hxxps://gofile[.]io/d/KJRz6r

Analysis

user interaction
yes
max time kernel
899s
max time network
868s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/KJRz6r
Sample260707-vah8eaay2p

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
17	1108	chrome.exe
17	1108	chrome.exe
17	1108	chrome.exe
21	1108	chrome.exe
15	1108	chrome.exe
20	1108	chrome.exe
28	1108	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
1580	tc1.exe

Loads dropped DLL 4 IoCs

pid	Process
1580	tc1.exe
1580	tc1.exe
1580	tc1.exe
1580	tc1.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	api.gofile.io
2	api.gofile.io

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1108	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279164387259349"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
2316	chrome.exe
2316	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2164	812	chrome.exe	88
PID 812 wrote to memory of 1108	812	chrome.exe	90
PID 812 wrote to memory of 2868	812	chrome.exe	91
PID 812 wrote to memory of 4052	812	chrome.exe	92
PID 812 wrote to memory of 2868	812	chrome.exe	91
PID 812 wrote to memory of 4052	812	chrome.exe	92
PID 812 wrote to memory of 4068	812	chrome.exe	93
PID 812 wrote to memory of 4068	812	chrome.exe	93
PID 812 wrote to memory of 2600	812	chrome.exe	94
PID 812 wrote to memory of 2600	812	chrome.exe	94
PID 812 wrote to memory of 2492	812	chrome.exe	95
PID 812 wrote to memory of 2492	812	chrome.exe	95
PID 812 wrote to memory of 1580	812	chrome.exe	96
PID 812 wrote to memory of 2688	812	chrome.exe	97
PID 812 wrote to memory of 912	812	chrome.exe	98
PID 812 wrote to memory of 2688	812	chrome.exe	97
PID 812 wrote to memory of 912	812	chrome.exe	98
PID 812 wrote to memory of 712	812	chrome.exe	99
PID 812 wrote to memory of 712	812	chrome.exe	99
PID 812 wrote to memory of 3312	812	chrome.exe	101
PID 812 wrote to memory of 3312	812	chrome.exe	101
PID 812 wrote to memory of 5428	812	chrome.exe	102
PID 812 wrote to memory of 5428	812	chrome.exe	102
PID 812 wrote to memory of 1676	812	chrome.exe	105
PID 812 wrote to memory of 1676	812	chrome.exe	105
PID 812 wrote to memory of 2424	812	chrome.exe	106
PID 812 wrote to memory of 2424	812	chrome.exe	106
PID 812 wrote to memory of 3464	812	chrome.exe	107
PID 812 wrote to memory of 3464	812	chrome.exe	107
PID 812 wrote to memory of 2576	812	chrome.exe	108
PID 812 wrote to memory of 2576	812	chrome.exe	108
PID 812 wrote to memory of 4184	812	chrome.exe	109
PID 812 wrote to memory of 4184	812	chrome.exe	109
PID 812 wrote to memory of 5656	812	chrome.exe	110
PID 812 wrote to memory of 5656	812	chrome.exe	110
PID 812 wrote to memory of 624	812	chrome.exe	111
PID 812 wrote to memory of 624	812	chrome.exe	111
PID 812 wrote to memory of 5372	812	chrome.exe	112
PID 812 wrote to memory of 5372	812	chrome.exe	112
PID 812 wrote to memory of 1768	812	chrome.exe	113
PID 812 wrote to memory of 1768	812	chrome.exe	113
PID 812 wrote to memory of 5104	812	chrome.exe	114
PID 812 wrote to memory of 5104	812	chrome.exe	114
PID 812 wrote to memory of 2748	812	chrome.exe	115
PID 812 wrote to memory of 2748	812	chrome.exe	115
PID 812 wrote to memory of 5460	812	chrome.exe	116
PID 812 wrote to memory of 5460	812	chrome.exe	116
PID 812 wrote to memory of 1280	812	chrome.exe	117
PID 812 wrote to memory of 1580	812	chrome.exe	119
PID 812 wrote to memory of 3472	812	chrome.exe	120
PID 812 wrote to memory of 696	812	chrome.exe	121
PID 812 wrote to memory of 2964	812	chrome.exe	122
PID 812 wrote to memory of 2964	812	chrome.exe	122
PID 812 wrote to memory of 5448	812	chrome.exe	123
PID 812 wrote to memory of 5448	812	chrome.exe	123
PID 812 wrote to memory of 2244	812	chrome.exe	124
PID 812 wrote to memory of 3452	812	chrome.exe	125
PID 812 wrote to memory of 3464	812	chrome.exe	126
PID 812 wrote to memory of 4560	812	chrome.exe	127
PID 812 wrote to memory of 2036	812	chrome.exe	128
PID 812 wrote to memory of 4480	812	chrome.exe	129
PID 812 wrote to memory of 6060	812	chrome.exe	130
PID 812 wrote to memory of 1316	812	chrome.exe	131
PID 812 wrote to memory of 1248	812	chrome.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/KJRz6r
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb0d17c728,0x7ffb0d17c734,0x7ffb0d17c740
