8329bcbadc7f81539a4969ca13f0be5b8eb7652b912324a1926fc9bfb6ec005a

Analysis

user interaction
yes
max time kernel
1049s
max time network
1045s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Eula.txt
Size 7KB
Sample260628-tflp2sat3n
SHA256 8329bcbadc7f81539a4969ca13f0be5b8eb7652b912324a1926fc9bfb6ec005a
MD5 8c24c4084cdc3b7e7f7a88444a012bfc
SHA1 5ab806618497189342722d42dc382623ac3e1b55
SHA512 6c74bed85638871fd834b30183e1536e48512dd0f8471624732ac1b487f0eba34dec99f88d2d583335f66df543d5fabf4b8c9456255df2248a4c086f111f0baa
SSDEEP 192:RCVPxjERdQe/lb9iLbRvhSXH3DsDw3zF55Mz6h:RcFERdXlRiLbujuw3zF55jh
TLSH
T1CDF1C8AF32CA176205D203A27A0AD1C7FB298574329BD615BDA981281346D28937F3ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
696	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271360160012926"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4908	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
3548	chrome.exe
3548	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe
Token: SeShutdownPrivilege	824	chrome.exe
Token: SeCreatePagefilePrivilege	824	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe
824	chrome.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 3560	824	chrome.exe	90
PID 824 wrote to memory of 4964	824	chrome.exe	93
PID 824 wrote to memory of 4964	824	chrome.exe	93
PID 824 wrote to memory of 696	824	chrome.exe	94
PID 824 wrote to memory of 3284	824	chrome.exe	95
PID 824 wrote to memory of 3284	824	chrome.exe	95
PID 824 wrote to memory of 4920	824	chrome.exe	97
PID 824 wrote to memory of 4920	824	chrome.exe	97
PID 824 wrote to memory of 3492	824	chrome.exe	98
PID 824 wrote to memory of 3492	824	chrome.exe	98
PID 824 wrote to memory of 2212	824	chrome.exe	99
PID 824 wrote to memory of 2212	824	chrome.exe	99
PID 824 wrote to memory of 972	824	chrome.exe	100
PID 824 wrote to memory of 972	824	chrome.exe	100
PID 824 wrote to memory of 4336	824	chrome.exe	101
PID 824 wrote to memory of 4336	824	chrome.exe	101
PID 824 wrote to memory of 4856	824	chrome.exe	102
PID 824 wrote to memory of 4856	824	chrome.exe	102
PID 824 wrote to memory of 600	824	chrome.exe	104
PID 824 wrote to memory of 3380	824	chrome.exe	109
PID 824 wrote to memory of 3380	824	chrome.exe	109
PID 824 wrote to memory of 4632	824	chrome.exe	110
PID 824 wrote to memory of 4632	824	chrome.exe	110
PID 824 wrote to memory of 1812	824	chrome.exe	111
PID 824 wrote to memory of 1812	824	chrome.exe	111
PID 824 wrote to memory of 964	824	chrome.exe	113
PID 824 wrote to memory of 964	824	chrome.exe	113
PID 824 wrote to memory of 3432	824	chrome.exe	114
PID 824 wrote to memory of 3432	824	chrome.exe	114
PID 824 wrote to memory of 4920	824	chrome.exe	115
PID 824 wrote to memory of 4920	824	chrome.exe	115
PID 824 wrote to memory of 3144	824	chrome.exe	116
PID 824 wrote to memory of 3144	824	chrome.exe	116
PID 824 wrote to memory of 4796	824	chrome.exe	117
PID 824 wrote to memory of 3312	824	chrome.exe	118
PID 824 wrote to memory of 1712	824	chrome.exe	119
PID 824 wrote to memory of 4932	824	chrome.exe	120
