d2bf1fa245e510e5207b85cf4fc62a30f17f3465efb645179ffd6791761fd10d

Analysis

user interaction
yes
max time kernel
467s
max time network
461s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/07/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Game.exe
Size 60KB
Sample260701-wvprcsdt4s
SHA256 d2bf1fa245e510e5207b85cf4fc62a30f17f3465efb645179ffd6791761fd10d
MD5 614d5d0a75834c109e257d86c67d356e
SHA1 4222003595ac21675dd0d606ba3675713d4a92d0
SHA512 a79bd3a4307ac52abe66864c54e6288d3393b70a573e2d75b24aea4a44f299f9044b2987c495f01f4bb718a446b6044c9740fc3bc78ea352110f8769339f7c8d
SSDEEP 768:XFlWv8mkZ4fklKF6+eT3u5LXcFRqzjXmsVmrowxGLvs3TLGlKbFv5MS:VlWvkZ+I+4u5LXcs7jVStGLvdo5l
TLSH
T17C533A557940D0B2C082A874D861C7F05B297D32ADA9C5937B963FEF7F317C19A2A30A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
544	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274033790896226"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1131776342-1023621610-2767477260-1000\{F6C25102-BB18-400B-9219-76B864EA6160}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
4160	chrome.exe
4160	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe
Token: SeShutdownPrivilege	5164	chrome.exe
Token: SeCreatePagefilePrivilege	5164	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe
5164	chrome.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 1620	5164	chrome.exe	93
PID 5164 wrote to memory of 5480	5164	chrome.exe	94
PID 5164 wrote to memory of 5480	5164	chrome.exe	94
PID 5164 wrote to memory of 544	5164	chrome.exe	95
PID 5164 wrote to memory of 4788	5164	chrome.exe	96
PID 5164 wrote to memory of 4788	5164	chrome.exe	96
PID 5164 wrote to memory of 1112	5164	chrome.exe	98
PID 5164 wrote to memory of 1868	5164	chrome.exe	99
PID 5164 wrote to memory of 1112	5164	chrome.exe	98
PID 5164 wrote to memory of 1868	5164	chrome.exe	99
PID 5164 wrote to memory of 4220	5164	chrome.exe	100
PID 5164 wrote to memory of 4220	5164	chrome.exe	100
PID 5164 wrote to memory of 5772	5164	chrome.exe	101
PID 5164 wrote to memory of 5772	5164	chrome.exe	101
PID 5164 wrote to memory of 3804	5164	chrome.exe	102
PID 5164 wrote to memory of 3804	5164	chrome.exe	102
PID 5164 wrote to memory of 556	5164	chrome.exe	103
PID 5164 wrote to memory of 556	5164	chrome.exe	103
PID 5164 wrote to memory of 5316	5164	chrome.exe	104
PID 5164 wrote to memory of 1928	5164	chrome.exe	106
PID 5164 wrote to memory of 1928	5164	chrome.exe	106
PID 5164 wrote to memory of 5944	5164	chrome.exe	107
PID 5164 wrote to memory of 5944	5164	chrome.exe	107
PID 5164 wrote to memory of 5416	5164	chrome.exe	108
PID 5164 wrote to memory of 5416	5164	chrome.exe	108
PID 5164 wrote to memory of 1632	5164	chrome.exe	109
PID 5164 wrote to memory of 5768	5164	chrome.exe	110
PID 5164 wrote to memory of 4280	5164	chrome.exe	111
PID 5164 wrote to memory of 5056	5164	chrome.exe	112
PID 5164 wrote to memory of 5056	5164	chrome.exe	112
