hxxp://superbukster[.]xyz

Analysis

user interaction
yes
max time kernel
1800s
max time network
1119s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/06/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://superbukster.xyz
Sample260629-smepmsgv3v

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3332	vlc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3148	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272196701008213"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{DF6F534E-DB55-4FB9-8AB2-1368E2612B00}	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2564	vlc.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
3900	LocalBridge.exe
3900	LocalBridge.exe
3900	LocalBridge.exe
3900	LocalBridge.exe
3900	LocalBridge.exe
3900	LocalBridge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2564	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe
2564	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	vlc.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 3200	4900	chrome.exe	81
PID 4900 wrote to memory of 3148	4900	chrome.exe	82
PID 4900 wrote to memory of 3500	4900	chrome.exe	83
PID 4900 wrote to memory of 3500	4900	chrome.exe	83
PID 4900 wrote to memory of 2784	4900	chrome.exe	87
PID 4900 wrote to memory of 2784	4900	chrome.exe	87
PID 4900 wrote to memory of 4892	4900	chrome.exe	85
PID 4900 wrote to memory of 4892	4900	chrome.exe	85
PID 4900 wrote to memory of 3000	4900	chrome.exe	86
PID 4900 wrote to memory of 3000	4900	chrome.exe	86
PID 4900 wrote to memory of 3004	4900	chrome.exe	88
PID 4900 wrote to memory of 3004	4900	chrome.exe	88
PID 4900 wrote to memory of 3440	4900	chrome.exe	90
PID 4900 wrote to memory of 3440	4900	chrome.exe	90
PID 4900 wrote to memory of 1388	4900	chrome.exe	91
PID 4900 wrote to memory of 392	4900	chrome.exe	93
PID 4900 wrote to memory of 392	4900	chrome.exe	93
PID 4900 wrote to memory of 4912	4900	chrome.exe	94
PID 4900 wrote to memory of 696	4900	chrome.exe	95
PID 4900 wrote to memory of 696	4900	chrome.exe	95
PID 4900 wrote to memory of 1376	4900	chrome.exe	96
PID 4900 wrote to memory of 3936	4900	chrome.exe	97
PID 4900 wrote to memory of 4088	4900	chrome.exe	98
PID 4900 wrote to memory of 2080	4900	chrome.exe	99
PID 4900 wrote to memory of 2080	4900	chrome.exe	99
PID 4900 wrote to memory of 2220	4900	chrome.exe	100
PID 4900 wrote to memory of 2220	4900	chrome.exe	100
PID 4900 wrote to memory of 4556	4900	chrome.exe	101
PID 4900 wrote to memory of 4556	4900	chrome.exe	101
PID 4900 wrote to memory of 1824	4900	chrome.exe	102
PID 4900 wrote to memory of 1824	4900	chrome.exe	102
PID 4900 wrote to memory of 3132	4900	chrome.exe	103
PID 4900 wrote to memory of 3132	4900	chrome.exe	103

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://superbukster.xyz
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff2961c728,0x7fff2961c734,0x7fff2961c740
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,14242512150173477565,8619950772663463361,524288 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2152 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1568,i,17896072005851707214,2935350627187843702,262144 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,14350829336714489586,10294637559544500393,524288 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1860 /prefetch:13
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2944,i,10941280675978407191,11680224664577738042,2097152 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2936,i,13739195207246506179,7028085439398451592,2097152 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2972 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,10635423186090632618,2139919601878327987,2097152 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:9
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4556,i,10366437320810468332,3184342110448110909,2097152 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,2284733350805271176,13326990494310274599,524288 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5372,i,18087213867999043131,5082293927736512833,2097152 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,12764954802719259183,5825279362154110819,524288 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,5451974449661173677,13127739539206410963,524288 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:12
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,14632531235654455147,8880887486294216712,524288 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,8277912602986052839,16156798647509170994,524288 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,6722323205692020010,5476349924493590994,524288 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6188,i,2458083567581991550,4261918636040268698,2097152 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6132,i,2038006592925686912,16289221508539442988,2097152 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6196,i,12133605259425775373,6208838377167976633,2097152 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5600,i,1359232267392345740,17345999770863638637,2097152 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6240,i,9960463809503874024,6310620206340400402,2097152 --field-trial-handle=2012,i,9710097291479276799,11443390926294401361,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4028