PID 824 wrote to memory of 4932	824	chrome.exe	120
PID 824 wrote to memory of 3428	824	chrome.exe	122
PID 824 wrote to memory of 3428	824	chrome.exe	122
PID 824 wrote to memory of 3000	824	chrome.exe	123
PID 824 wrote to memory of 3000	824	chrome.exe	123
PID 824 wrote to memory of 4216	824	chrome.exe	124
PID 824 wrote to memory of 4216	824	chrome.exe	124
PID 824 wrote to memory of 3548	824	chrome.exe	125
PID 824 wrote to memory of 1188	824	chrome.exe	126
PID 824 wrote to memory of 1188	824	chrome.exe	126

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Eula.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdc904c728,0x7ffdc904c734,0x7ffdc904c740
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,8912338299088694279,2232636709023557098,262144 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,6090069309648318262,8307761187070202002,524288 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,17803877492845684517,16947158218215059463,524288 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,7992002654698756105,9011307043566264599,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,15401917939684009789,9706005879713895516,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,9146349052592742585,16374716655375664961,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,11732131733313981697,13180171660277795652,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3956,i,7394749694022963015,818201332027793574,524288 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,10080575057286401725,16383286504617200820,524288 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,2917609957649216103,10653321272450410861,524288 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5888,i,7235151912200502535,933839398631527905,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3288,i,9821900151488113116,5025994392019898224,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5936,i,5789248955272424139,8359016534911701117,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5824,i,17226498544556768288,16658667386643969636,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6264,i,8762191327262955481,5274614244777751981,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6436,i,15850006702632187716,4092914799676866324,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6368,i,9718470628728442466,10125234382577784470,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,8787483821923331451,13765482054757012819,524288 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,2754889372987749405,12160883823042814135,524288 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,8430370613161280748,14814179534393164752,524288 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5816,i,1398990412545733190,3168963073177152800,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3624,i,3649300222487414168,11510990573564556826,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6276,i,1298707650671159852,12289687145007667125,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6440,i,5616287151574582822,7263890568260573084,2097152 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5620,i,16425349991164698922,1986090601910343564,262144 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,15951763384657661670,2383075414772676857,524288 --field-trial-handle=1968,i,17718933583885142144,4988990416118988649,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1304 /prefetch:8
