hxxps://wetransfer[.]com/downloads/36602b49750d92ac53c50a10846a9e8320260708101403/31c5bb70bf2f827aba2cfe73434f20a920260708101435/944646?

Resubmissions

09/07/2026, 04:38

260709-e9tv7adv5x4

09/07/2026, 04:36

260709-e77z2acw6l4

09/07/2026, 04:33

260709-e6jk2sdv4t4

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wetransfer.com/downloads/36602b49750d92ac53c50a10846a9e8320260708101403/31c5bb70bf2f827aba2cfe73434f20a920260708101435/944646?
Sample260709-e6jk2sdv4t

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2204	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280452240491416"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4680	chrome.exe
4680	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe
Token: SeShutdownPrivilege	4760	chrome.exe
Token: SeCreatePagefilePrivilege	4760	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe
4760	chrome.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 880	4760	chrome.exe	82
PID 4760 wrote to memory of 2204	4760	chrome.exe	83
PID 4760 wrote to memory of 1676	4760	chrome.exe	84
PID 4760 wrote to memory of 1676	4760	chrome.exe	84
PID 4760 wrote to memory of 1480	4760	chrome.exe	86
PID 4760 wrote to memory of 1480	4760	chrome.exe	86
PID 4760 wrote to memory of 3524	4760	chrome.exe	87
PID 4760 wrote to memory of 564	4760	chrome.exe	88
PID 4760 wrote to memory of 3524	4760	chrome.exe	87
PID 4760 wrote to memory of 564	4760	chrome.exe	88
PID 4760 wrote to memory of 2736	4760	chrome.exe	89
PID 4760 wrote to memory of 2736	4760	chrome.exe	89
PID 4760 wrote to memory of 4812	4760	chrome.exe	90
PID 4760 wrote to memory of 4812	4760	chrome.exe	90
PID 4760 wrote to memory of 2260	4760	chrome.exe	97
PID 4760 wrote to memory of 2260	4760	chrome.exe	97
PID 4760 wrote to memory of 1748	4760	chrome.exe	98
PID 4760 wrote to memory of 1748	4760	chrome.exe	98
PID 4760 wrote to memory of 3520	4760	chrome.exe	101
PID 4760 wrote to memory of 3520	4760	chrome.exe	101
PID 4760 wrote to memory of 1052	4760	chrome.exe	102
PID 4760 wrote to memory of 1052	4760	chrome.exe	102
PID 4760 wrote to memory of 940	4760	chrome.exe	103
PID 4760 wrote to memory of 940	4760	chrome.exe	103
PID 4760 wrote to memory of 4332	4760	chrome.exe	105
PID 4760 wrote to memory of 1908	4760	chrome.exe	106
PID 4760 wrote to memory of 1320	4760	chrome.exe	107
PID 4760 wrote to memory of 4060	4760	chrome.exe	108
PID 4760 wrote to memory of 4060	4760	chrome.exe	108
PID 4760 wrote to memory of 4120	4760	chrome.exe	109
PID 4760 wrote to memory of 5020	4760	chrome.exe	111
PID 4760 wrote to memory of 5020	4760	chrome.exe	111
PID 4760 wrote to memory of 4028	4760	chrome.exe	112
PID 4760 wrote to memory of 4028	4760	chrome.exe	112
PID 4760 wrote to memory of 2728	4760	chrome.exe	113
PID 4760 wrote to memory of 2728	4760	chrome.exe	113
PID 4760 wrote to memory of 212	4760	chrome.exe	114
PID 4760 wrote to memory of 4868	4760	chrome.exe	115
PID 4760 wrote to memory of 4868	4760	chrome.exe	115
PID 4760 wrote to memory of 3380	4760	chrome.exe	116
PID 4760 wrote to memory of 3380	4760	chrome.exe	116
PID 4760 wrote to memory of 4680	4760	chrome.exe	117
PID 4760 wrote to memory of 3720	4760	chrome.exe	118
PID 4760 wrote to memory of 3720	4760	chrome.exe	118
PID 4760 wrote to memory of 2360	4760	chrome.exe	119
PID 4760 wrote to memory of 2360	4760	chrome.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wetransfer.com/downloads/36602b49750d92ac53c50a10846a9e8320260708101403/31c5bb70bf2f827aba2cfe73434f20a920260708101435/944646?