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExitRequest.wma"
1⤵
PID:3428

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\FindLimit.mov"
1⤵
PID:5092

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\GetUpdate.mp4"
1⤵
PID:3572

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\InvokeDebug.html"
1⤵
PID:2388

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\MergeUnblock.search-ms"
1⤵
PID:2220

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\Microsoft Edge.lnk"
1⤵
PID:2348

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\MoveExit.docx"
1⤵
PID:4048

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\MoveRead.xps"
1⤵
PID:844

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PingPush.docx"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3332

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ProtectCompare.dll"
1⤵
PID:2632

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ProtectExit.mp3"
1⤵
PID:1680

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PublishRequest.wax"
1⤵
PID:4548

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ResolveComplete.3gpp"
1⤵
PID:4352

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ResolveShow.M2TS"
1⤵
PID:4524

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SplitCopy.xlsx"
1⤵
PID:5044

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StepRestart.edrwx"
1⤵
PID:1012

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StopMeasure.dwfx"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2564

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\TestRestore.docx"
1⤵
PID:1308

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnblockPop.dib"
1⤵
PID:3564

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnblockResize.mid"
1⤵
PID:2716

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CheckpointDismount.emf"
1⤵
PID:1820

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ConvertDeny.exe"
1⤵
PID:776

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ConvertFromRepair.scf"
1⤵
PID:3004

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ConvertFromWait.htm"
1⤵
PID:3452

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CopyComplete.iso"
1⤵
PID:2616

