aace783aa0c12da906ccee3a34e9c68b
SHA512 3516868261d7f9164d3d1baccd9f9f1302546cafb57d459e958037b674eb672ab840100391e36cce110978478871464a7ecd3d6a4f5c5536899a10ba0fa7133e
SSDEEP 192:1REHcBzuw4LBcv78ugPRpC5KtqdJdp94Hsb+WNlKbh44n29FeZ8yIsnAUgE:1REHmzuw4dIYPX6WweP29E
TLSH
T14B42B72FA950257B9DDAD329F9A1BB67E3F5102175941E80EAFC8E2C15DBDCC211301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8ef9329597c7262bcdfa059b0a944ffa4ce5640c11386ef94af8f0818adfc691
MD5 ded352684a4fef6d47014acc4ca0c775
SHA1 adb54d76fa3a1e1a4df5ac17f96d8d7757c70352
SHA512 9963f39c4a411d955d5a391cdca02557ec36fe2c38a2ebc6956cb76743afcff28679702313200cbc852af1fc053b3e4545a3c195a995c7bd04233cf2264d01dd
SSDEEP 192:1REHcBzuw4LBcv78uAPRp25KtqdJt94Hsb+WNlKbh44n2WFedVyIsnAUgE:1REHmzuw4dIYfXsWweP27E
TLSH
T11A42B52FA960353B9DDAD229F961B727E3F5102275D41E80EAFC8E2C15DB9CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b781ae0feb4ea21f790e713c209535e69a304cdf1de31ac6a5bec5c8340281dc
MD5 3763ce98935e5806aa335eeb3179db56
SHA1 6ab146c3de95023010aa97f780ee8cab82e9ff3d
SHA512 5e5898896c2fc8713b621808a76e81744727284003afd199640257c46f86daed55c12aa6c4e57ed38c0fdf79f72c71c5b4cb31adf47c4a5690bd573e7ba62681
SSDEEP 192:1REbuw4Lmcv78uAPRp25Ek94Hsb+WNnbh0zFeOVyIsnAUge:1REbuw46IYfXIWwV0fe
TLSH
T12332B62EA950753B9CCBD229FA61B757D7F5102275942E80EAFC8E2C14DB9CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7699f5e71b78f5f719def724412b96c7899368365827b2f3f9f57a56e15e9e67
MD5 e2110b2c17a56e17ab039346b6cdbdaf
SHA1 25ae46e5fab989f49db6f4622b9a48d89eee3b00
SHA512 47f83a0fc9cc3b7e7f39e02308f35a0efd1eb8b6851cb0b24ce3d3f4be170095e7cfaa1991379f9acb9a708e0ddcf2a0c2d5eda2fd09da4b7e7d4fc80655960d
SSDEEP 192:1REHcBzuw4LB3v78ugPRpC5Kynq6CJdp94Hsb+WN5flKbhHVD4Bm6W96+4n24Fev:1REHmzuw4dfYPX3Ww5GJn61N28O
TLSH
T1C152C86FA960257B8DDAD219F991B767E2F5102175D41E80EAFC8F2C14DBDCC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 466cd43d0d23fc821de3e69c2a3e5bf132cb3dbebb252a897757892a70e9a1ed
MD5 7bfeb19557d95c21dacc814e586baa86
SHA1 8bd9326e6500ed5f015685c60b7f31697a16850e
SHA512 5f8469e8ffffeeb843577c4fe42ebd92e9131e00b8da30a25dcfa755dd8163cb451dc056a7e108cffec4472e3133b760b9dedee8bd2f42fd3fab3d7eaeca358d
SSDEEP 192:e+x4K6sK7KxkXqK4I40pUZNCgVLHrKHfFKslESWAXzKD/ru+ErUkKN91pqtS95ZW:/xjzK7KxkXqKf/pUZNCgVLH2HfgslyAV
TLSH
T18E32B727948D6A7B4FD8E90CDC136F8F6CB5029272680D2456FF9D0803E5BCE115A5BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 95db6fa67c32803a2933d07319c15fd441e27a59e0e54e25a12a03ef61f0af7b
MD5 a7f778cad085de23d32abfebf6045321
SHA1 93ba3d425ebfe37b3b1dd58e36f12ab5e4e54141
SHA512 422cc6f8c2428e349cc885b16caa59e63e9cc59c554630ba258bc4bb292bc6a6d2147a16ff50f09d3d454f605900b7a3df6df73972e5cfb3f7ea66e6f114791d
TLSH
T131A0026016C10D41DD100A7B13C246D033938C148726878391D0018CCA7E3574986650
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 c226830db98c8598a7a27744805d1451b45246a4d0deb2276f22703c5f08347c
MD5 6e6c083ea61edc4aa1c19d1bbdd5f027
SHA1 92eed4bd6ba1e87bfb0c0543fed40872416550e3
SHA512 7971b8f0fcc05186a4229318645957226e76550b1f63df526d0166c0b730b8943bed444a09e9a533c75c823e3aed2c58b4e55d8e719d2af4eb44308fe25d8b44
SSDEEP 192:dFtdMPE2WaoJRhrNzSiU20MCvJQOkSJ0uCup:dFt+PdoR1NGeCB/J0uCy
TLSH