PID 5164 wrote to memory of 4012	5164	chrome.exe	113
PID 5164 wrote to memory of 4012	5164	chrome.exe	113
PID 5164 wrote to memory of 2528	5164	chrome.exe	114
PID 5164 wrote to memory of 2528	5164	chrome.exe	114
PID 5164 wrote to memory of 6072	5164	chrome.exe	115
PID 5164 wrote to memory of 6072	5164	chrome.exe	115
PID 5164 wrote to memory of 5176	5164	chrome.exe	116
PID 5164 wrote to memory of 5176	5164	chrome.exe	116
PID 5164 wrote to memory of 2112	5164	chrome.exe	117
PID 5164 wrote to memory of 4160	5164	chrome.exe	118
PID 5164 wrote to memory of 5804	5164	chrome.exe	119
PID 5164 wrote to memory of 5804	5164	chrome.exe	119

C:\Users\Admin\AppData\Local\Temp\Game.exe
"C:\Users\Admin\AppData\Local\Temp\Game.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffd1241c728,0x7ffd1241c734,0x7ffd1241c740
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,18193364741986611508,8472231863307015206,262144 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1624,i,15552093790780504650,7378691737154459909,524288 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,5151047900534268386,11302368517617673688,524288 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,2249337096633704284,4657895472087481175,2097152 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,17389865555850001505,14383345445437676778,2097152 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4324,i,9054764647045809246,13627921182601921524,2097152 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,4935011941724749515,18105279825792074030,2097152 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,17388881064728924171,16316757599256734916,524288 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5024,i,17416680076493767925,14426957764304301987,524288 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,16359354717165718154,13378133251412483712,524288 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5676,i,4324779833307188232,11675851226855255849,2097152 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3228,i,14451529132888465459,17266131382367288461,2097152 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3264,i,17358696618252180651,11766393733151939575,2097152 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,11768402762497725608,16253800313117085014,524288 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,6202074944374160821,17935994873262246492,524288 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,14693594720839235756,11781097976455230258,524288 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4376,i,2817792187175117619,5503307068543750795,2097152 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4464,i,10340760254288003477,17624039236373292691,2097152 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5728,i,3893756301332196294,7964877926548532152,2097152 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6044,i,2430887301191159861,4899767391088601672,2097152 