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fa77b75f8abd58ba7990606943058e5d40675a96ddbbab833dad4fbfbb8459da
MD5 7c5eaafc620aacc4d51f9aa22a721881
SHA1 067208043df58cb084fb9b3132be6cb0d5963afc
SHA512 5e77bddda5ed3bd8821589bc1ca63dd789e08be9fd6f21ec15e2f37b4a14a8c693c3dd0c22a3d4fa4e2dbad3b14ba6cefc4b563fead5161013eaef725c7dfb3b
TLSH
T188E022EAC831DC3708FD471CA0944A86E711035B2B80868F7A3C82088FB567A42AAD7C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 a1b1f7cd7767595b1ef3ec673d85489df10b0c14f994bc7a601befebdba9936d
MD5 719d2ced684317a00360a0b3f5a03d98
SHA1 a46ee77f37300dc36fad5e9f8ec306518dd4137d
SHA512 8a19055a41b4c077c85f23096c90e03f1f665955fd8d627616cb00f2af4c87c0007de39458f97f2c7540df99e5450b0a3dca14f81219196cc0dee7cf42d9284b
TLSH
T14AE08C45F5DB203CCB87863508A11C283379C1882C634EFFC38991BF21B67E64A2099A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 1e9265cbff040e10cae95d15b12bc9dc65fd43ffabf74e6cee12c97363c09cbb
MD5 384eb96861724bac08335cb79e0d2b5f
SHA1 4be421114a7a474a78a27d49dc83f2d1a11974b4
SHA512 706ff3a6638a17995468f05570e9f074347e61c9d0232bcb8a976fe4719e0c7287854c3f96b7fbb47a32869b1916a96c35b1b6948889426b360971a4fbd9bb65
TLSH
T1A5F02E17F0EBA1B8CB83443284D0082833B881632C5B4FABC38D50BEA0A23A64A90181
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 e2e1369751a53764c7e04dc93567731cd7883b888c0dee9260a0ff1f3678a978
MD5 2213ba90a34e1df6e9b3364569c89a7f
SHA1 24e5203808464eac357128d16777eb527b094200
SHA512 23f08f7596394b773de872c2973310cc7481cf7860fedd7affc7abb26421beeb761b4dea1887ffa46fde460cbaa88a0e9cbdeaf4d3941a9713a811e3fcec4fd4
SSDEEP 192:DUkCS/2weeCNAQaIaEd4nfn3vFPFYir2Oo5UHr7uBCO16hfAbAkA6AZASc1k57L:DUkCS/2weeCNjaIaEd4fn3vFPFYir2OP
TLSH
T13212ADF7C3E8CA2DCD0251F1AA657E2BCE5D092447683C5AC8E5AF1FA3E2471D20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 44071f536e0f90993575631322bbb36981df194edf2a081e77b3191f0345757c
MD5 7e24ec273dbb7a3a72563215c681f58f
SHA1 fcfc762bef146e62c966df0788b8d3840b2a7192
SHA512 9e2b4123de5148fe7adc545caffef367064cff5c5224792623893bc220e7d23d4a89cccc839a57a6c7cdc1f8839d02ffbbcc3d39e76934973151dd86eaf257eb
TLSH
T11C214FA7927FB46B207D5DAB0E05BC065C7A6435038128F4DBAB416DB0C65F31F26466
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 30c31056e6068dc81e49f6f69e2d89e171b9ef6867bd3f730e4c8437f40c95eb
MD5 f8f86a00ccadc2eda4463dbb428d810a
SHA1 81419888415c8a5aa020c5e95df395a5515d0ccb
SHA512 6a88eaaad35aefd7bfc999aa12d16d423390b54ab2ed9d06acd6421adb8bb55cc86b32ee7dc649b339a4eeedcff8a061707601840d6c0040ea8ce017f8fafc49
SSDEEP 192:RR1dvkNe0IhUOwPv7d+pAPRp2XQ9WHsb+WNnw+4ol23deO2u4YVyIsnAUge:RR1tMvH8UXdUwtV2R2u48e
TLSH
T12542C73EA910A53B9CCBC319FA657793D7F6102161D42E80EAFC8A2C15EB9CC211743B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 862bfe03d13b151b35f700286baa353a1aba54e4117f04dba85c3f03c9b64de9