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,13712825464567384312,413173534682741463,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1988,i,2134200672893608518,11091510907172127919,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2952,i,5173661120525568297,4468682094483541659,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2948,i,7574300263882256391,14725213246998309611,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,14086644068717962931,17451935188921552885,262144 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4708,i,2075888462273937249,17512154309835229077,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,17983967682483720611,17302391450842567785,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5304,i,15248504536451609830,3236925302351494667,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5332,i,16105089159431707547,15014624913664028539,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5592,i,9521085790835467827,8664428211122376059,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5640,i,13016234803635062890,8800873219368796040,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5756,i,12106048578777900916,10060281676510946417,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5648,i,17833114640400740139,2487736074366457686,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5980,i,13035451953332465766,9994201039999218191,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6328,i,16438398988408259284,3798665626870884139,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5696,i,6364018002024113705,15696154446934935569,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5872,i,14380899308228859840,13061753828479119507,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6196,i,1277832331883473718,2937596642088694752,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6316,i,4067210985525858835,3473949111324072527,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5732,i,56061499965434451,13724329818671469429,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5924,i,2807012481294933821,2365452174102126956,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5660,i,13510057560795019029,10003384049201670273,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5948,i,7076117615782841388,12481514509246922626,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5508,i,8985272672209602581,10421980545254055470,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6460,i,298609437393211365,18446224779391430209,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6528,i,16322712308328430662,13666556437354179510,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6540,i,4878008631618813762,10328096274716663249,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6544,i,6593438727737867361,15893707090415866990,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6544,i,15123731190035160436,18210523481169885962,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5784,i,8707087636002791360,8638027019689074872,2097152 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4796,i,12312524206270905012,14101624870019841210,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,11363104180756740201,7663391018967539783,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,16143673575064667381,2003102516711074361,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=788,i,3490334044941686866,17132500915832146514,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6456,i,5273422913522548089,2883892882077811182,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,13923162902853962157,5111767500683327606,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,4751000264221077348,18010530736580878895,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,987299828883897299,3928028497854166159,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6448,i,17640501120810172367,9843027688578576081,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6588,i,6971922056769191902,15357771905553519973,262144 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4556,i,16955396000193433496,15125173845440618398,524288 --field-trial-handle=2420,i,18231950567743602099,33941858287912842,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:14
  2⤵
  PID:2340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5264