  2⤵
  PID:1188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5a6f0410dacd7f299c998f04e525d7fd66ab2b3715f9d1f7daf5f5608a7d99f7
MD5 99fae23123f6180943dbfd23acb6e470
SHA1 2a59a47d7c786815b2e5eaed3b103b64e80ca3da
SHA512 c2ce794416ac8141ab352aeb2c5d5c865e278f318725139ca49c84936f2a6a14015a39a4f54dc69f581c24c78cfa8ed8c49625a54630ec8f9e318cc49db3f709
TLSH
T1EFE02BAACD219C770AF96B2820100746E74003163F91CD0F3A3D83498FB5A3B416792C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 bbe50d1747f6d889155b0bd5cd59305041d79eeb0117d806d2ab2d516c42b6e3
MD5 18b2e43ffedbc3f8afff6043052078e3
SHA1 f7626518e967b238696fdadf13da783ad85f6838
SHA512 928427e392eb7b39426d7ffdbef60da4bb17a55fcdebf285af402c0a8354b514d841352aab950abce66bc3f1ac07f3eb311d9cdfbdd0b9124533c76f95af3c96
TLSH
T1BD31A93696A825E9EF70BCB024984EB0273415E245935F0FCBFAD83D683B2FD5321490
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 010922938254a6c2325e09a7a8c296cc52867730921a40f742e1d26df3b2e25a
MD5 69fdf1c37fedc882330e6dd88686b57a
SHA1 2b5ca39007012dbb67405f37ec14337395e5bf4a
SHA512 e2888d1f921670790a57f592b1d4237e9f0d16410b8236e8c46fd7a9c1f1c9b7bb85d49dc54b97943b936cfe21b6d61fa085269c0066d2e5c3f07abbad1bdf25
SSDEEP 384:DoJGZWTHHRmHa72y17ttaIcSPKKnKNyaJO3j1QzKBwXj1PveVLtqk96K3/i4CVpP:phwvXi
TLSH
T13D628AFBC2E8866D8A1156F4AB147E1FCE2D0968436C3C56C9E8AF4F93E2471D34164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 342935b8f8859d846c77950186ea6195fc3f64ac39381bf5452682de44f60465
MD5 0c7e0a01f6fb47034941b1f256e281c4
SHA1 b838c33f69f9facb867e6bd9524ff6e34a1c35f5
SHA512 5ab3036c4db067e420671fbd053908c26a549dd226cc2145d6c4d68cddb52a7830dd120a71abde92c049db94131fcb081322870eecc16b9db47440a34c7e0194
SSDEEP 384:DoJGZWTHHRmHa72y17tViaIcSPKKnKNyaJO3j1QzKBwXj1PveVLtqk96K3/i4CVA:yhwTC8
TLSH
T1626279FBC2E8866D8A1156F0AB147E1FCE2D0928436D3C56C9E8AF4B93E2471D34164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 01b7aa0b1b22d07d841e6959b46c293bcb4f2f9085f57c71d111fd2c5ce3a44e
MD5 9253cf1108354721775440d485ce3ad1
SHA1 6de245f612752c8a70c7591b01f711a40502c224
SHA512 3c83a5fe825ab567fd53c97d47449ffeada630306d86d6387611bc9b0b5e9e79ac089d4a1841de9801456d530d674888da5f223e672cfbcb9c1763c0ae903b09
SSDEEP 384:D0uQtixzPBqVNl+BGjPE2MaIcSEdKnKNyaJO3jIkzKBQXj1PuZVtmqT9PK1/i4gA:ehwiU
TLSH
T17E428EFB83E8866DDA1196F0EB14BE1FCE6D0524436C3866C5D8AF4B93E2471D24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 93e0033c1527c8d010619866b5ec0d4173faa62019709b79dd62403d9c29812e
MD5 7aa67d257d9a929020e36a17d2341ae1
SHA1 d7c76c082a5088017be73bf58d5569d2234843a7
SHA512 2188428469926023b9bfabacd3ab359acd0c3031ad95a4fe89a367c6e1255b1ca9acc9e1846408b3383454e8de3152dc0008ea37f2f8708a31e1b466cc228f54