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff9a290c728,0x7ff9a290c734,0x7ff9a290c740
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,14390130606918107710,3141692703052087457,524288 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1732,i,5991622101317753945,11904889378036802852,262144 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,14876075877433972948,12166134816126642458,524288 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,14916118097574469971,1572949983733482465,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,10063399389371631203,1326337766597119355,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,3933413640602953996,15261152978012368189,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4448 /prefetch:2
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3916,i,4856585458383380925,9139299125325626882,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5140,i,17461559032588421903,18046361260747062452,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5340,i,2213553897617783507,3309202735920780256,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5600,i,516694815901164136,979882567989932986,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5892,i,9656533462975324804,15691669173906572014,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6064,i,4609794989329124180,7133758238695580246,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5288,i,7919126610931239833,14733193896200126783,524288 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,10522277220444883806,6075911589754144486,524288 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5280,i,16445695180739100264,10186263505660646827,524288 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5424,i,12293072410840761563,1555516049324201991,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,2305306269001852824,541470101967603144,524288 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4564,i,17751330789991006195,8380160258406269511,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5440,i,5040187706195246171,3299994992186345578,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6448,i,6829172685184638124,13622257991463405168,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,13261218260260283644,13605351083463695858,524288 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7840,i,4239311172796260214,157563451977397322,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7944 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7976,i,5934044145342159041,27739592484151350,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8100 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7648,i,13041885241897842428,10888487148213484168,262144 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6480,i,1236490406161597906,1793392562495817578,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7784 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6032,i,12417907068618232235,13769615641700753057,2097152 --field-trial-handle=2084,i,3907385334722483339,16744329611480853549,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7656 /prefetch:1