C:\Users\Admin\Downloads\tc1.exe
"C:\Users\Admin\Downloads\tc1.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:696

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3788

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 134KB
SHA256 b3eb3f58a5586036cacc0c85c82ce822a6f7cd05903880355374a4eb64978cad
MD5 af257e898fc4d8698e29c16c5e7916d7
SHA1 a719be885574bbcb99561c74a14b2b33628d4d1d
SHA512 5e7952047cdd54e6a1a5acbc17aaf1382d78dec3c595facea53d03135d416a407e996ae16334acd3d319b7870a062cd60e96b9eac81390c0fff4c7955c614349
SSDEEP 3072:N4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxB4:N4AhdNorGvHdbi09GJS
TLSH
T11ED36BA1F3051736C26B227AE45A6BB8F33582B493630551B4A9066D60C3DE4873F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 077d4d10dae34cf8c4693033f2c5e5007e08689587a6884c2ae8741a338bac23
MD5 4b818f05eefda690ef15fc388139b27d
SHA1 7a46dc8959e88807bb4dcf2ff1f5a866e9637914
SHA512 2f1381dbd76853bcd1b873ab643390b1c0af76be152384876bb0b9e3380cc800599f478bd83755abebb0aa9510b0d8d0d6eedd9ad822cb8f3b9707459ce595a5
TLSH
T10D01552107A4AFD0D3942F3BE6D4A9A33072675C0E038DE2510544B46B477B45E7836B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 455a278b200f9eaa276e4d2ce4dad2e936389d26fa103facbcb83b06cd7f4300
MD5 3b7d3d94eaea0a8d598cda87775a9df0
SHA1 5035d74ec601b1dae33f99fff2f871cb61d9ffec
SHA512 0f79ad1a48831aa6bb3a59f76c93e489990a490cc6f39574fec41376ce2c0cfe82eb222be998631f978b1b7e57caae6fadb1140633a22c29a33272034d322018
TLSH
T19651B0F7C3E8953D891556F8AB156F2BCE190924432C3C66C8D4AE1B63E28B1E24064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d8e62482d5c94aef92ebb1edfca2191d5651ac84a1ccfd3f3c8a769d05c5bc9f
MD5 31f5ee3f57c47bf4e728af82d8d81be4
SHA1 4adba24339429dd283b39f354b6df365c912f1a7
SHA512 49b3c17941871f021b42b217a3335f72188d5ecc6eda8badb83c1fd229a961341b3b4b227564b5860897136b83c259f04690f801925ecebfef0f3ae5f8b8106f
TLSH
T15751A0F3C3E8953D891556F4EB156F2BCE590A24432C3D76C8D4AE1BA3E2871E24064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 869a5aac1b1788cb7d1a5e3285a5dd0413964b656c6536aa961e3fc42713d50d
MD5 9f4119ea2671585129cfa676540b3d16
SHA1 444e448c067c2063e012ad4e30ad397bd66a802d
SHA512 320c2575788f4b308e4fc66e98daac42f13821fe2da54b6620a8aeea7ac8a6ed2a79833e82fedcd9b0fd9acc1b17edbd633b24681b44e97f15e939cb40f979dd
TLSH
T1B651C0F3C3E8957D8D1556F8EB156F2BCE190A24432C3C66C8D4AE1B63E28B1E24064F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 ce0f7c1ba4bd52a37887a955260e6df3e301967574ebc1789619143991f7ae70
MD5 09c50ab681e9e439712534ee87d96780
SHA1 d1a073f6fbe3b40c79833a7e20c53ff2d8610bc4
SHA512 1c796087db6519ac68e924f5697534fb0f55c6369b0c7a32881a68d8c1a6f98437b10dd19131e93bf81fe8d3f9c4ced6bbe5aca22ead46622baedeeefdb6fb29
TLSH
T1B8319AA796BEB45B20280C6F0D54BD452CB9F831839158F5EAA7C26CB0991F70B16893