SSDEEP 384:DoJGZWTHHRmHa72y171aIcSPKKnKNyaJUh3j1QzKB0XXj1PveVLt2Kk96K3qjtiW:hhUnd
TLSH
T138528AFBC2E8866DCA1196F0AA147E1FCE1D0968436D3C56C9E8AF4F93E2471D34164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 947773c90e4a66fe13aacf8f83e2136c8c56bb0d1fb3fec9fdea793110ccd328
MD5 d366e73febea2f1cc3f31d2239d504be
SHA1 e2fd7058be6e6d7f2d4c069b9e7ab2ef4d433198
SHA512 f39859c68e04f3a6eb60b3e3b164f18b5e13a2a09673dec4f4645c1dd96524abbdbf2bc62b72d17895b78bc02cf3029b57c82a6d3eb0e4cb848cd68060ff10db
SSDEEP 384:D0uQtixzPBqVwNl+BGjV6TaIcSEdKnKNyaJO3jIkzKBQXj1PuZVtmqT9PK1/i4gi:1hwi+
TLSH
T1BE428DFB83E8866DDA1196F0EB14BE1FCE6D0524436C3866C5D8AF4B93E2471D24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 c4a1c404dcf4f1e6ec751f87247d5019e018fe5cd2694eaf59d9287acb8243a6
MD5 01b00908a12c5d01e70b0ea50d8e7759
SHA1 6e26f2a4049332b89c20f6a5b6b74937c1eb97dd
SHA512 b562c9487fa50e7b90369948ca6839c7fc500a8f620f0cebfbc010885e1eaafc9b890fc38013fb1030a9802a45ab1b41b9ff61215a50b1a0f5d87d3a70c42da6
TLSH
T1EF217EE7A27E749F11AC58BF8D44F8065A7AB435079228F1DE97417DF0824E71B0641B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 668ffc1418298386c20cbfc208db729073a5f023e49b9c45a324b509a646c6de
MD5 96620f023ad971510f539210e55ac046
SHA1 665dbda57abcb496b8d6fc7237dd4a51f493539b
SHA512 4dcb305e3818d1c4c73713ad6ffe62db2dc1858a9057426d0bc6aba1bfe8860d8c6829d7c77c47108e9ffac101b79d90ef25bf4b6166c8d5fe4b763e8b7f3154
SSDEEP 192:UhRzcBzN322X+y5mv7chYPRptqK6iLa6GiV29BHsb+WNeddFw5RBW5Ix+CP27M7W:UhRzmzNm275Sw8XAFJrwU/GT27+SOe
TLSH
T1EB62C75BA5201DBB9DEBD225F8227B5BE3F5102219902D84F6FC8E1C15E76CD2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a57569712960b3071325f92a272c6bd5de0f046fe3557257c1c6642bce3c083e
MD5 d9e28e21fe078b37b34ba13d57e65b0a
SHA1 1fb989ce129fb436c133f972a4748af99567706a
SHA512 ef75f1d0bc7a80321f704eaa04b6950ad09ba326fb613022f99a14169f537a68f516343b8b314d61f67c1882f04bf82d04b58ea2a1f0b6aa0fdbcbb81ce7e004
SSDEEP 192:UhRvN322X+BYmv7chAPRp2qg9BHsb+WNnBW0K7aYLLVJVyIsnAUgtaJ:UhRvNm24YSw8Xlgrws0k9v8
TLSH
T1E242E92EA91069BB9CDBD319F9267B57D7F5102225902EC4E6FC8A2C19E76CC321701F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d3a51b2bb7a5830e4db7ebf2242444eee01eec4792e50e19188bf4feb5252a43
MD5 b503244aabe54e051012fed30a2621bd
SHA1 cb4a047c22ab505018fd90c7aeb93030f1fd8591
SHA512 2b0f12e8ac106cec543841045bddcba80aec6b166206dcfc9ce508f5a21ee42ee402922dc5ee32954bdbdcbfe381835be683f4e07630cff573f52460ad209b6e
SSDEEP 192:UhRzcBzN322X+BYmv7chAPRp2qFLp3s9BHsb+WNq4BW4CP2b7aYLLVJ8yIsnAUg8:UhRzmzNm24YSw8XlErwsh239O8
TLSH
T10252D82EA92069BB8DDBD315F9227B5BE3F5102225942DC4E6FC8E2C15E76CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 af141577799ba53a8ee8a6bba146beee4d1ad04ef2c017b576d50233320fd450
MD5 1f2f0221cacf6df1a936930dd9ef4d41
SHA1 e9f0fc2e37b08ca948a2836140ad3dc418591746
SHA512 ffa49307637fc4bbde5475e46fcfed084b1698c276c925f522d2109a4eacb3995e425542d42f5ad18b2f3fa887121ce43222f1a4fb210fe8114746256e64c147