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3316,i,15146953178975598074,1012403129695593226,524288 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=904,i,3826160143077170579,8182819810764741752,524288 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6160,i,12011126300303959224,5884397730472035082,262144 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,7964020330749832239,1223341822613964990,524288 --field-trial-handle=1916,i,13165278316089484737,10881894263526618672,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:5804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e011f5f3cb9c52a4a96e139f3b7d3eb32f8c17f22f149c4aa4fd25c1c6056a1f
MD5 82453f4426feb1544ad40c948eefccf8
SHA1 86c6c7e3c84dc82e371af4a3672322fc99f840f9
SHA512 2fca4bd3189393987bd68bce402c98284f772247a6c659c08b939c099dab04deed0b32269b6240cd4d083c8731c477cd82eeaa7384d84c6adad4066b90c6b66b
TLSH
T188E022FAC972EC3B18FD1B2920984B42EB8213576B50854F7B3C814D8FB1A3A428681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 1024KB
SHA256 3cdbac15e0f6931c8382eef84ce4c72c3d0c5ea6bd7587b41f99d68566fd6086
MD5 41acbb87ce56aea91621d023bf66c2cf
SHA1 d0eced1a9479719e35134a1eb09fa74f0a488d50
SHA512 29bd6ddb6095266bc0bf0dff253519a7357cd4f657867babd37a62d4147d6c7c822b97a531e0c21cacce197f7948684e6ca517000ed0b627a6dfce42bd172282
SSDEEP 24576:PU7dZQ7ofsozCsq0oJKobF+kx9P545bN1aOGNF6xBKz:PO+84JbJxB5+74F6a
TLSH
T1C025332D5910BCEEDE9319357C339190C19FB62263572B1A0C1AB8896E581F3DF6173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 1ed7a3f33d0a36ec61767d601cd28b221394a66299b49d156ea74338e58b0966
MD5 2d8d32a0eca32d40f45f68344a74349a
SHA1 3db43ea41ab4251eb742a294dcff80ba4dee4d82
SHA512 6f66d4dd2e4f061fd88accba21f58b46cbebb01d2c93b2806efd86a4ea2968276ba7bb545682a28d5cf889ee7563861fa571b4bd13dabdf6ac39cce302e9fa6f
TLSH
T1C031DCAC33CB51D0CB5B8071C6F6E92176B70E9A05233FEA02148579B3B239B5406DD7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 855948dce45d44c2751adbe1bf2157a1aade065ba482008d994147725e210867
MD5 63d13d4f579e9fff80979bcddc55d971
SHA1 4e242528a323843327d2519362c74f097b211ad2
SHA512 c4cfe681493feb609ce3d7501dea3671513effe3fb1f30c8b73ae63a9111b6124b548c6cd73ebe7df956dbe178b22389d72b1da5727584952b34b0b9e44adea4
TLSH
T1F8F097BD33CF82D6CF370131CA7A0A163B7229AB5A2063EA02494524D5C32A89D08C17
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 2610766494df58e588e92729e2a1e46c2d5a49c33f0e000fa8471c26e8c104df
MD5 0bcdc659faf52db399c942ddeceba2d3
SHA1 d54dcce3314bbccc8ae24fbfb7b383df3654ef4e
SHA512 1a7e4cee8b5cdb3b11e53a3a11acc1f737bb1fba0202b768a8a7b32a4d67a442b1f2c3595bcc206e372ffa8c3c9f15ffb5c83f87fa9afd9b166d40fa63da256c
SSDEEP 384:D/i1dQkUJbJoOqfDlQmOeDPSaIsg/mXJYba7Fce7N0Zu0BQi1qvI+feNpNH+JQti:FVwSPpaCc/TV
TLSH
T15652CDF7C3E8862DC91252F5EB256E2BCD1D0928432C3C56C9E4AF4B93E2471E315A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 077e6741717df3c3efd35703962f205df4e2499aeb6a8a70ff64af314a76b820