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 907946194ee219ad59c3bada6da3f8fe248555e5d17b9de123766f9ba71cadb5
MD5 550784faa50c102fc7b79e4aa72df740
SHA1 052148bd16f00be875b8a17478df7fdae6eed0c0
SHA512 5354ee65e4dc6a68db24fdda278f7d49a3eca60755963b9bbb8bd2e03a987bdbceb0feb34bc416fc0176598ed815775c84936475dd589adc862719aadafaf543
SSDEEP 192:1RMeGTbCYv73vAPRp2TlE96Hsb+WNnRAQ+Fe4rea2VyIsnAUgg7:1RMe2+Eb6XZYwq7e2OK
TLSH
T16032942EAD14753B5CCBC21AFE267B57E6F6102576D42E84EAFC8A2C11EB5CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b03bf876461bdb2dce240d50b0808a65b9708e1da820d6f2c41dfc8dd3d575ef
MD5 322b2d839bc010723765c0c25b3bcc47
SHA1 7020de446b5099d6f22346bf3d4bc5c5c94ff687
SHA512 60ca4d1c2a907efb1935845937e8db95b4e347fc76fe986f37a58ead50a15241a68a7c5b1a8140e3434934633cb194e0912e5fe1afa01514ea5f2d9f37dac526
SSDEEP 192:1RMbGTbCYv73vMPRpHTlE96Hsb+WNnRAQ7wEpreh2VyIsnAUgG7:1RMb2+Eb2XaYwqLEcOw
TLSH
T1E542A72EAD24657B5CCBD21AFD257F57E6F6102136E42E84E6FC8A2C12EB5CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c4b759b26853668f6c6c8e38ae363df9a0e7116d18df6a15e26fca99bae4ce84
MD5 ee48a618b05b50368b0fbd3bf0bf359c
SHA1 c7181c448737d084c1e03f1f5c12e88f3a7bf600
SHA512 23d8df7edcd096713ef5b150d017a3728054610b6844fc3e45fa408b0207b9242521e7340c0c8b65a77fc9d0b43c5d485825cfd72e397d9f43c7601fc8f0ec09
SSDEEP 192:1RM2GTndv73vAPRp2TlE96Hsb+WNnRAQPc2nrea2VyIsnAUgg7:1RM22ndb6XZYwq72TOK
TLSH
T14A32942EAD24753B5CCBC21AFD257B57E6F6102536E42E84EAFC8A2C11EB5CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 bd2d9e74ff7c9eb46dffffe8f3823ec21360dbdef65c14f03094b1bb6e2e2002
MD5 038681e6901dc5df04caaee3d2f93127
SHA1 6c8902c83a5ad3a04e854f7748387dcb1d20750a
SHA512 2086bc8b9a7cf9134ae1864d77a7976ea3eae5434cfac0a23590f501cd8d3b303502bb8618c285dc8b3323c1216096f158f5adef9d667f65fe90f0c093db62aa
SSDEEP 192:1RMbGTbCYv73vAPRp2TlE96Hsb+WNnRAQ7wE+reL2VyIsnAUgG7:1RMb2+Eb6XZYwqLE1Ow
TLSH
T16132A62EAD14757B5CCBD21AFE267B57E6F6102136D42E84E6FC8A2C12EB5CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 d33aba460a84206e582a3bd7c6c7d64eb2aac22b8b3ddcab514d24f1780ee014
MD5 6f5198498b5b9729205cffed14325458
SHA1 3d977170ee353806ea2a3f5e96be737bcd522fa0
SHA512 b90f816a2285124562c4053e1c61ee22164412b151cd2ad38fd3f23ee14d14fed076d2e53af1c9bcee838563142b5ca9a9538fbc1c8d4d31029ee47d356bd881
SSDEEP 192:elW4K6BR7KxkXqK4I40pUZNCgVLHrKHfFKslEtNfXzKD/WJ+ErUkKN9OP1Rhjdd:sWjOR7KxkXqKf/pUZNCgVLH2Hfgslyf5
TLSH
T1C732F82BA54D9A3F4FD8D50DDC126F4FACB5029673680C2466FB9C0803A97CA115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a059b336e1e952a257459913bdb61ad26cf5d4a737cef052b9377862950bba3f
MD5 98c8db2a937a217450af6e4154ae072d
SHA1 2f1f1107cabe18e89216b053613e8169efcd207e
SHA512 36ab1dd58a44365ac626ab27ba433399d3c2809f857102ad57347834fb0ec0640bd06aad5b85256f4079623e42d73d903527ef7335733c22422a67e3bbb7f1a9