SSDEEP 192:UhRzcBzN222X+ywmv7chYPRptqK6iLa6GiV29BHsb+WNeddFw5RBW5RW+CP2QM7W:UhRzmzNj27wSw8XAFJrwU/eT2Q+SOe
TLSH
T18C62C72BA5201DBB9DEBD225F8227B1BE3F5502255902D84F6FC8E1C15E76CD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 07e5524e580be9c8ef4c235d04d4315c28c7d8d314609e4a43ef496639a8bff2
MD5 08586305944e0c0fb045263135251adf
SHA1 45590f0034f85c4146f8325a9250d00ba4e576d0
SHA512 c3d1430fc416843c00e554719d110e5bc9564da4d3df8543a3c357259d7956e813b4258a18d7f54e13310248c3a0d5c85cd8cedcb73268854fc397c32836cb9d
SSDEEP 192:UhRzcBzN322X+yamv7chAPRp2qK6iLa6GiVu9BHsb+WNidFwJ4BW5Ix+CP2dL7al:UhRzmzNm27aSw8XlFRrwucGT2dHIOe
TLSH
T17962B76BA5202DBB9DEBD225F9227B1BE3F5102265802D84F6FC8E1C15E76CD321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c5bf47f93b39359b79c6c739a5c4013135f634e4bea6cccd958217a01f768d70
MD5 b261e25808ae4e70e16a2a220173ee07
SHA1 aa38a807696d6a8cfa5eba7ab2754bc2c5dc305a
SHA512 71361a9cc81ee0abad2e850c8c39019c33c50bda4c7b25ccf0d1bfd3db76ba1a420aaf4290a6c09462163fd8ae6358707f8b51ac1fec107129e031699b3dade4
TLSH
T1F1B0128180015322C01203F8164314D8B134DF10DA0B170553E0A976C839261C019151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cdda.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cdda.TMP
Size 96B
SHA256 50516794f3699d021b0b855337766e0336c0e6aebe49ceead546120939fb65a6
MD5 26bb3229849a41cdbbb8b4f3f6903e3d
SHA1 35395fc21e0fac8490aad02ded66f8b4af83ea5e
SHA512 ed60c44c93678ae0a093d0d3c17d1a5aec72ac090c8fe2954fae60b15896c0299301d25b71c6c7be90edefcfeeafcf33c8ff274d055bc2e372a29dbfc9d1f247
TLSH
T1DAB02280C002B223C08303B02C80C0F832A0EF22C203220E8AE00A22CC2C2208222020
MD5 SHA1 SHA512 TLSH

Submit Download

bc59ac7d4bc27de1_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\bc59ac7d4bc27de1_0
Size 194KB
SHA256 b2e5b09ea80d8f9a511d9e62edacd5a21b15c9b6b26b933d8720a3aa87f0bbc8
MD5 fbe6f536db829c3693f289ef859a6a69
SHA1 1207e28d20458a8baec507f012a2993294977ff6
SHA512 99d8acd7bbc95d7aa1e57934dce751f83bd85aaf19395dd15b6b59980ab4f3c2b02b150885173532fa288f873531325a78270db4d92f45e0e322ca50c49dcbf9
SSDEEP 3072:uegF1cJu9zByRIZa8vj0QbJI1lXrZ1lThh:uegF1cc9zByRIZa8HlI93h
TLSH
T176146B316300F43BA9139E61A27F7F4E3C35A16BDD0686FCA1E4E870AEE6CB60515758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 b7202f5fdd630c3f2bbdeeab5b6da8475753713103417277d893bb9b106f04ac
MD5 790a19668cf523af67a7fac3d99ba456
SHA1 5842ff5980745729566820654061f0a8986a7cbb
SHA512 c7361c35cd2483d0e5f84a4912f439c84d0d944c3c972b08e95209ed9d5f8038db66e644bcc09b5e2ac376a736b8026bcc616948749878f501eba4d017279bd8
TLSH
T119A0025145C90DF1CC1002B3B4A903903320F8183299CB0360EEA4449D7235D7659206
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 c4afb05523d85b2deb1a8854356a5bd50d454532f05a06f25dd87a026cdcbbe6
MD5 89b266873f2c47da34641c19187c2ef0
SHA1 6567b27ff098df7091ca5672c68ee3b6f3578aac
SHA512 e568f7060ac22f71579d4fa9c1cbe041ac15ca8e28e889262d91292d6a685ff70dcee10161cef303fd5a38b75d2e8612e6563787b4e0c8df5e25aed7e421b618
SSDEEP 6144:+0SttY13Xb5zuXltKY1sK6hhFmUi21rSm8uUVNSlzYQ:uttaLI/KVK6hzfi21b8j8zB
TLSH