MD5 735d836615e6a9a7299cc36658a2d0f3
SHA1 44c832268eb555f973c2606d212f093ee812f58e
SHA512 a0edb54a124b1fe6c9b226ae9b65cae8f7d2de7a64c0f12deda338db0f5365d6572688ade7f609185140449cfac2bb5e18b7234a932614e78ce864917f6beb0a
SSDEEP 192:RR1dvkNe0IhUOwjv7d+pAPRp2XQ9WHsb+WNnw+4VGeedeO2u4Y8yIsnAUge:RR1tMvb8UXdUwtpei2u4re
TLSH
T15642B83EBA10A53B9CCBC319FA657757D7F6102165942E80EAFC8A2C15EB9CC211743B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5f42a8b7f36a3358e5ed7942a415fa32ff3e78d834631fb70500caf60e56d4cb
MD5 6bfd997e533e79ced9484bff7064fc74
SHA1 9eda2006b6730b9840ae8d56f23840d390518992
SHA512 1378d7b76a0598d4f49d5d0cdf2cf071afbb86c7bdb3413f72578782d6bec13da655f7d1a5fb865cccfaa504afe22bbb2a56a4ce9737f4171117df3bc92d9fc3
SSDEEP 384:RR1tMvxB89nX6NJ6ZOUwpchJpYv2u0wpE:xt4x69KNJ6ZOUwpchsv2bw2
TLSH
T15862D76BA91059779CDBC329F961B757D3F62021A1D01D44FAFC8E2C16DBACC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 aa5ac95738e43cce65a9c719c1cb24b7ca5b7bd712ec475fb4d71d7f8264f3e4
MD5 3ff00ddfe415d8067c513d68270f01b5
SHA1 946658fceed2abdf0ee76e81ee78b698598d7fd4
SHA512 20fe11c8761622b551936544d475543183c4ddae0667d294b8c0369934afd8bc04d7644a3d12f06212fe52fe32785d4fdac07a6dfe92cd9208a463eff2db1304
TLSH
T131B0121080026101D44702F0225668F871346F30960A170553E46936C8365618455153
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5878f4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5878f4.TMP
Size 96B
SHA256 693d63f265d6ef13c5e02efb3c11c7bbd0d31a2b56cd6152ba6a246e23f612a9
MD5 1763771908f1765cc36462442f06a0cf
SHA1 2cbcb9fa5b433b8582bd688596650c330d87ecfd
SHA512 fef1c4319aa92fde93efbbc84e5d58d21be14945ef84dc21b13113d68b3a7968bad4e66949fe1d24e645a8b87b61c82a751b0a45c5023b13c8eedba286384dfe
TLSH
T18FB02280C30332C3C00303F0208080CC30B0CF28C2030202E2E00A3FCC30B300A28022
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\25ae204b-2262-46d3-9ff2-be70eaffe9e6\index-dir\the-real-index
Size 72B
SHA256 ba4dee821ea38c4ee1e5b321e825c574ac7c01d8e3431388a6613063e5b6ead5
MD5 d9f37cd137af1ca20b49d9ad47c50cfc
SHA1 f79596606854958c5b092a1c2955554f85988296
SHA512 0eb5cb8cf6e0c1ce3b77095de7377db8c99d3dc45732fd0cd0469509092a1fb1fe4c302b1387d6970514a62b591e771f2f0b418dbc37f8f3057472fd7b66b11e
TLSH
T129A0023D13570629C45117B4244705A172315910FE46421281E17184D8A59EB5157579
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58999b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\25ae204b-2262-46d3-9ff2-be70eaffe9e6\index-dir\the-real-index~RFe58999b.TMP
Size 48B
SHA256 987216f0c852dd573b06b071f212ec96606a28ab0af584b2809e395f8f6fb07b
MD5 0088d78aae785307cb04b7ebd3f425d4
SHA1 b119f9c9f09fb0f74e9cac6567442fe39d8d730a