SSDEEP 96:7bJ6U6d+acl8CHIuxfTVKn3pXSl8h4otop5rNyDGB6DGyvKtcn1I0MnYgq0j9ISv:7tQZclJo6S7iU2GWjfcnmPnYgqU3
TLSH
T1C9C10971F46D983359B7E657B5023E43CEB8219B9614AF94EAE90F0C05FF4EC2342922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 9f2e7eb75836c117e2cf27afb7f525898ff9bbafd4a938a9fe1337b462fd6d39
MD5 ef030b12df2e53dcbca3bddf24d14591
SHA1 53ca3df107317434344b30446bd3fa2919c3f962
SHA512 40b65699f24bc3bcfa38e41d0ae4e08f48e7397797fe9cd23348dc63f692b4c1351e6cd1c79ab706d993e2e7836571b2f35bd57921689e76cb5acb235b7b38ff
SSDEEP 96:7bJ6U6d+acl8CHIuxfTVKn3pXSl8h4otop5rNyDGB6DGyvKtcIl1Yg0RNC39ISyX:7tQZclJo6S7iU2GWjfcIl1Yg0uCN
TLSH
T19BC1E771E06D993759B3E986B1032E43CDA9206BA6147E99FDED1F0C05EB8EC1342663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 735d017b2028a80ec2eb34ec12db110634921c9f81911e08b8cbe25e9ee2db11
MD5 21233d8db40c5087b881aeff8c6db6f3
SHA1 4d0f3514219f923e4404117473077ee43b7577b8
SHA512 67607a374a10b3a98e685cf714365a8b44c3fec85fdb0b7d8788914bc18494a60bacdab79968b10f5b7d711763bd231c24977f81b5bd45577ac29257837c369f
SSDEEP 96:7bJ6U6d+acl8CHIuxfTVKn3pXSl8h4otop5rNyDGB6DGyvKtcIl1Yg0RNC39ISyX:7tcZclJo6S7iU2GWjfcIl1Yg0uCN
TLSH
T19BD1E871E06D993759B3E98671032E43CDA9206BAA147E99FDED1F0C05EB4EC1383663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 56a25b955fb058d30c0bf964b96d3bbc1a651f5819941d340c41283d096ec2fb
MD5 3411bce688d1ac8988c968a65345792e
SHA1 caf6562b269e46414fb8ae893a79afe184135949
SHA512 2870d4268e90b6511ccbff12dc676755eb5a288e5e4dbab4bcc8c01cd690f5d80477de1238b329f937b2ddff1a43bd6fdb6c6ecf9db11e1cccad845e158fcbe0
SSDEEP 96:3C6U6d+acl8CHIuxfTVKnvpSRDotok5rNTDGB6iGyvKtcJgobB4Rv4a:3CQZclJo6SuDUDlWufcJgobBI
TLSH
T173A10971A17D89335577DA86B9023F03CEB97067A611AFC5E9EC1F0C09FF4A81702612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f2061c0ef1bb67073eb2a869cacaac7f74fd06aa58769a72bcc42e6c9e8c4d58
MD5 294322d00bf5aba5868383fe1f905d4b
SHA1 be46bf3cb1de9a0424d472089443f565ecb3377a
SHA512 c1b80ca4d283d03e343449f9efbf9524365a8a6d48d5e2f10f8ca6f3b8f98585651c4c546bec6a7af588076dcf91c0a10371c29f540366a578eba5b591088d0d
SSDEEP 96:7C6U6d+acl8CHIuxfTVKn3pXSl8h4otop5rNyDGB6DGyvKtcn1I0MnYgq0j9ISF5:7CQZclJo6S7iU2GWjfcnmPnYgqU3
TLSH
T1B5C1FA71F46D983359B7E657B5023E43CEB8219B9614AF94EAE90F0C05FF4EC2342922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\Downloads\libcurl.dll
Size 638KB
SHA256 9883961d1ea6b501420b8d57ac4c22e6786874fc5c33a60f51f1092db6b6d503
MD5 406828dfb7b5b0010ae6ef42aa191edf
SHA1 15d3aad6fb91a25b40589e6a7ffef706171ca709
SHA512 2bb385b88c08c8cbb3679b378d5f88ff6d2a734aec38ba5d3c0735159cf013d5467e873de82853eeb1a0baee2edc1ff7aded7a6b363c2749170795570c58eb03
SSDEEP 12288:W/clYFXBoBWhlYxOw+CyB8nRfTed5/gklQnAPlgTgc:W0lYFXBoBaYxpbBed5/gklQnAPw
TLSH
T1E4D46D55B3F401A9E167C17CC2439623E7B6B0546321A7DB07B4CABA6F13BE2673A350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tc1.exe