  2⤵
  PID:2360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8a8fb969-77b7-4c97-b972-78a64e89ae11.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8a8fb969-77b7-4c97-b972-78a64e89ae11.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6d5bb6a8f2755840926ec84b4aa70cd04043dbd65a70c4e0f46d77c41829e60c
MD5 742fdb8b09632042cdcaa661bc5d15f4
SHA1 c6e8a6b78e63cea3f35ca23834b661a7abdd80c1
SHA512 97b52d9d97faeb78ffbd9907c9300ce4622d6d77329231ea72348a9cbe6ff629dc614ebc0d639781fb9129335da263ebcf092e660100331c38f0a6c4d9402388
TLSH
T154E02BAEC832DD3718FC4B1C50541686E71013662781456F3F3D420C8FB023A41C5C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5dfb35bea51ecf9b0762cb00b2ad516f7695f1a07f1f643caa6671c023b3b9fa
MD5 ee1bf2addd9973b7372ab5e63f25e5ee
SHA1 652daa42beb2bd6118079ba9cab99326ad347c79
SHA512 0064d0decdc9b797ad1c219ece1212bb74f51c2f5eb097d812f14d22fa742d506524aca345ab0bd3a902ad2bd8b131b1aa1fb1af47932e7709b8883895bb5363
TLSH
T123714E9973D78FE9DB98533463B228C77A705001D42E7F9F9D8CE528B9476D1010E86D
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\000003.log
Size 177KB
SHA256 c0451420440fbaadacffc7166ba92d1e82976262d91b656669be749621ef3391
MD5 3ec7c50358cca757c25ebdc8e3d5c57c
SHA1 0f739d90b8e16a2f4c0b6381ff38ccaebad59973
SHA512 8f5160d5afaa11e44b11c1f7a17ff3e72bbd0114330e1aac37371fecb6f9634f0a115f91d34954587e19b81af37204b859d1088d881d125e8ddad2b40e5fd534
SSDEEP 3072:F6BXuui4IbFlZHcHL9pJaXz0vKeb2oxuKhbU6XQ17Z/hOHlh30283KjDtJhiPX4u:ES
TLSH
T1EE04887EC881C837C5F6853AC4E46BCAEB76A8017D815C4AE0DB7E495833A563CD1E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\LOG
Size 347B
SHA256 6c0ac06fff5025231e27466a7e164ffdea206e025867687401f75ac3a86300fb
MD5 19abccfde40d8774719d12ebf1979432
SHA1 90c896ec035ed8adad8f00263331a6daab0ee6b0
SHA512 4e982531229aff9a819208c294d8dc6a864f99dc46ef1aa2f8bc80d26eea4ac696b03c2044e5355dc4ac6acb5a9313d3563007648b036e249b1eb4a388a5ee3e
TLSH
T19EE0D81C99CD826F1114826715B1BB0F9EEEAE0CB7DDBC851F41E41471C545858E82B2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 cf6892b3ef90e3ce1e168ae9edbd2ee28eca08990e452945f80ecd659d3072ab
MD5 1c9d75f71865577f2f2ac6ff967b7d0a
SHA1 57b24b1df373d0f4371b2e811fe19059736e08e8
SHA512 fb38ac317b91db089e46368bf6d191ff06d732d9bb3bb451a9628921e3e743c3b8e5f7d0c2d661754e1925594e14702365d4517cb3b85eae06d66e219621cc07
SSDEEP 384:DoVybWWteHOw1HJKJ3+r/KaIaEdGlo5exi4lbIty7a1flMkls9qxACqRxfKqRGxs:MUwEJSCkP9XrND
TLSH
T10E62D3F3C3E4873DC41552F06B102E1ACD1E0528636D386785E5EE4AE3D34BBE29164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 c52446a7c15e6508e3cc8c837ee418f25595df724e1dabfb0f43ea14549933be
MD5 c1b2041309d906be126e91110a856ac6
SHA1 f19efdc3b667f1e98146774d4eabe4c04cc1e80a
SHA512 70554e1d0c7709d448698e99453810ad0737807deb979593af73c94d066f51e13b5619c1e15c03a5b0fb2aa041409bcfe2f419a3f8e0766a73e63c4aa6a28c3e