T18D3412217B53A9B3AEBC31C831477A195D7C6D439C21C6549207EF422CED38B6726DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 e78299cceee432feea061697b5d4457c66172d66c7c10fb6b82690fba7256c5c
MD5 b1596e72b0bc8ee24ac239bbff86fa05
SHA1 1eca85dc05cd126ab992f31713868584dfd39743
SHA512 21dd539f6e8b84cd53abb1cfad44194e4c8e795cac1d1948d70f2bb638d6cc8abfa8db9297a44b678fde3869b00fd57df27383535749e603a72b093d902a09b7
SSDEEP 6144:+NSttY13Xb5zuXltKY1sK6hhFmUi21rSm8uUVNSlzYQ:TttaLI/KVK6hzfi21b8j8zB
TLSH
T19C3412227B53B8B39EAC71C831477A195DBC6D439C21C6549207EF422CED38B6726DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 6331426a32417d460f7a8e8c4c24700f7c7ebb8039c48a48f89cd703423175e2
MD5 838baaf5ce377b053f68f50c16340d3f
SHA1 3a3966c09f400d1a85ded255bed6fe13d7fae568
SHA512 17fe7685c658a7d005eb074c9f8b25f02d443eef93979d14caf4efa8565075b512e3d043af5508d8df5bd02b1f50585fa92d4ececd4df1e69ea7ea1bb415f608
SSDEEP 6144:BSttY13Xb5zuXltKY1sK6hhFmUi21rSm8uUVNSlzYQ:8ttaLI/KVK6hzfi21b8j8zB
TLSH
T1983423017B53B9B39EEC71D831477A2A5D7C2D529861C2A08207EF422DED3CB6726D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 e1bd0ac8a8b607b5ef0b8c442091cefdfa1060ee4072164941c606b88af188d6
MD5 0bc65377260528e85da3ca2b29450a30
SHA1 6ae0dade85e9b5ba10e73ff84e6e928285c12a97
SHA512 85111a1cdf2adb00a6b39716fe2a61faa223e1e944bab1d3198cbadd4a103e8f5c2a0dd1400c40948a39abd56404de9f9b3bb3a776a3fe45476e342ecbd3eaa9
SSDEEP 6144:20SttY13Xb5zuXltKY1sK6hhFmUi21rSm8uUVNSlzYQ:mttaLI/KVK6hzfi21b8j8zB
TLSH
T1563412217B53A9B39EBC31C831477A195DBC6D439C21C6549207EF422CED38BA726DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0771c0c5e6173975b9b31958daa9afbf57ce18cac06cea3854ce3517f1172a70
MD5 4b9127832407fde9db542075a516af81
SHA1 6b4f38c20bab718a5e870d35ebe2abf5ee802d02
SHA512 7da6a689f01120634586d25b9ee1525aede7095eaae19231b9d204453bcc916737c0cb8cf9f3639816278807a10dc7d567cb802978eb57da49548d4827c934e2
SSDEEP 3072:ShFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:cFmUi21rSm8uUVNSlzY/
TLSH
T1FFC313007AE3E8F2EF5930447BEE2A149D6C4D818291C6415673AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 4015c78eb366c65eda1a04cda1d75c0770e8c7982f2ae8bbcf3c2bb080ddf14c
MD5 cc202a47e91c61fe979f99432d2796d6
SHA1 d5bcdbb025b60a5288901b9ca4085a3beaf2c1d9
SHA512 1e204ca56d73e573e7cafc65a6278444820c8ab67b8a1ac5082c4961f0fc4d05ed5de47696d004ecd5be14a6a1ae52e3cf4e154bdbfca5b3fdd5fe2beaf1099c
SSDEEP 6144:cSttY13Xb5zuXltKY1sK6hhFmUi21rSm8uUVNSlzYQ:fttaLI/KVK6hzfi21b8j8zB
TLSH
T1F83412017B53B9B39EEC31D831477A2A5D7C2E529861C2A09207EF422DED3CB5726D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 10038c59c3f1f844a0fedd4f4ec4b3ab6fa73ccfdefb8e28169fea72247828ce
MD5 c0658030e867a89a9d22438a21ce1296
SHA1 1691e9564fae344d83be8eaf64be2c771410e578
SHA512 4d2e7c192bad4117b6c44b1895fb2faa6722e1e6e2161e6121b5e35e2f356fe764822f7e50dd7ca6dcc05c6a5ca67584696bb42e6f20266d77ea46c46a1aaebb
SSDEEP 6144:4SttY13Xb5zuXltKY1sK6hhFmUi21rSm8uUVNSlzYQ:zttaLI/KVK6hzfi21b8j8zB
TLSH
T1933423017B53B9B39EEC71D831477A295D7C2D529861C2A08207EF422DED3CB6726D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download