Path C:\Users\Admin\Downloads\tc1.exe
Size 5.9MB
SHA256 858d233e6059e7dbec5a480587f08d22cda6188d0f430fbfeaef99754e48d5f0
MD5 a245c74f2cf6542b1b9b14a2f15118c9
SHA1 584b812d701eccd6a07317b1375508b5d65e5bab
SHA512 179fe726c1d906e5b7834127e07a1f468f6b5d903eca93f998f9b5ca68d4306a67d9e12ea4154d064ad41f2be8176fa56dbb9f284f922ea126c578332e90f9a3
SSDEEP 98304:xNHugCdUatmWsiV3xo/Y7mgTm05AwJHE6hgWJLlZqL9PlFk:xrC/j0g7PAmkm/ZqL1lF
TLSH
T18E56AD47B3918198D26A813CCA96DB57E3323C080B1157DB36EC7A5E2F73AD40EBA751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxhash.dll

Path C:\Users\Admin\Downloads\xxhash.dll
Size 57KB
SHA256 c3af6cb87a7f70b2d8546bd01c4875bd1ff6ed9daf470d98c6da55c800f9187e
MD5 466300a481b35f64f8e1478658b0a2c4
SHA1 95fe877d0ceae5b52a6d9c2f063a5fa4d2ffcbf1
SHA512 37e8b0a69fe66549985794e6ac2a48e9725d6027cf78c4c1390007fe63cb7dbd4a787807843cdcc9ec55c67dc7fefad3a2e6b5f2e4b3b5797ae42542f21fb571
SSDEEP 768:upGDuJCwTes5ovICVq1XwxMBP5+injQZOl2GnWrkiASW2fJ:KoOcxKxPjIY
TLSH
T1A1435BDFD952A87CC7C6C33CD79F6D4649B6F6200170472583A361642D136AC8FBAE92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\Downloads\zlib1.dll
Size 86KB
SHA256 16214e465d14ed2badb0bfb00ed2f9797ca9bb5f380e463d464caf9c55ebe2e5
MD5 05b8f5143f3d082213e4d1e0a1a50695
SHA1 74a71d9c074459ed0c9671dc402e697053449d85
SHA512 d113f58040f9a4ecf4316fd2068b33180c010747999f1aba2e0d5b073d8580b6118d09d303eaa2f82dd54bc11e015c59045bae935f78cee4396beb5f4fe69d5f
SSDEEP 1536:Lo5L+dFVRXa8tQahDhaBJeJ6FQMhX/FexTIOcIOZEcydZ/:Lo5La9Xa8+EgJrdh9C1SZEcyr
TLSH
T190838D95AAB422A2D6B34178E8D3479DD335B01403645BDF938CA7691F23AE02F353ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zstd.dll

Path C:\Users\Admin\Downloads\zstd.dll
Size 640KB
SHA256 d580e36ca1480c544c7bf8b036dcd8062168fc966a9761358f12149a22767a23
MD5 be019017d876b97e3114d10fc38c80cc
SHA1 92cf519932d4a1f104c9f74c6094b46bd9ad4964
SHA512 3d39a64f5c618e81efd749edabb3a3888ec4ab9b139221abe570a683890bcf97e73c19d792058d3a65aabe1a5efd92d252a6de6476204d1b84af201bc1690524
SSDEEP 12288:udFgvkkkrBELbqJBPWT/ZKg39+Pedp1FLuOxAtGdiNyb:winGtWT/ZKgtqedp1FqObx
TLSH
T199D48D83F29592ECD02BD139C6565363EBB67C4513006AEB83A0EF653F13AE55B34386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1580-423-0x00007FFB0D520000-0x00007FFB0D537000-memory.dmp

Download