SSDEEP 384:DoVybWWteHOw1HJKJ3+rjaIaEdGlo5exi4lbIty7a1flMkls9qxACqRxfKqRGx4Z:MU5EJSCkP9XrvV
TLSH
T13B62D3F3C3E48B3DC41556F06B106E1ACD1E0528636D386785E5EE4AE3D38BBE19164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 15fbec4654fd3da282dbec3452daeebb88d65141d5bf631884272305fb00945c
MD5 2f91e85faf1eacfb7776dca85bc3156e
SHA1 d73a1f74af0c9906d85788eedc55d028c7d3c173
SHA512 4ec7b5dc634a0a90c1a70bde104a8cb12ef8fa3dc6d374b01b7f9f05f311b8fac535a568ed44de95fed36022ab3c5dac8e6197582dfaa2ef99e838efb1e6125a
SSDEEP 192:ARUnRCJ+CStv7YnpAPRp2Se49oHsb+WNnGvFcIG2jXzkwhaVyIsnAUge:ARUnRk8NkUXZuwCM2rzse
TLSH
T14642D86EAD11693B5CCAC32AFA227F93E7F5102125952E84EBFC8A5C25F75DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ff25ea196ea2f02e4a79e3b56d9ce90a28026501dbaac3062e12c381613e5267
MD5 1b319728312943f3ad79ced90861d126
SHA1 9c49f60cc96fde17fbed49227d0b9a15de39f359
SHA512 7861ea34bccb10ef4cb4b9f8e4c367d87d7f474c23742bf3e36b45ed604ae939f4694270679ad70792fc0c1ea6f5b0f8c676ec1a1993b18125ac4275e0e719f7
SSDEEP 192:ARUnVCJ+CSvv7YnpnPRpvSzNe49oHsb+WNnGvKYJqcU6YUXzkwhEVyIsnAUgE:ARUnVk8nkdXSuwCDjY2zaE
TLSH
T15952D66BBD116D3B5CDAD22AFA227F92E3F4102125902E84EBFC8A1C25F75DC2213007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0cd68a1250a9945f4d24d0c214387e2ec67c919d7868efc0973b4c3719b50b3f
MD5 0519548ab624495e12e5cf02929c492d
SHA1 9a2d7ae862458ecc87f2c990fab86de92b365b9d
SHA512 d28b95e56328222dea6ef9651b2b873d502b0469b5039d842d30247856e4a6ee1c58f8d1de04d3743b61b9c5572f3accb4129737a2b2ff634765c3bc33d4d164
SSDEEP 192:ARUnVCJ+CSGv7YnpnPRpvSzNe49oHsb+WNnGvKYJqcU6YUXzkwhEVyIsnAUgE:ARUnVk8ykdXSuwCDjY2zaE
TLSH
T19952D66BBD116D3B5CDAD22AFA227F96E7F5102125902E84EBFC8A1C25F75DC2213007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f2ea378c10e438e2bb7554f409b2f8cc33c66df9ea2ab35a54c0ee9c2861ad77
MD5 a6ef4d38907cc2a478ff7cb6fb031617
SHA1 76c6865d65b86df0cd018f9bbea728ea21a6e2d0
SHA512 ec5af075b97f7f2ce7eb83de6a191076121ab1597bbb3413be1649161d3eabfbba575099e4243b331d4f2748198d326d1a806e8a94acc2ba68a7bd6a8b08d703
SSDEEP 192:ARUnVCJ+CSTv7YnpnPRpvSP4e49oHsb+WNnGvKYJqcU6YUXzkwhEVyIsnAUgE:ARUnVk8rkdXNuwCDjY2zaE
TLSH
T12B52D66BAD11693B5CDAD22AFA227F96E7F4102125902E84EBFC8A1C25F75DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 027836949c2e3612e20bd9e16e96268998daba59f68b531c3ee5c94115afba65
MD5 512e3b132cc3157066911804919d8796
SHA1 d5ec01e9895b8296731cf5721120045c2c88bf11
SHA512 655d48bbc45621725b2ff8e5db36ebb1bbd7ac6d626d26d498fff9bc9201e935f7e88d3c644238bf6c7c19241ec3d4b4f3fa3d0e27fecd40b548e81f928107c6
SSDEEP 192:ARUnVCJ+CSYv7YnpAPRp2Se49oHsb+WNnGvFcU6YmXzkwhAVyIsnAUgE:ARUnVk8EkUXZuwCMYAzeE
TLSH
T1E542C72EAD11693B5CCAD22AFA227F93E7F5102125952E84EBFC8A5C25F75DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d1e8235706125bb79acc4da877de847bff7907af09fc3eb960bd4b554b12f5fd
MD5 702b73109dcc51c70f66f13d93647795
SHA1 f9619ac9bf345729ec52291f13e5a59ec6af04af