SHA512 1b4679dc1b905a3b2577dcd6751f5026a149ff24cfd80d1b7ed923eac7c8a3066df2878fc731f925786c30d413a037f21282273538b80671709581e1a733db3b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 82B
SHA256 3057af1a71799327cf061d3d1dab5c5164363bde5bb0458271dc2d3f4e453c9c
MD5 bafac0ffe4b2a23a90e58bd1ade02653
SHA1 bbc888afbdf8f6d15de8abbec8cd1f5645501dfb
SHA512 c009c6abd60daadadcb264a12b79fe3df1a28d507aa39a4d245c9f1c653aff1306799811265474a51cc85bbf687caf8bee2129c1b19f2c95ee7631a6576af30d
TLSH
T138A002FB3902C08E4F30B9E93476B31DE45B998C8CC5DDF1E868E442323DAB20406A50
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 163B
SHA256 5283ed599b0f86ceffd314a0e68da89cfba1818121fdc04833df8fdd69f9d589
MD5 a3f508a950c591d4506327f8174e6a4f
SHA1 c013bd21443ff719dd3a36f176a6c7d0269af8ea
SHA512 895b2dd37cd4d83844d76671c680598d78d8c7dc6eda2a8c814dfb9f2a84e97027507c07cfc265b13330897eb45668e78d6d7009c19ea759caba687ab711c397
TLSH
T19BC08CE32625868A0B307AD02021B20CE4678C0D4CC0CCF8B495B20131394624804720
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 241B
SHA256 20fc16588f0c40bb5c37b593e1434d9b8d45993d2fe0e37303e927c9eb4a0aac
MD5 631a21ba7ae81990f2db108c7692730d
SHA1 4fe6e1371bc8da4ba39cf62637c4b9e38d3bd0ac
SHA512 703881d550c2b37745465a5b1ce0c5839a5e508de6ba8c4bc76b9387eea50c1af22d428944e363349a3197ae3047cb89e7c0ecfa69093a61308feac55837a0b5
TLSH
T10DD0A7D76636898A1730ABD05516305DD91B4D098C84DDF8E9CCB241307D5219515735
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 157B
SHA256 96e32b5ccf827bc4f27937a061077fc0cfa642eeea47c9941b08333c2b31ee41
MD5 50845e226bb7efe99561832cd375578f
SHA1 e78efe4b24b63bcfb78f3fc310fb72ec74de0dfa
SHA512 d52d16a59c45f75bc23d294e14a10573ca99c67a80d2a48bd72ce70719243d47e10811f754b3f9e65f58ebbbd54a360a5b10fa9ec377c70628cc736a285dd47f
TLSH
T14BC08CE326258A8E0A30ABD42016320CE457880C4CC0CCF8B4D4A20131394620801721
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5849d5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5849d5.TMP
Size 166B
SHA256 00478084bdc2ec8bfdc7d149dfe0ef24d583261354185239823b0942997c473f
MD5 20381888db53e4d882d201b8f76365e0
SHA1 b0c60e566046e6c0c421dcba88c7dbf182ed2634
SHA512 163faa011a2e7f7addbc11011d3f267e0f565dc4fb69e705162ee4664a7218ed83adebd47393bf2fab253c3ec01e91c3ac829f19e7dedecda56a883ddb9102c0
TLSH
T1D0C08CEB2E3280CE0F20E8F92836B24CE823AC989CC6FCE08C14F04531786A18005A18
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 55b663dd96466eda16813d6912a65f184de9814c9c92317d067fdd16bcc4737f
MD5 1fee60c986e6ddc2c8aa197f7fcb4676
SHA1 628274131a1a2245a633f98fbac4be44e5c9e0b9
SHA512 ec7d77573d7101eaa4468d8417d624e274e9b4d783363777b4877bd81619c49fa41d5dc9085183dd110ee11624b48f1afafb6dd6742914c0e008af539ed70208
SSDEEP 3072:xynzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:xCWDfxA3OnjrYQ9EU0/hEV