MD5 1c01f995c8e58d7e1861a2fe2409aa18
SHA1 fef1d9d6b30941b316443a07e2cc82a7c1e8be56
SHA512 60ff838ae54a2c01a82eb0a6f6356dcfe8ad838a983abbf8050ae24c73a1e51fe9902b3c7b9b00123187d6affa2e5ff2faff4c0d741793c7f86362696e65fa87
SSDEEP 192:D/i1dQkUJbJoOqfDlQuaIsg/mXJYbaPDFce7N0Zu0H2QivtqvI+fPi2NPhNH+JQS:D/i1dQkUJbJoOqfDlQuaIsg/mXJYba7L
TLSH
T10F42CDF7C3E8862DC91152F5EB252E2BCD1D0968432C3D56C9E8EF4B93E2471E211A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 1c4a1a8b2210a852bce8cc032d444b148f5a71b0b4059fe8e523053327062fda
MD5 a66e6ae1284cfc180f541f267073b2e4
SHA1 01a05badb0f44c89b6c385e390ba788100f753bf
SHA512 12e3590c86e7860136fa39167a6d4c95520b46ec6d61125118060830a8723296f0af4076936506a8d4c57fe0b4fbfa9da117650e2dba1d1b4c9de09a0b56122a
SSDEEP 384:D/i1dQkUJbJoOqfDlQmOeDzaIsg/mXJYba7Fce7N0Zu0BQi1qvI+feNpNH+JQtAS:FV9SPpaCc/po
TLSH
T1AC52DEF7C3E8862DC91252F5EB252E2BCD1D0968432C3C56C9E4AF4B93E2471E211A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 8b634a11e0ee6c34c2c1f605f04888c3a5cc437d4f2791815e4ec44280c1b884
MD5 873c7e17b7ae412ee303f9ba21d20902
SHA1 1185e9f020e83b2915958a354e15896c2a459d5d
SHA512 ce11783181f10e3b10d009df25798bdf16521f2da90b923af8f9cca6e27527c22e13968eaa801f44ebd632fb85d82a7f67350e5c1ede08b334ca19e289297746
SSDEEP 192:D0utlXqJJ5JE+ajwNYD4eaA41aIsgEdXJYbaPDFte7gB08SivqZvImfPiNPiNvJm:D0utlXqJJ5JE+ajwNYD4eaASaIsgEdXJ
TLSH
T18132BCF7C3E4866DC91152F4DB266F2FCE290928432C3C66C9D4AE4B93E2471E251A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5ea78dc873803712b4df087823d8759024485d46d066a641fc470c4bd9ce78c3
MD5 9545a04d8a4af0acbbdaf2afcf1d55eb
SHA1 4ec3e12762c68fa12e82396f7fc34ab4a6596cd6
SHA512 10d0f564f50f57765749ceec33841fc0b74fee4768c6933858a187f2516c7c85728fc0e2f555ef3695ee60a5855f5b2bbca97c9a78b07920261b5671d8ddca56
SSDEEP 192:3REcBh+Sc8BHsv7SIpAPRp2hsGqC99jHsb+WNRCUdK49iYMCeW2JAVyIsnAUgraJ:3REmh+s4OIUXUxw+rYD2JEe
TLSH
T1D152C72FA950297B6CDFC22AF861BB5BD7F7102125941E84E7FC8A5C16E7ACD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 08af6dd2b5274d57c9fdb1a1250c23e1db508df234babfc5073148e3b239f1c4
MD5 b2f6e06fa5e8f3ae4b27c4a3967f025d
SHA1 7e64530682f01099ab31e1d130380a990bb3961a
SHA512 07ba92869ab375a06b4a760390b051b2250b3ee044b71fad0b20d27db1c319dbb476229271e0d3b5543c9cd6408a35520d0787e7fdcbb9cc3ad5f56394eea453
SSDEEP 192:3REcBz+Sc8BHKv7SIpAPRp24OL9jHsb+WNndK4YH2WCeW2JhVyIsnAUgtaJ:3REmz+sGOIUX2xwob2V2JH8
TLSH
T14252D72FA910657B6CDFC22AF861BB57D7F6102125952E84E7FC896C16E76CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3f4f9061783425cf5c6c15c469aa0d34f5f4309dfecb51c565dd5f020bac4a92
MD5 e492def593b7c6bd819287d974e159e0
SHA1 9dfed47263e3ca9b78e9326a48aa4fde481a679c
SHA512 044d60b8650d53dad3be46fe0cf5bceec48b4cbc44c6352638bd3741dee4f5d22ab4ea45aa0c8ec3dbbcb9440f162dca24490e7d9125c6e9c08014fbcee5a225
SSDEEP 192:3REcBh+Sc8BHxv7mIpjPRp0hsGqC99jHsb+WNRCUdKqokcXw9iYJ4CeW2JSVyIsB:3REmh+shqItXOxw+R3XDYJH2JSe
TLSH