SHA512 905de1eb45409f59f2b35a36e16c1800e3ecee8322eff1ded931aab4493b621fae9fc94d77f4599ac959f14582cac1a1dbef4ab8c95bd557ad28a00647655591
SSDEEP 192:ARUnVCJ+CSkv7YnpAPRp2SzNe49oHsb+WNnGvFcU6YmXzkwhAVyIsnAUgE:ARUnVk8AkUX1uwCMYAzeE
TLSH
T1DD52C66BBD11693B5CCAD22AFA227F93E7F5102125952E84EBFC8A1C25F75DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3f9b2ff6733d6ea176b7f87b97bfc00f43ce5ae2fc7db0bf43e5673b611d2981
MD5 a8d99a89af5bdc4d36bda0a26f9a1835
SHA1 eb4f61f12dbd8bc006b66b5635e820349ee33d41
SHA512 c99be19c76c0ad1a08682264926ddb11a255acc2f228d7157f1abd1d4a7df9d1f680e336435cd220b8f27397dfc7a98def0531d0590cc20f63719683618de399
SSDEEP 384:GYjax7KxkXqKf/pUZNCgVLH2Hfgslzh7pLuLcSjoJXODap+ErU3+pHG2xw4483G:Gsax7KxkXqKf/pUZNCgVLH2HfgsVh7p2
TLSH
T15272F967AC48DD370F94CA8CDC277F4FADB9024B65ED846442FA982903D5ADA11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 62KB
SHA256 033536677ec7d5738a0973a33f503f7345947d913c8e494c5e08e0b5c04af3da
MD5 e779a9d5f95ed9f7dfef82c2fed08efd
SHA1 3bc2998c720af910ba652e54bf400be55c18e642
SHA512 796cbe552976dde2fdec235dcfef268548feb50d01cb6df157c93c596de60c4646b7060d13f319d0cc5553a6d8763d9eb4e35957d22bfefc829d68b357ae9027
SSDEEP 1536:/waGJUKEXr6EYQ85iwMiJXH91gb5MV2VhN/gkU0nIjNjHWlvkYNTD:HsXH91gFYNjsZ
TLSH
T16E5309E7341B00A21FE776BFE856E9E5BC33615D6CCC8954FB30892D0384A7C166B998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 1fdeeb805bbae7110068871a52a6c2ca58b241ce336d9baff27b1bb1219a3de3
MD5 6a32a4c02c7411c9d5a062907b15547a
SHA1 a13ba1a46bcc922174ea608d3a908913d75b6ea4
SHA512 03e7e529ccb952a2120573cbb9cf7dfdfc7a2da4aaea0e01c76c38cba745982471499cb15cc5eaa25455a57cba909762e7588edc1e6d9c16c0c7a90da0051647
TLSH
T11DC09B51C6026121C05607F455A555D871A85ED4961E274577F4152F5C3516480591D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586ea3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586ea3.TMP
Size 96B
SHA256 e0854b8ae37b1678036273c5f7524d043a24e524bca8378c972a08c3073daf12
MD5 236e61dcdbdd80d8304c9ad03f68120b
SHA1 fc91b1e41ac137e3e232106e9e3664cb864d54e0
SHA512 a1b59bafec8c295814f1d6506e36a282060d3b6a12d3c14c0170709e8286b98999200872c54cf28dae383540c8eebd1198e3eb5bcf7d3068f5b3a31ceccea76a
TLSH
T160B02200C0033303C00203B038B080CC30B0CF20C2032222C3F00A22EC2022008ECAE0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ebe95af797d6a48fac39dcd9533b0d6a5da246277f387879fe63c9f31d717a12
MD5 427d18abb2c3c6861773f08576dfa727
SHA1 90c3c4e880588b6ea89a06c9ce49523b479f284e
SHA512 01b564f9c0e626683d454e7bf5be7b14bc62ca3d363cea29b5cb1a9f787aa171286c5b04f6cc04057e2c3a30795ae255342677500dfc4b6449cdeb493865fc8f
TLSH
T1B3A00269314A5441C14482B13492814077966E2901822321B0D0694699901954282500
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 c8f0c44b53a4e3cb5af9affb638e8eadeb82e07139b16d86a15de63fa53ec05f
MD5 f2221e34d99e666515ce01413ec91a4a
SHA1 98bf561dac1038528a24425454b2ebe9977fdccf
SHA512 27e97c112d3740af3ab6de22fde93c6bceea5ffc8f98c46280a784d528779ecb862b35974b6eed22492aceb63d87200c5b8576e04d28040b23a41226a55fb1a1