T10CC1E771A82DACAB99F26584F1036D438DB8611BB955BE98F9ED0F0C10EB8DD5383127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5f259b203528d4550cb9bad8724ff230b56346e7bdc260331f2f780aa1402387
MD5 338a9f09bbc74bedbaac82710da95cfb
SHA1 db89dfea099505ceeed9c7f01de6bbc764cc5f4e
SHA512 194d4c5fe454d3bdebb454604739992c09827a8d06733453c8b3f118505fc376f635076d17b3b86a677e461847d21f2a529d50a066cead2c4b622053c42c77dc
SSDEEP 96:dFbJ6t8d+/9PX02k7aoBD/+FfWhrNFF7SSl8h4otop5V/D4B67GGfv+yqOVuo0OC:dFtdMPE2WaoJRhrNzSiU2lMCvJqRo0wG
TLSH
T1EAC10A31783DE8B765F35A95F0023A83DEB8615BB552AE54E9E90F0C15EB5DC1383123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 4f6b3b3f79c4ad88e1682f2f2fdee4664eb2f70fe904262d1543fca8e05ab60e
MD5 9afb2889f389a7c56028a8c13832c186
SHA1 77e0393be98ae84e6d2620bba0d7fa7a27216863
SHA512 373c00baadf5025f85a6bddc651c26cd7f7e63f4825dc3bf3db6d68390409d903415987a52425381768385ba4dd9e6804986c72ad8daa9956f66eb16b7b3db1f
SSDEEP 192:dFtdMPE2WaoJRhrNzSiU2/MCvJQOkSJ0uCup:dFt+PdoR1NG5CB/J0uCy
TLSH
T144C1E771A82DACAB99F26584F1036D438DB8611BB955BE98F9ED0F0C10EB8DD5383127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 972a394c1a4513b514d5e4f3691e1ed9ca141f268f2c06f177e67395f32b6c7b
MD5 27fcd7dc3b0f2180848fcb85c7f85445
SHA1 4a5c4fffec8eeadc8a9431ed0b8f6565c654cfff
SHA512 401abaabb25a058124a02fbc414a76b9d181a895e1bd404c1d4e9f4745f5da5dfa29867da3e4608a63decfde9fc76b036d83c3734495e6d30763397d4e4df364
SSDEEP 192:dFt5MPE2WaoJRhrNzSiU2/MCvJQOkSJ0uCup:dFtqPdoR1NG5CB/J0uCy
TLSH
T1F1D1F731A82DACBB99F26584F1136D438DB8611BB955BE98F9ED0F0C10EB4DD1383127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 39edabb4e90ad6c8093f564b60a7f8c8375e08333ae6b72765d25f289c9ac5f0
MD5 92aa2729b4d7d87eb63971c63018129b
SHA1 2677e209e69c3d4fd3eea909cc3da62931f2020c
SHA512 b3f5123cc31af4dd598eb4747648c1fb90e9addc973d33f139e4d7956e4dd245d89f040d9d840866f2bb1d47e002489be991baa2f3bd778e5590a6731c65cb2e
SSDEEP 96:dVC6t8d+/9PX02k7aoBD/+FfWhrNFF7SSl8h4otop5VlD4B65Gyv+yqOVuo0ODDe:dVCdMPE2WaoJRhrNzSiU2nMNEqRo0wDe
TLSH
T16DC10A32783CE9B755F25A95F0032A83DEB8616BB9526E94E9E90F0C14EF5DC1383127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c1bddce61eeb53afb55c1cc67f05e552a36ec8eed566ccf42ae60c4561e271c6
MD5 7287850d93ca668055a90130ec63fedd
SHA1 02a0e642b15737aacbd2aaaed335ac18c4bcb735
SHA512 ac0bd0aaa5db8706a74199804adc5517addc16fd47ff67e898a1503b825c2d73ffc631926c8d64303a37454585504f07b0580090af731f620e0caefbd82a4997
SSDEEP 96:dVC6t8d+/9PX02k7aoBD/+FfWhrq+F7XRDotok5VGD4B6jGyv+w6DJsebElkfv4a:dVCdMPE2WaoJRhrq21DUDWMbi6DJvb+w
TLSH
T15AA10A31743DE8B795B59984F5127A83CEBC611BB951AFC5A6ED0F0C24EB0D81342127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b819adf2-0fe6-4244-b46e-28eda48a5503.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b819adf2-0fe6-4244-b46e-28eda48a5503.tmp
Size 5KB
SHA256 0a9423b68ee41b1fa71cf7d3c9903a10458c53dd8b07321e253c048f17355e2a
MD5 2e19918cd2cf43c45079b8a9ea2d0c28
SHA1 eb3cb574cafa0e63ccc600047546b33e1d711e45
SHA512 1910a4f1545203f7a16522391983c5aec78ee8206e26ef4e191d95cef24ccbe9b1ed6fa8c4c78f436af67aeb313fd21c276e80fdfe964f1f2c0bb3c4a866a068
SSDEEP 96:dFbJ6t8d+/9PX02k7aoBD/+FfWhrNFF7SSl8h4otop5VWD4B67GGfv+yqOVuo0OC:dFtdMPE2WaoJRhrNzSiU2iMCvJqRo0wG
TLSH
T1B4C10A31782DE8B765F25A95F0023A83DEB8615BB552AE54E9E90F0C15EB5DC1383123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download