TLSH
T1E9C302A11C39BD660DF8EE98740D3E60AFF4AC9A92875CD3A2ED1F4C14FA5C81179931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f9d60ba25a461fdd626b60272b1e9f239200af78ca7bb7208bfa6096fcb93d84
MD5 f97056bb9c73c9802ab19d8549a7bf5a
SHA1 4c327d2226f8d4ec745874ae4062d02d83c5b701
SHA512 d27b7f0962e577794ea43259de3bf3ecd7fc7741deca8ae564854ed38dc333ab3e7058e5580d59a1c6993de918c2d39a10912bdfe343fe70f821fa9bd3382aca
SSDEEP 3072:AzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:uWDfxA3OnjrYQ9EU0/hEV
TLSH
T1ABC302A11C36BD660DF8EE98B44D3A60BFF4AD9A91835DC361ED2F0C14FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5fa737fdd8ad9952aeaefdc5fd713eadc7f784045c72dd5a7f0a782aacb9f618
MD5 e5cec622ab1268c7f13f7c08e21c39fd
SHA1 13ed6ed35246d1543013924576085a42555a47d5
SHA512 e6290513061c096865309d634415b83fcb64a18e2c1818688d2d089e029e84aff8d1f66541e98a6d7a9182d4a7ec1d32b47ce00893ef379bc4033cf82d8f33ec
SSDEEP 3072:fLzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:nWDfxA3OnjrYQ9EU0/hEV
TLSH
T1BAC302A11C3AFD660DF8EE98740D3A60AFF4AC9A92835DD392ED1F4C14FA5C81179931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 57e0198f5a42f20af7c24cf6c79dd2d10db5cedb382cb7f53ac6b96c03623bd0
MD5 400faadb17b20da83442e4f5d7f5b108
SHA1 463c6e51b9b3b9ed1e52f05f02e3dd4777d215be
SHA512 c82b10d162c94b2262984b67c712a7b8f6ba434c91804af97d252b8b4d6f3ace398a1572d9ec2d0f1c583031297ed1adbfce070a8547637ac481d93915373273
SSDEEP 3072:wLzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:YWDfxA3OnjrYQ9EU0/hEV
TLSH
T117C302A11C3ABD660DF8EE98740D3A60AFF4AC9A92835DD392ED1F4C14FA5C81179931
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 221KB
SHA256 bd043b31b6b640680c1e52c5b2e4590ec001756120fbe4c48a254e1eeb73730a
MD5 2d2a0c991ded1e62a2feb78c853cba17
SHA1 c92c6bd2b7cfdf53d0cbd7ea2d8867d8c388c9c4
SHA512 1c1402c5e76c92a9857ca97036b019bf60f5f95ac600502615e23fbc189a077059094be96fbb0d0da6624fa699799346eb5a68e1278cdb31b228309e6f72a767
SSDEEP 3072:zSVTnLk8MdiwoYXZJ9JrVjnnO89rNOT4yDzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/o:zGw8MRoQs8dKWDfxA3OnjrYQ9EU0/hEV
TLSH
T1F72413700C3EFC760F789A14740D5EA0FAB62DF7428A5CD651BD2F8822679C86935877
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 01654ac1f7e1518c8324095bb48c051f43ef6f04d56ee9b0760fc2f0161b5263
MD5 f0e3810820d1a76294ac232641de416b
SHA1 2c6d46e87919f1947ee5fbf5a236a1080f6132a1
SHA512 7f59d5c46a59493cfadee3b8f14ef98a07b2d5a0761cee6f6ab6f4895429488d8943f77fe95cea11e2158cc2829bb64261d71d6a4048a9492049910eb4e56710
SSDEEP 3:MsEllllkEthXllkl2zE/l4ZN:/M/xT02z1
TLSH
T1284404047FC51507C70111F44051C3501370D5100713774335510D335CC57400D40001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2388-492-0x00007FFF1DA00000-0x00007FFF1DA34000-memory.dmp