SSDEEP 3072:5xoajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:3HjSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T12BC302E0CAF1CC5BC66542DDE0355ECA89D08DA4E945EA8673DA3F5B382B1CE7A43431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 b512db1019e8c919fe5a3ae0305f80059f6279b324a19329d00889f0e9d29abd
MD5 42c519275f0088ea95706934949e9ea3
SHA1 00e7c4642dde9ad7d2d2dbb18765a19d81ea20a3
SHA512 33f15c2b3f252fc56e95292ff256d8a363f14cfe39b0bec2a8e22d8581a59c4d30749f815bbdc395768893d6e9e408a13d867d6b85f33f146fb9f30054ebf043
SSDEEP 3072:wxoajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:mHjSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T1DDC302E0CAF1CC5BC66542DDE0355ECA89D08DA4E945EA8673DA3F5B382B1CE7A43431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7aea70234fc8a7ba7ea579da1425759fada873860208a91f13068acf5da6c72d
MD5 7c35f73a66950baeee7291c6eef7e8ac
SHA1 34e41a656ebbf42c044d851e0b54742f5ae4da73
SHA512 16913ea0a0313387c8b8e3d3e45ed445e16f61fd4b3fe118c98690fa6555cf49949240cb88953fb12fae164c3aa7ef36e94946ac7e81d25eaf0cbf0647e00be5
SSDEEP 3072:6PajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:5jSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T14BC302D1CBF2CC5BC22542CDF4355BC649D08DA4E945EA8663DA3B5B382F1CA7E07421
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7cf015cbcd98cfa9db9916a5eabecfc0222248290a89f99cf9b8b3d5c83daeb3
MD5 fb7f2368e202fb4a08bb7729a3f81dfa
SHA1 2e3278a0e944aaa91b72a3dcd5e1afe43d0b7025
SHA512 bf1f4538e2899e5a2218fe04aa816b40d365ae6faa4016a59133031e19c231981fa967cac729024dd84abe64198b5c6666a5f3426f1dc9aa1e5573666b57c947
SSDEEP 3072:lMajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:tjSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T108C302D1CAF1CC5BC26542DDE0355ACB89D08DA4E945EA8663DA3B5B342F1CA7B03821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b527df192150cea186bfa34a1e3e7cbbedc1b314604aba98f8c126727840eb50
MD5 7374856f620dbf08cc71b0abe629d853
SHA1 9e7ecfb771496db3daf77b2eb4a6086317deb78a
SHA512 87b9ff526b7a64d6a6dc8f46ff50b2e1a78e0fda55a9d7a9c8ec1188535f146c85b0f0514e521d72193bbba385d3cd46054ae355f8cfdfb1d8a1fed51ab4844e
SSDEEP 3072:SMajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:yjSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T19AC302D1CAF1CC5BC26942DDE0355ACB89D08DA4E945EA8663DA3B5B342F1CA7F03831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9c8c3856246bf99b3cb0fe3931467e3ff2fee27188206c9360ffd477731c1f5a
MD5 4b0d28cd194e220369f388d3c3d7a96d
SHA1 d43313f3fe7f529b6ee352e29e13f901f9ad25ed
SHA512 c4d65cecb3dc01e16e35f4a989b09a65d131e6ef5e1291b78bffb543350389eee7a38c52f2d7cd6a4a5c56d35c9711256e41dd1b1aa28fbd8f74172945d4a28b
SSDEEP 3072:ZMajfaNqkTzjzEndotdvR01Ad4DzaDtBKU7f2GuO48mK0v81N:5jSNqOjQC362d4YtkMf2GuP8mKm+N
TLSH
T1E1C302D1CAF1CC5BC26942DDE0355ACB89D08DA4E945EA8663DA3B5B342F1CA7F07831
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download