T18A62D82BA960197BACDFC229F851BB57D3F6202165D41E84E7FC8E5C16E76CD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d2b43f027fc945866cfd9e0d6effc971b067a00cc0860fc2bd70c30b68b1a26f
MD5 85a5efdc659655acc9df82c050ee811c
SHA1 81dc4f618fe55a4250701a0d8205f025bd5abd1a
SHA512 589f3adcdde6614195ccdb50a227aa5ae91ea19ae304109d307ad115f32ed50303c109ed6824d9443e55b0bdf402cde9fe4d8e9d67cf09a1ce03e3bc21d8b95b
SSDEEP 192:3REcBz+Sc8BHOv7SIpAPRp2hsO+S9jHsb+WNR5MdK48Te1CeW2JAVyIsnAUgraJ:3REmz+sqOIUX0xwDDe02JEe
TLSH
T1B752D72BA950297BACDFC22AF961BB57D3F7102125D41E84E7FC8A5C16E7ACD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 06b570cb521b23c365b310516bb6af480a0ff05371f795f792a7a9c0bd194bb3
MD5 343a39de611323bc17f77aa7745bae42
SHA1 fa94afe29a835c1520d7e033078fa78c1143d0b1
SHA512 15ba776d8050d2aa6922f8e6bb2162b7fe841ab363007d3cf7a41eb6e1a2d9d21cf75fb8c8e3ced905b05529a99fdc979f5cb66fc842c79be4a8aaae84b6d2c2
SSDEEP 192:3REcBh+Sc8BHsv7mIpjPRp0hsGqC99jHsb+WNRCUdKqQP49iY1CeW2JSVyIsnAUp:3REmh+s4qItXOxw+NrY02JSe
TLSH
T17862D72BA950197B6CDFC229F861BB5BD3F7102165941E84E7FC8A6C16E7ACD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 340c95adffe454574508f600d77034d3342a35f4c7ff76776a503d74223a17a3
MD5 14d294c675ca88a5323dadaa60b3eeb2
SHA1 1d42e55f369e9b5e06b8d56ed3a27186d0431868
SHA512 e3607c2a935bc4cd11d070ab4fabc9f3bbe0567f1f5447d59aa013623624181b62cb5e597c94c5fce04a8009fca86aee760581fa9ab40a95128553db2f273adb
SSDEEP 192:3REcBh+Sc8BHXv7mIpjPRp0hsGqC99jHsb+WNRCUdKqBeM/9iYsCeW2JSVyIsnAQ:3REmh+s/qItXOxw+5zYj2JSvE
TLSH
T11162D72BA950197BACDFC229F851BB5BD3F6202165D41E84E7FC8E5C16E76CD2117007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 802e9731416dfdde734a8c32f9b3498a8e31bd2c38f48aa230a91669dda7d98d
MD5 474334982331e518f7838e3a6ac4dd31
SHA1 1973b89cc10dd3526936b57957d19ff668a8cc0a
SHA512 39ef8891d0bd7543d4dbbbc01474f26a7f3bbad22fdf03d701305ec2f04cb21fa591f772d4ae9b084aca0d6fde9bdf11aaee5e34a3049fcca670bc167fbba07d
SSDEEP 384:97j3e7KxkXqKf/pUZNCgVLH2Hfgsl3z7pLuLcSjJ0XOD3a+ErU3klHGu6p2gAR:933e7KxkXqKf/pUZNCgVLH2Hfgs9z7ph
TLSH
T1EA72E8677C4C9A770F94C9CCD826BB4FADB6014A65DDD85883FA982503D6BCB01061F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bba0f793c61eab77d180dcee8fec499a8e14db6a4af318c5858eb2aa4987f7d2
MD5 502ca37f694075930f77415b5b891697
SHA1 b6df8cbc7729d20dfe5aea2abf0a65e2202a720c
SHA512 5a33747c36bdf9698c87c5477d59eda58b89ccaccbc01c7b26ddd3d53a947aace0df1d7009c61b087406e4bae846cec300a16b0109fb609282a71b1f3f2ae663
TLSH
T1D3B0128080019201C00306F4115214C872149F30960E1B0657F06D2288251A0C1150A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e72f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e72f.TMP
Size 96B
SHA256 5a2e56c024befdc34424435254e0ca11ed1de7fc6caa72861508a643c52a0df1
MD5 55d0aebbcf7e49797a63f98caa88142c
SHA1 a7d6d473d9b016f65bfb3a26f349c4b7b515d189
SHA512 56430a5509a78f5404749267872834a0a70262d7198a180f52d6148055c57b3a1ecb6ed6a7d8dbaf784e757052fb98e0d6dfabb91a4630ce53dc7df7378e520c