Download

memory/2388-509-0x00007FFF17E60000-0x00007FFF17E71000-memory.dmp

Download

memory/2388-489-0x00007FF6DB480000-0x00007FF6DB578000-memory.dmp

Download

memory/2388-493-0x00007FFF18440000-0x00007FFF186F6000-memory.dmp

Download

memory/2388-499-0x00007FFF293D0000-0x00007FFF293E1000-memory.dmp

Download

memory/2388-500-0x00007FFF29310000-0x00007FFF29329000-memory.dmp

Download

memory/2388-501-0x00007FFF1D920000-0x00007FFF1D942000-memory.dmp

Download

memory/2388-502-0x00007FFF19470000-0x00007FFF1949B000-memory.dmp

Download

memory/2388-503-0x00007FFF17E80000-0x00007FFF18210000-memory.dmp

Download

memory/2388-510-0x00007FFF17D80000-0x00007FFF17E52000-memory.dmp

Download

memory/2388-511-0x00007FFF17AE0000-0x00007FFF17D76000-memory.dmp

Download

memory/2388-508-0x00007FFF20F80000-0x00007FFF20F94000-memory.dmp

Download

memory/3332-496-0x00007FFF1D920000-0x00007FFF1D942000-memory.dmp

Download

memory/3332-490-0x00007FFF1DA00000-0x00007FFF1DA34000-memory.dmp

Download

memory/3332-497-0x00007FFF19470000-0x00007FFF1949B000-memory.dmp

Download

memory/3332-494-0x00007FFF293D0000-0x00007FFF293E1000-memory.dmp

Download

memory/3332-491-0x00007FFF18440000-0x00007FFF186F6000-memory.dmp

Download

memory/3332-498-0x00007FFF17E80000-0x00007FFF18210000-memory.dmp

Download

memory/3332-506-0x00007FFF17D80000-0x00007FFF17E52000-memory.dmp

Download

memory/3332-504-0x00007FFF20F80000-0x00007FFF20F94000-memory.dmp

Download

memory/3332-488-0x00007FF6DB480000-0x00007FF6DB578000-memory.dmp

Download

memory/3332-495-0x00007FFF29310000-0x00007FFF29329000-memory.dmp

Download

memory/3332-505-0x00007FFF17E60000-0x00007FFF17E71000-memory.dmp

Download

memory/3332-507-0x00007FFF17AE0000-0x00007FFF17D76000-memory.dmp

Download

memory/3332-512-0x00007FFF179F0000-0x00007FFF17AD8000-memory.dmp

Download

memory/3428-486-0x00007FF6DB480000-0x00007FF6DB578000-memory.dmp

Download

memory/3428-487-0x00007FFF1DA00000-0x00007FFF1DA34000-memory.dmp

Download

memory/3572-452-0x00007FFF29310000-0x00007FFF29329000-memory.dmp

Download

memory/3572-458-0x00007FFF17D80000-0x00007FFF17E52000-memory.dmp

Download

memory/3572-449-0x00007FFF1DA00000-0x00007FFF1DA34000-memory.dmp

Download

memory/3572-450-0x00007FFF18440000-0x00007FFF186F6000-memory.dmp

Download

memory/3572-448-0x00007FF6DB480000-0x00007FF6DB578000-memory.dmp

Download

memory/3572-457-0x00007FFF17E60000-0x00007FFF17E71000-memory.dmp

Download

memory/3572-451-0x00007FFF293D0000-0x00007FFF293E1000-memory.dmp

Download

memory/3572-456-0x00007FFF20F80000-0x00007FFF20F94000-memory.dmp

Download

memory/3572-453-0x00007FFF1D920000-0x00007FFF1D942000-memory.dmp

Download

memory/3572-454-0x00007FFF19470000-0x00007FFF1949B000-memory.dmp

Download

memory/3572-455-0x00007FFF17E80000-0x00007FFF18210000-memory.dmp

Download

memory/3900-4486-0x000001CBF6FD0000-0x000001CBF6FD8000-memory.dmp

Download

memory/3900-4485-0x000001CBF6FA0000-0x000001CBF6FAA000-memory.dmp

Download

memory/3900-4488-0x000001CBFA600000-0x000001CBFA6A8000-memory.dmp

Download

memory/3900-4489-0x000001CBF8D70000-0x000001CBF8D92000-memory.dmp

Download

memory/3900-4490-0x000001CBF8D50000-0x000001CBF8D64000-memory.dmp

Download

memory/3900-4484-0x000001CBF6A50000-0x000001CBF6A7C000-memory.dmp

Download

memory/4548-515-0x00007FF6DB480000-0x00007FF6DB578000-memory.dmp

Download

memory/4548-516-0x00007FFF1DA00000-0x00007FFF1DA34000-memory.dmp

Download

memory/5044-470-0x00007FFF17D80000-0x00007FFF17E52000-memory.dmp

Download

memory/5044-465-0x00007FFF1D920000-0x00007FFF1D942000-memory.dmp

Download

memory/5044-463-0x00007FFF293D0000-0x00007FFF293E1000-memory.dmp

Download

memory/5044-469-0x00007FFF17E60000-0x00007FFF17E71000-memory.dmp

Download

memory/5044-468-0x00007FFF20F80000-0x00007FFF20F94000-memory.dmp

Download

memory/5044-467-0x00007FFF17E80000-0x00007FFF18210000-memory.dmp

Download

memory/5044-466-0x00007FFF19470000-0x00007FFF1949B000-memory.dmp

Download

memory/5044-462-0x00007FFF18440000-0x00007FFF186F6000-memory.dmp

Download

memory/5044-461-0x00007FFF1DA00000-0x00007FFF1DA34000-memory.dmp

Download

memory/5044-460-0x00007FF6DB480000-0x00007FF6DB578000-memory.dmp

Download

memory/5044-464-0x00007FFF29310000-0x00007FFF29329000-memory.dmp

Download

memory/5044-471-0x00007FFF17AE0000-0x00007FFF17D76000-memory.dmp

Download

memory/5092-481-0x00007FFF20F80000-0x00007FFF20F94000-memory.dmp

Download

memory/5092-478-0x00007FFF1D920000-0x00007FFF1D942000-memory.dmp

Download

memory/5092-477-0x00007FFF29310000-0x00007FFF29329000-memory.dmp

Download

memory/5092-475-0x00007FFF18440000-0x00007FFF186F6000-memory.dmp

Download

memory/5092-476-0x00007FFF293D0000-0x00007FFF293E1000-memory.dmp

Download

memory/5092-473-0x00007FF6DB480000-0x00007FF6DB578000-memory.dmp

Download

memory/5092-474-0x00007FFF1DA00000-0x00007FFF1DA34000-memory.dmp

Download

memory/5092-479-0x00007FFF19470000-0x00007FFF1949B000-memory.dmp

Download

memory/5092-482-0x00007FFF17E60000-0x00007FFF17E71000-memory.dmp

Download

memory/5092-480-0x00007FFF17E80000-0x00007FFF18210000-memory.dmp

Download

memory/5092-483-0x00007FFF17D80000-0x00007FFF17E52000-memory.dmp

Download

memory/5092-484-0x00007FFF17AE0000-0x00007FFF17D76000-memory.dmp

Download