TLSH
T14EB00299C2036252C04213B02996DAE87360EF36C7235217D2E15F66FD256609569570
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 0e3e0b2a546fbde2e9377bdbfa941f0e44e7d747fcf0fa386f9f616639db5df2
MD5 6b1d7bc5df81ca64c6181692e288fbca
SHA1 b2003deff2f3c822102bf3a93ddb52a37138a48c
SHA512 ecec5c63df00f12875dc7e6c0c417c2689ce61152a319283e8efaf8b2e717ccdf18e7e3ef3053fbf26c9819b28b0c017e332817236874bbd64f8d1de3a4b6770
TLSH
T17DB002D46D445986C46407BA23D6E1A833352D255713911358B1AA6FCC36B49CF1DB82
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\7034be34-3296-4784-b2f8-5a4939e070a3\index-dir\the-real-index
Size 72B
SHA256 6f7dba6d5fec5fd7bf04be54035716e79d4dd23722dcced33093401ab65957c2
MD5 5d3e2b7b2ce3b557c6869455e88fa519
SHA1 9a1f7375925bba271328dbe9892358e525a9796f
SHA512 fd93116d2d4a6722527fae0e5661980e5a6f7399feb7e0147d179a6fc8ecd0cee552bb635a80f96f403b7e6d25d55a38793e7c092548a22df89a310e2eb0335c
TLSH
T1CBA0026801500225D81452746457017633B54964EA450742C1D43586C8916D59143138
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac19c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\7034be34-3296-4784-b2f8-5a4939e070a3\index-dir\the-real-index~RFe5ac19c.TMP
Size 48B
SHA256 fa52a86997a9b5d4c275d87768a9edcd63f198d3ce4ebdaf4d4ae79a2a7c2be1
MD5 b0058f8d99f39c26cd6ec32e68cdb039
SHA1 01e480ac9d1d912a875b993a8aac488c3b41327a
SHA512 60fa46124befe8b561fd7b60f0eb47bccd3b4e5f05d311da30df379bfb92922f746585c8ad0a5ecb8776ac483d19212ce4e2e8fbea5e42798fc72f6d0aa07a10
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 232B
SHA256 9afbcb1d157facd2b64986f9929b2cadfe9725de5779ac8854a9846706d407ac
MD5 e5e07988b1cfd7bce3c18240c9bdf60f
SHA1 7871fdbf99dac8dd3ecf9f6e3a40defaf5dc7347
SHA512 f96e2a1d8025e8b3dd4f5938f42581a176009602f28c50f84975dc7789c08bac650f94876b9f365bb3c5f6ab37e269702d5bc648b1faf02c7d4f9d5319df4a83
TLSH
T1FCD0A7EB712258551774A7C82435350EA41A5D0EECC5E8E57A44B05266F4E11C912528
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 149B
SHA256 1a92520c871973a94eeeb31e5cbb6e21731aaa46e91e36b51f167308f3aea684
MD5 9d978660322f00121a4dc095e5b6f92c
SHA1 92a4496c0f1188ca1bbae5ad71266764a5fb2b45
SHA512 9c44b2519947bc20153e411686d8469651f0ec977c95a4bcd79195763814a642070e623ce7731e70153a5277253003daad800099acba263ff702fcc8a6da007e
TLSH
T117C08CFB2102448A0AB097CC2039360EE807860C8CC4C9E2A608804222F4D224911524
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 148B
SHA256 63f506ed6982287d1d328316e9226e918d62fb62ba28a49f263eaa153d6db1cf
MD5 63446c3cd573c84f0f658004fbacc580
SHA1 b565489831108bfdbf3569e29e8ac6b342811354
SHA512 7c866e272f75223217ca528035734d9d33bef3ca7f223cdcd92ea3722589997ca88b6b6ed50c2aff5bac6884e60451da04eef8de9c01e746b2979283831062ba
TLSH
T186C02BFB2102548A0B74DBCC3039370EE807860CDCC4CDF2A60C804223F4D228502524
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe597a28.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe597a28.TMP
Size 155B
SHA256 482ef9a1f1ecc089912b0b2439dfa135df3f35724dfd96ec5d531e4cd218ebf5
MD5 7bdfb561d5c6cca6fe562bb34c925039
SHA1 1fa670575775926811e638f0a5dc92c863217aef
SHA512 180c1d878acd1e6ec9ce3033fdd737fd0c8e216b0dae85cd47fe2e0ae6c3bf2034f403392ff2dd7cb1a9fe451db130942faf7254776fb93d4dd9f43cd8bce304
TLSH
T1AEC08CFB211204860B7197C82038360EE8178D0C8CC4C9E2A608B04232F4D228610524
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 e8516656ae9a5f8325e72a81211ea3c188e48c467aac95ac5855fc2b7f3bc86d
MD5 6ada0f195b22cae4f0250f8eff6f58f1
SHA1 7a7f0d7a7c4d8d1e207953d270f01f80f5bc2f18
SHA512 0026bb55473d3879ff890ba6d2fd0d01d344c41d82e991fb0e67e17dcc580d17b095b6709d748745a0d488efb4d6e6f5287256e43d4c28eb8546b4918d24db29
SSDEEP 6144:y8mg1kQfATCFbzQACjE3LfqBZqenbyyVEd1cB1H:bneAxLCVDuenH
TLSH
T1A934233289E46EBE2315097231071B246DD69BBFCD927F8C413D1FB6A1C6988AF86C51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 9781aa571a330351adda9785aae13857aec22752735f5371aae0f81f5fcd70a5
MD5 5c8f213ddd5e547b1f9d131fffe0b1c8
SHA1 f0e82f7b66cee51ae4be15a7e432b50d0e9db5a1
SHA512 f8a5aa188f3eb463cce45f69554333c78f910895b8c0602904612a67383d2abaed0a1f220013abbd22e71173d4723cd0ada580467ebf1d27100ec1ddfb82704a
SSDEEP 6144:RZmg1kQfATCFbzQACjE3LfqBZqenbyyVEd1cB1H:XneAxLCVDuenH
TLSH
T12434233289E46EBE2325057271071B246DD29BBFCD927F8C413D1FB661C6988EF86C51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 cfa94af8401e892d7d561eaedb0beebb628cd471e4c05c9ec80ec3b0783326a5
MD5 cad35f6358e91daf3f45906d46cbfea3
SHA1 f3ac5908c7fd049e62dda7b35e67f6e437fd61f9
SHA512 a1d3116e84d079a2653ebdcc16f14a7065ec3d4316f9d6254f293745f060e42e12d7e18a9a7739cc6d786879314ceba13e350d50caba2a7e08039f36a914a2b8
SSDEEP 1536:XmwZlAmf1mWUYZchNBoXUF1F8Mh9azKCW3iw9xODQ7B6wQtLPyedtK0XMBg/Qu+y:Ww3LffUnBKU/F8enCW3iyVEXGey0cB1i
TLSH
T18EB31231E5A6FE6BA369462AB40F93181CE249FB44E1B788447C3F19F0C6288EF58C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 e0261a923c624fbb325c0a7b64b04a3f8e7479ead23dacdf94f33d2fef078401
MD5 8434db590b16a415e203f49cfbadd7ba
SHA1 9ad8d688fda1c43c77d058a8369fabb97930e014
SHA512 b4ac926bd8ce00c7f5dccf25b19544dac7ff84321a117faeda7c4c7b551fb61e1ca3f362038f36d5467af65badbf1a259239936fa739f57521ae25c1b9c0785d
SSDEEP 6144:Zmg1kQfATCFbzQACjE3LfqBZqenbyyVEd1cB1H:pneAxLCVDuenH
TLSH
T1DE34231199E4AE7F2359057271471B38B9D24BBFCDE22FCC413D1BB6A1C6984AF89C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 8e95598456fa868316bd7406c3d9e07799568fbe8a8c999e3ec10efc68e0ac92
MD5 bf561708d700035c569552d4a8a960ee
SHA1 abc3a1380caf25276d3c8f36f535ebb12703b6cb
SHA512 5a9e65ccc05ed8e23275b1e00dca6c64ab15617f4a7289a703da39628f6af8902a1e6a4e82d41031f348d344de029a2600aa7b233ab27b6333c6372d01b69a77
SSDEEP 6144:1Zmg1kQfATCFbzQACjE3LfqBZqenbyyVEd1cB1H:LneAxLCVDuenH
TLSH
T17C34233289E46EBF2325057271471B246DD29BBFCD923F8C413D2FB661C6988AF86C51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download